Add Emacs movemail local exploit against 4.3BSD, inspired by The Cuckoo's Egg

[wvu]

msf5 exploit(unix/local/emacs_movemail) > info

       Name: Emacs movemail Privilege Escalation
     Module: exploit/unix/local/emacs_movemail
   Platform: Unix
       Arch: cmd
 Privileged: Yes
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 1986-08-01

Provided by:
  Markus Hess
  Cliff Stoll
  wvu <wvu@metasploit.com>

Available targets:
  Id  Name
  --  ----
  0   /usr/lib/crontab.local

Check supported:
  Yes

Basic options:
  Name      Current Setting  Required  Description
  ----      ---------------  --------  -----------
  MOVEMAIL  /etc/movemail    yes       Path to movemail
  SESSION                    yes       The session to run this module on.

Payload information:
  Avoid: 1 characters

Description:
  This module exploits a SUID installation of the Emacs movemail
  utility to run a command as root by writing to 4.3BSD's
  /usr/lib/crontab.local. The vulnerability is documented in Cliff
  Stoll's book The Cuckoo's Egg.

References:
  CVE: Not available
  https://en.wikipedia.org/wiki/Movemail
  https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg
  http://pdf.textfiles.com/academics/wilyhacker.pdf
  https://www.gnu.org/software/emacs/manual/html_node/efaq/Security-risks-with-Emacs.html
  https://www.gnu.org/software/emacs/manual/html_node/emacs/Movemail.html
  https://mailutils.org/manual/html_node/movemail.html

[busterb]

LGTM! Wonder if we could get a retro CVE assigned :)

[AmbitiousOkie]

Wunderbra!

[busterb]

Release Notes

The Emacs Movemail Privilege Escalation module has been added to the framework. This is a local exploit against 4.3BSD, inspired by events described in Cliff Stoll's "The Cuckoo's Egg."