Fixed shell script creation with passwords with special characters

[digitalcombine]

With the post/multi/manage/sudo module I encountered that passwords with the $ character causes this module to fail. This is due to that lack of quoting when generating the script for sudo -s -A. The lack of quoting causes the script to attempt to expand the $ as a variable. For example the password "the$sign" creates the script:

#!/bin/sh
echo the

In sudo.rb on line 102, I changed the line:

cmd_exec("echo echo #{password} >> #{askpass_sh}")
to
cmd_exec("echo 'echo '\"'\"'#{password}'\"'\"'' >> #{askpass_sh}")

This adds quoting to the script generation and to the script itself. Now the password "the$sign" creates the script:

#!/bin/sh
echo 'the$sign'

Special characters in passwords shouldn't cause failures with the exception of the ' character. Thanks to @bwatters-r7 for reviewing the initial change.

[bcoles]

This looks good to me. I'll merge when the automated tests pass.

msf5 exploit(multi/handler) > [*] Command shell session 1 opened (172.16.191.165:1338 -> 172.16.191.166:56910) at 2020-07-23 09:33:20 -0400

msf5 exploit(multi/handler) > use post/multi/manage/sudo 
msf5 post(multi/manage/sudo) > set verbose true
verbose => true
msf5 post(multi/manage/sudo) > set password asdf$asdf`
password => asdf$asdf`
msf5 post(multi/manage/sudo) > set session 1 
session => 1
msf5 post(multi/manage/sudo) > run

[*] SUDO: Attempting to upgrade to UID 0 via sudo
[*] Sudoing with password `asdf$asdf`'.
[*] Writing the SUDO_ASKPASS script: /tmp/.lLQQnVV
[*] Max line length is 4096
[*] Writing 28 bytes in 1 chunks of 102 bytes (octal-encoded), using printf
[*] Setting executable bit.
[*] Setting environment variable.
[*] Executing sudo -s -A
[+] SUDO: Root shell secured.
[*] Post module execution completed
msf5 post(multi/manage/sudo) > sessions -i 1 
[*] Starting interaction with 1...

id
uid=0(root) gid=0(root) groups=0(root)

[bcoles]

@digitalcombine Are you keen to take a look at some of the other issues with this module? (in a separate PR)

• multi/manage/sudo leaves clear text password in world-readable file in /tmp/ (multi/manage/sudo leaves clear text password in world-readable file in /tmp/ #13893). Ideally it should cleanup the file afterwards, either by using register_file_for_cleanup or rm_f.

• It should bail out with Failure::BadConfig if the session type is meterpreter as it is not compatible.

• ... + more. The entire module could use a review.

[bcoles]

Release Notes

Fixed the post/multi/manage/sudo module support for passwords containing shell substitution and meta characters.

[digitalcombine]

@bcoles definitely. I started looking into removing the evidence, might as well continue on.