pwn 0.5.737
Offensive security framework with evasion
“https://github.com/0dayinc/pwn/README.md”
Installs an unrestricted sudoers drop-inSkill claims access-list bypass
SHA-256044ed98a6fcc321ba0b10bba3860bfe90aaa93a0ecec01b93ca78b1d0983a7c9
Evidence
1#!/bin/bash
2hostname=$1
3
4echo 'Updating /etc/sudoers'
5if [[ ! -e '/etc/sudoers.d/jenkins' ]]; then
6 sudo /bin/bash --login -c 'echo "jenkins ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/jenkins'
7fi
8sudo sed -i -e 's/^Defaults.*requiretty/# Defaults requiretty/g' /etc/sudoers
9sudo /bin/bash --login -c 'echo "Defaults:admin !requiretty" >> /etc/sudoers'
10sudo sed -i -e 's/^%sudo.+ALL=(ALL:ALL) ALL/%sudo.+ALL=(ALL:ALL) NOPASSWD:ALL/g' /etc/sudoers
11echo "Updating FQDN: ${hostname}"
12cat /etc/hosts | grep "${hostname}" || sudo sed "s/127.0.0.1/127.0.0.1 ${hostname}/g" -i /etc/hosts
13hostname | grep "${hostname}" || sudo hostname "${hostname}"
14
15# Listens on TCP 80 & 443 by default which collides w/ Apache
16# TCP 80 Collision
17sudo systemctl disable nginx
18sudo systemctl stop nginx
19
20# TCP 443 Collision
21sudo systemctl disable inetsim
22sudo systemctl stop inetsim
1#!/bin/bash --login
2pwn_provider=`echo $PWN_PROVIDER`
3
4# Clenup History
5sudo /bin/bash --login -c 'find /home -type f -name ".*history" -exec shred -u {} \;'
6sudo /bin/bash --login -c 'find /root -type f -name ".*history" -exec shred -u {} \;'
7
8# Cleanup Logs
9sudo /bin/bash --login -c 'find /var/log -type f -name "*.log" | while read log; do > $log; done'
10sudo /bin/bash --login -c 'find /var/log -type f -name "dmesg.*" -exec rm {} \;'
11sudo /bin/bash --login -c '> /var/log/debug'
12sudo /bin/bash --login -c '> /var/log/dmesg'
13sudo /bin/bash --login -c '> /var/log/lastlog'
14sudo /bin/bash --login -c '> /var/log/messages'
15sudo /bin/bash --login -c '> /var/log/syslog'
16sudo /bin/bash --login -c '> /var/log/wtmp'
17
18# Disable Local Root Access
19sudo passwd -l root
20
21if [[ $pwn_provider == 'aws' ]]; then
22 sudo /bin/bash --login -c 'find /etc/ssh -type f -name "*_key*" -exec shred -u {} \;'
23 sudo /bin/bash --login -c 'find /home -type f -name "authorized_keys" -exec shred -u {} \;'
24 sudo /bin/bash --login -c 'apt autoremove -y --purge'
25 # This allows for PacketFu::Utils.whoami? to properly fuction (Used in PWN::Plugins::Packet)
26 # Socket.getifaddrs.each {|ifaddr| puts ifaddr.addr.inspect}; << return nil when teredo interface exists
27 # this breaks https://github.com/packetfu/packetfu/blob/master/lib/packetfu/utils.rb#L196
28 # which tries to call ifaddr.addr.ip? when ifaddr.addr == Nil
29 sudo systemctl stop miredo
30 sudo systemctl disable miredo
31fi
32
33# Clear Bash History
34history -c
35
36if [[ $pwn_provider != 'aws' ]]; then
37 # Create lame password for admin user & reset during deployment via Vagrant
38 echo -e "changeme\nchangeme" | sudo passwd admin
39
40 sudo passwd --expire pwnadmin
41fi
1[Unit]
2Description=RPC interface to the Metasploit Framework
3
4[Service]
5User=root
6RemainAfterExit=yes
7ExecStart=/bin/bash --login -c "msf_ruby_v=$(cat /opt/metasploit-framework-dev/.ruby-version) && source /etc/profile.d/rvm.sh && rvm use ruby-$msf_ruby_v@metasploit-framework && $PWN_ROOT/packer/daemons/msfrpcd.rb --action start"
8ExecReload=/bin/bash --login -c "msf_ruby_v=$(cat /opt/metasploit-framework-dev/.ruby-version) && source /etc/profile.d/rv …
1487:46… oad(opts = {})
1488 uid = Process.uid
1489 domain = "gui/#{uid}/#{opts[:label]}"
1490 system('launchctl', 'bootout', domain, out: File::NULL, err: File::NULL)
1491 unless system('launchctl', 'bootstrap', "gui/#{uid}", opts[:path].to_s, out: File::NULL, err: File::NULL)
1492 system('launchctl', 'unload' …
⋯4 lines
79end
80
81puts 'The following is the public SSH key created for Jenkins:'
82puts `sudo cat /var/lib/jenkins/.ssh/id_rsa-pwn_jenkins.pub`
83puts 'If you intend on leveraging User-Land jobs that will connect to remote hosts via SSH'
84puts 'please ensure you add the aforementioned public key value to your respective ~/.ssh/authorized_keys file.'
85# TODO: End of Potential Race Condition
86`sudo -H -u jenkins /bin/bash --login -c 'chmod 600 #{private_key_path} && chmod 700 #{File.dirname(private_key_path)}'`
Showing the top 5 files — 6 more files (51 regions) not shown.
No evidence locations were recorded for this file. Raw result