{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7379","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7379/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7379/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7379/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/7379","id":180187099,"number":7379,"title":"Linux Kernel BPF Priv Esc (CVE-2016-4557)","user":{"login":"h00die","id":752491,"avatar_url":"https://avatars.githubusercontent.com/u/752491?v=3","gravatar_id":"","url":"https://api.github.com/users/h00die","html_url":"https://github.com/h00die","followers_url":"https://api.github.com/users/h00die/followers","following_url":"https://api.github.com/users/h00die/following{/other_user}","gists_url":"https://api.github.com/users/h00die/gists{/gist_id}","starred_url":"https://api.github.com/users/h00die/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h00die/subscriptions","organizations_url":"https://api.github.com/users/h00die/orgs","repos_url":"https://api.github.com/users/h00die/repos","events_url":"https://api.github.com/users/h00die/events{/privacy}","received_events_url":"https://api.github.com/users/h00die/received_events","type":"User","site_admin":false},"labels":[{"id":125500911,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf","default":false},{"id":103436014,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"closed","locked":false,"assignee":{"login":"pbarry-r7","id":19912177,"avatar_url":"https://avatars.githubusercontent.com/u/19912177?v=3","gravatar_id":"","url":"https://api.github.com/users/pbarry-r7","html_url":"https://github.com/pbarry-r7","followers_url":"https://api.github.com/users/pbarry-r7/followers","following_url":"https://api.github.com/users/pbarry-r7/following{/other_user}","gists_url":"https://api.github.com/users/pbarry-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/pbarry-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbarry-r7/subscriptions","organizations_url":"https://api.github.com/users/pbarry-r7/orgs","repos_url":"https://api.github.com/users/pbarry-r7/repos","events_url":"https://api.github.com/users/pbarry-r7/events{/privacy}","received_events_url":"https://api.github.com/users/pbarry-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"pbarry-r7","id":19912177,"avatar_url":"https://avatars.githubusercontent.com/u/19912177?v=3","gravatar_id":"","url":"https://api.github.com/users/pbarry-r7","html_url":"https://github.com/pbarry-r7","followers_url":"https://api.github.com/users/pbarry-r7/followers","following_url":"https://api.github.com/users/pbarry-r7/following{/other_user}","gists_url":"https://api.github.com/users/pbarry-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/pbarry-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbarry-r7/subscriptions","organizations_url":"https://api.github.com/users/pbarry-r7/orgs","repos_url":"https://api.github.com/users/pbarry-r7/repos","events_url":"https://api.github.com/users/pbarry-r7/events{/privacy}","received_events_url":"https://api.github.com/users/pbarry-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2016-09-29T23:21:42Z","updated_at":"2016-11-11T23:03:25Z","closed_at":"2016-11-11T22:55:07Z","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/7379","html_url":"https://github.com/rapid7/metasploit-framework/pull/7379","diff_url":"https://github.com/rapid7/metasploit-framework/pull/7379.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/7379.patch"},"body":"Exploits CVE-2016-4557.  Metasm wasn't able to compile (no fuse.h from libfuse package), so I went with a check to either compile live on host if all the packages for building were there, or drop binaries.\r\n\r\nUbuntu (Desktop and Server) 16.04 w/ the default 4.4.0-21 kernel works great, i've also had it working with the updated kernel 4.4.0-38\r\n## Verification\r\n\r\nList the steps needed to make sure this thing works\r\n- [x] Start `msfconsole`\r\n- [x] get an initial shell\r\n- [x] `use exploit/linux/local/bpf_priv_esc`\r\n- [x] `set session #`\r\n- [x] `set verbose true`\r\n- [x] `set target #`\r\n- [x] `check`\r\n- [x] `exploit`\r\n- [x] enjoy being root\r\n\r\nThere are 3 things that bother me about this module that I think can help it, but I'm unsure how to accomplish them.\r\n1. When going with mettle payload `shell` and some of the commands don't work. `getuid` and `sysinfo` work fine, but some others dont.\r\n2. `doubleput` and `hello` are still running when you get a shell back, and `doubleput` often is chewing 90%+ CPU.  With those running, you can't unmount /tmp/fuse_mount and remove it.  Killing them manually works, but my attempts at killing them via `cleanup` function calls of `cmd_exec` or through (i forgot the exact name) on_shell function also failed.\r\n\r\nSo in summary, this module works, but it could be better!\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/260075916","html_url":"https://github.com/rapid7/metasploit-framework/pull/7379#issuecomment-260075916","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7379","id":260075916,"user":{"login":"pbarry-r7","id":19912177,"avatar_url":"https://avatars.githubusercontent.com/u/19912177?v=3","gravatar_id":"","url":"https://api.github.com/users/pbarry-r7","html_url":"https://github.com/pbarry-r7","followers_url":"https://api.github.com/users/pbarry-r7/followers","following_url":"https://api.github.com/users/pbarry-r7/following{/other_user}","gists_url":"https://api.github.com/users/pbarry-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/pbarry-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbarry-r7/subscriptions","organizations_url":"https://api.github.com/users/pbarry-r7/orgs","repos_url":"https://api.github.com/users/pbarry-r7/repos","events_url":"https://api.github.com/users/pbarry-r7/events{/privacy}","received_events_url":"https://api.github.com/users/pbarry-r7/received_events","type":"User","site_admin":false},"created_at":"2016-11-11T23:03:25Z","updated_at":"2016-11-11T23:03:25Z","body":"# Release Notes\r\n\r\nThis new exploit module targets a BPF vulnerability in certain Linux kernel versions ([CVE-2016-4557](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4557)), resulting in privilege escalation."}}
{"actor":{"display_login":"pbarry-r7"}}