Saverr/pwncat
1
0
Fork 0
mirror of https://github.com/calebstewart/pwncat.git synced 2024-11-27 19:04:15 +01:00
Code Projects Releases Wiki Activity

Added some improved setuid stuff

Browse Source
This commit is contained in:
Caleb Stewart 2020-05-09 17:19:14 -04:00
parent 068c55f868
commit 3692566a45
2 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
pwncat/privesc/setuid.py
View File

@ -86,14 +86,23 @@ class SetuidMethod(Method):
def __init__(self, pty: "pwncat.pty.PtyHandler"): def __init__(self, pty: "pwncat.pty.PtyHandler"):
super(SetuidMethod, self).__init__(pty) super(SetuidMethod, self).__init__(pty)
self.suid_paths = None self.users_searched = []
self.suid_paths = {}
def find_suid(self): def find_suid(self):
current_user = self.pty.whoami()
# Only re-run the search if we haven't searched as this user yet
if current_user in self.users_searched:
return
# Note that we already searched for binaries as this user
self.users_searched.append(current_user)
# Spawn a find command to locate the setuid binaries # Spawn a find command to locate the setuid binaries
delim = self.pty.process("find / -perm -4000 -print 2>/dev/null") delim = self.pty.process("find / -perm -4000 -print 2>/dev/null")
files = [] files = []
self.suid_paths = {}
while True: while True:
path = self.pty.recvuntil(b"\n").strip() path = self.pty.recvuntil(b"\n").strip()
@ -112,12 +121,14 @@ class SetuidMethod(Method):
) )
if user not in self.suid_paths: if user not in self.suid_paths:
self.suid_paths[user] = [] self.suid_paths[user] = []
# Only add new binaries
if path not in self.suid_paths[user]:
self.suid_paths[user].append(path) self.suid_paths[user].append(path)
def enumerate(self) -> List[Technique]: def enumerate(self) -> List[Technique]:
""" Find all techniques known at this time """ """ Find all techniques known at this time """
if self.suid_paths is None: # Update the cache for the current user
self.find_suid() self.find_suid()
for user, paths in self.suid_paths.items(): for user, paths in self.suid_paths.items():

2
pwncat/privesc/sudo.py
View File

@ -234,8 +234,6 @@ class SudoMethod(Method):
technique.user, sudo_spec, self.pty.shell technique.user, sudo_spec, self.pty.shell
) )
print(shell_payload)
# Run the commands # Run the commands
self.pty.run(shell_payload + "\n", wait=False) self.pty.run(shell_payload + "\n", wait=False)