metasploit-framework/local_exploit_suggester.md at master

10 KiB

Raw Permalink Blame History

The Local Exploit Suggester is a post-exploitation module that you can use to check a system for local vulnerabilities. It performs local exploit checks; it does not actually run any exploits, which is useful because this means you to scan a system without being intrusive. In addition to being stealthy, it's a time saver. You don't have to manually search for local exploits that will work; it'll show you which exploits the target is vulnerable to based on the system's platform and architecture.

The Local Exploit Suggester is available for Python, PHP, Mettle, Java and Windows Meterpreter.

Vulnerable Application

To use the Local Exploit Suggester:

You must have an open Meterpreter or shell session.

Verification Steps

Please see the Overview section.

Options

You can set the following options for the Local Exploit Suggester:

SHOWDESCRIPTION - Set this option to true to see more details about each exploit.
ValidateArch - This option lets us toggle whether or not a mismatch in session and module architecture should be validated or ignored.
ValidatePlatform - This option lets us toggle whether or not a mismatch in session and module platform should be validated or ignored.
ValidateMeterpreterCommands - This option lets us toggle whether or not Meterpreter commands that are missing from the current Meterpreter implementation should be validated or ignored.
Colors - Similar to the option used for HttpTrace. This lets us change the colors used to show valid, invalid and ignored options or incompatibilities. Unsetting this option results in no colored output.

Scenarios

When the Local Exploit Suggester runs, it displays a list of local exploits that the target may be vulnerable to, and it tells the user the likelihood of exploitation.

It also tells the user why the check methods for some exploits did not complete successfully, allowing for easier debugging.

Furthermore, with the Verbose option turned on, a table is printed showing modules that were not considered as valid for the current session, and gives reasons as to why.

The following terms are used to help you understand how vulnerable a target is to a particular exploit:

Vulnerable - Indicates that the target is vulnerable.
Appears - Indicates that the target may be vulnerable based on the file version, but the vulnerable code has not been tested.
Detected - Indicates that the target has the file, but it cannot be determined whether or not the target is vulnerable.

Table Output

Valid Modules

This table is shown by default, and shows which exploits have had their check methods executed, and provides information on the returned result.

Below is an example of how this table could look:

msf6 post(multi/recon/local_exploit_suggester) > run SESSION=-1 Verbose=false

[*] ::1 - Valid modules for session 3:
============================

 #   Name                                                                Potentially Vulnerable?  Check Result
 -   ----                                                                -----------------------  ------------
 1   exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec                 Yes                      The target is vulnerable.
 2   exploit/linux/local/cve_2022_0847_dirtypipe                         Yes                      The target appears to be vulnerable. Linux kernel version found: 5.14.0
 3   exploit/linux/local/cve_2022_0995_watch_queue                       Yes                      The target appears to be vulnerable.
 4   exploit/linux/local/desktop_privilege_escalation                    Yes                      The target is vulnerable.
 5   exploit/linux/local/network_manager_vpnc_username_priv_esc          Yes                      The service is running, but could not be validated.
 6   exploit/linux/local/pkexec                                          Yes                      The service is running, but could not be validated.
 7   exploit/linux/local/polkit_dbus_auth_bypass                         Yes                      The service is running, but could not be validated. Detected polkit framework version 0.105.
 8   exploit/linux/local/su_login                                        Yes                      The target appears to be vulnerable.
 9   exploit/android/local/futex_requeue                                 No                       The check raised an exception.
 10  exploit/linux/local/abrt_raceabrt_priv_esc                          No                       The target is not exploitable.
 11  exploit/linux/local/abrt_sosreport_priv_esc                         No                       The target is not exploitable.
 12  exploit/linux/local/af_packet_chocobo_root_priv_esc                 No                       The target is not exploitable. Linux kernel 5.14.0-kali4-amd64 #1 is not vulnerable
 13  exploit/linux/local/af_packet_packet_set_ring_priv_esc              No                       The target is not exploitable.
 14  exploit/linux/local/apport_abrt_chroot_priv_esc                     No                       The target is not exploitable.
 15  exploit/linux/local/asan_suid_executable_priv_esc                   No                       The check raised an exception.
 16  exploit/linux/local/blueman_set_dhcp_handler_dbus_priv_esc          No                       The target is not exploitable.
 ...
 More modules here
 ...

When output to a terminal window with the Colors datastore option set, the table rows are highlighted appropriately based on the Check Result.

Incompatible Modules

This table is hidden behind the Verbose toggle.

It provides a list of modules that did not have their check method executed, and provides information as to why a module is not compatible with the current session.