Description
This module exploits a vulnerability in RedHat based systems where improper file permissions are applied to /usr/lib/tmpfiles.d/tomcat.conf for Apache Tomcat versions before 7.0.54-8. This may also work against
The configuration files in tmpfiles.d are used by systemd-tmpfiles to manage temporary files including their creation.
With this weak permission, we're able to inject commands into systemd-tmpfiles service to write a cron job to execute our payload.
systemd-tmpfiles is executed by default on boot on RedHat-based systems through systemd-tmpfiles-setup.service. Depending on the system in use, the execution of systemd-tmpfiles could also be triggered by other services, cronjobs, startup scripts etc.
This module was tested against Tomcat 7.0.54-3 on Fedora 21.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/local/tomcat/rhel_based_temp_priv_escmsf undefined(rhel_based_temp_priv_esc) > show actions ...actions...msf undefined(rhel_based_temp_priv_esc) > set ACTION < action-name >msf undefined(rhel_based_temp_priv_esc) > show options ...show and set options...msf undefined(rhel_based_temp_priv_esc) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub