Multi Escalate Metasploit pcap_log Local Privilege Escalation

Description

Metasploit < 4.4 contains a vulnerable 'pcap_log' plugin which, when used with the default settings, creates pcap files in /tmp with predictable file names. This exploits this by hard-linking these filenames to /etc/passwd, then sending a packet with a privileged user entry contained within. This, and all the other packets, are appended to /etc/passwd.

Successful exploitation results in the creation of a new superuser account.

This module requires manual clean-up. Upon success, you should remove /tmp/msf3-session*pcap files and truncate /etc/passwd. Note that if this module fails, you can potentially induce a permanent DoS on the target by corrupting the /etc/passwd file.