Rapid7 Vulnerability & Exploit Database

Multi Escalate Metasploit pcap_log Local Privilege Escalation

Back to Search

Multi Escalate Metasploit pcap_log Local Privilege Escalation



Metasploit < 4.4 contains a vulnerable 'pcap_log' plugin which, when used with the default settings, creates pcap files in /tmp with predictable file names. This exploits this by hard-linking these filenames to /etc/passwd, then sending a packet with a privileged user entry contained within. This, and all the other packets, are appended to /etc/passwd. Successful exploitation results in the creation of a new superuser account. This module requires manual clean-up. Upon success, you should remove /tmp/msf3-session*pcap files and truncate /etc/passwd. Note that if this module fails, you can potentially induce a permanent DoS on the target by corrupting the /etc/passwd file.


  • 0a29406d9794e4f9b30b3c5d6702c708




Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security