For a class on IT security, I want to demonstrate privilege escalation to the students. To do so, I looked through the
exploit/linux/local list in the Metasploit Framework, finding (among others)
exploit/linux/local/sock_sendpage from August 2009.
I set up a VM with 32-bit Ubuntu Server 9.04 (http://old-releases.ubuntu.com/releases/9.04/ubuntu-9.04-server-amd64.iso) from April 2009.
uname -r gives me
2.6.28-11-generic. According to the exploit's description
All Linux 2.4/2.6 versions since May 2001 are believed to be affected: 2.4.4 up to and including 184.108.40.206; 2.6.0 up to and including 220.127.116.11
So it seems that the Ubuntu server that I set up should be suitable for demonstration. However, I was not able to get it to work.
I added a (regular) user on the server and SSH access works. From within the Metasploit Framework, I can create an SSH session using
auxiliary/scanner/ssh/ssh_login. However, when I run the exploit, I get
[*] Writing exploit executable to /tmp/mlcpzP6t (4069 bytes) [*] Exploit completed, but no session was created.
I don't get any further information, not even when setting
DEBUG_EXPLOIT to true.
/tmp is writabe, also from within the Metasploit SSH session:
$ sessions -c "touch /tmp/test.txt" [*] Running 'touch /tmp/test.txt' on shell session 1 ([redacted]) $ sessions -c "ls -l /tmp" [*] Running 'ls -l /tmp' on shell session 1 ([redacted]) total 0 -rw-r--r-- 1 [redacted] [redacted] 0 2016-03-28 09:44 test.txt
I also tried setting
WriteableDir to the user's home directory on the server, but without any changes. What am I missing here? Is this version of Ubuntu server (that I have deliberately not updated!) not vulnerable?