WIP: LPE CVE-2024-1086

[h00die]

Fixes: #19153

WIP exploit for CVE-2024-1086 . Running the exploit by hand on the box seems fairly reliable. However running it through metasploit currently results in about 75% hard lock of the box either instantly, or within 6min. 25% of the time its perfect though!

Only been testing the live build functionality, not the 'drop a pre-complied binary' branch

I forgot to bring along a bunch of the library files as well, so need to add those back.

[jvoisin]

Suggested change

	release = kernel_release
	if (
	Rex::Version.new(release.split('-').first) >= Rex::Version.new('5.15.0') &&
	Rex::Version.new(release.split('-').first) < Rex::Version.new('6.0')
	) ||
	(
	Rex::Version.new(release.split('-').first) < Rex::Version.new('6.6') &&
	Rex::Version.new(release.split('-').first) >= Rex::Version.new('6.0')
	)
	return CheckCode::Appears("Kernel version #{release} appears to be vulnerable")
	end
	release = kernel_release().split('-').first
	if release.between(Rex::Version.new('5.15.0'), Rex::Version.new('6.0'))
	return CheckCode::Appears("Kernel version #{release} appears to be vulnerable")
	elsif release.between(Rex::Version.new('6.0'), Rex::Version.new('6.6'))
	return CheckCode::Appears("Kernel version #{release} appears to be vulnerable")
	end

but it seems that this can be simplified even further to:

    release = kernel_release().split('-').first
    if release.between(Rex::Version.new('5.15.0'), Rex::Version.new('6.6'))
      return CheckCode::Appears("Kernel version #{release} appears to be vulnerable")
    end

[jvoisin]

This will only work on Debian :/

[jvoisin]

Can't the files be concatenated instead?

[jvoisin]

A couple of IDS are flagging binary execution happening instead hidden folders. I think it'd be better to let the user specify the full path of the folder.