Privilege Escalation in Solaris CDE (Extremeparr)

This repository contains a single Metasploit module implementing a local privilege escalation exploit for Solaris systems vulnerable to CVE-2017-3622 (the 'EXTREMEPARR' dtappgather vulnerability). The exploit abuses a directory traversal flaw in the 'dtappgather' executable, allowing a local attacker to create arbitrary directories as root. The module creates a directory in '/usr/lib/locale', writes a malicious shared object to it, and then executes a SUID binary (default: /usr/bin/at) with a crafted environment variable to load the shared object, resulting in code execution as root. The exploit is weaponized, supporting customizable payloads (default: reverse shell) and automatic cleanup. The module is designed for use within the Metasploit framework and targets unpatched Solaris 9 and 10 systems. The code is well-structured, with clear separation of setup, exploitation, and cleanup phases, and includes checks for vulnerable conditions and required binaries.