Local privilege escalation in Oracle Solaris Kernel (10/11)

This repository contains a single Metasploit module: 'Solaris RSH Stack Clash Privilege Escalation'. The module exploits a stack clash vulnerability in the setuid /usr/bin/rsh binary on unpatched Solaris 11.1 and 11.3 (x86) systems. The exploit works by uploading and compiling a C exploit (solaris_rsh.c by Qualys) on the target, which manipulates memory to create a SUID root shell. The module then uploads a Metasploit payload (default: cmd/unix/bind_netcat), marks it executable, and runs it as root via the newly created SUID shell. The exploit requires a local session on the target, a writable directory (default: /tmp), and gcc to be present. The module is weaponized, allowing for customizable payloads and automated cleanup. The only fingerprintable endpoints are the /usr/bin/rsh binary and the /tmp directory used for file operations. The code is structured as a standard Metasploit local exploit module, with options for target version, rsh path, and writable directory.