multi/manage/sudo writes clear text password to world-readable file in /tmp/

[bcoles]

multi/manage/sudo performs automatic cleanup, but there's still a window of exposure.

In a worst case scenario, the password is present and readable for 120 seconds.

metasploit-framework/modules/post/multi/manage/sudo.rb

Line 100 in d52f039

::Timeout.timeout(120) do

Highlighted in #13886 (comment) but never addressed.

[github-actions]

Hi!

This issue has been left open with no activity for a while now.

We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here.
If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!

As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.

[github-actions]

Hi!

This issue has been left open with no activity for a while now.

We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here.
If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!

As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.