metasploit-framework/lib/msf/core/exploit/tcp.rb

module Msf

###
#
# This module provides methods for establish a connection to a remote host and
# communicating with it.
#
###
module Exploit::Remote::Tcp

	#
	# Initializes an instance of an exploit module that exploits a
	# vulnerability in a TCP server.
	#
	def initialize(info = {})
		super

		register_options(
			[
				Opt::RHOST,
				Opt::RPORT,
				Opt::SSL,
                Opt::Proxies
			], Msf::Exploit::Remote::Tcp)
	end

	#
	# Establishes a TCP connection to the specified RHOST/RPORT
	#
	def connect(global = true)
		nsock = Rex::Socket::Tcp.create(
			'PeerHost'  => datastore['RHOST'],
			'PeerPort'  => datastore['RPORT'].to_i,
			'LocalHost' => datastore['CHOST'] || "0.0.0.0",
			'LocalPort' => datastore['CPORT'] ? datastore['CPORT'].to_i : 0,
			'SSL'       => datastore['SSL'],
            'Proxies'   => datastore['Proxies'],
			'Context'   =>
				{
					'Msf'        => framework,
					'MsfExploit' => self,
				})

		# Set this socket to the global socket as necessary
		self.sock = nsock if (global)

		# Add this socket to the list of sockets created by this exploit
		sockets << nsock

		return nsock
	end

	def handler(nsock = self.sock)
		# If the handler claims the socket, then we don't want it to get closed
		# during cleanup
		if ((rv = super) == Handler::Claimed)
			if (nsock == self.sock)
				self.sock = nil
			end

			# Remove this socket from the list of sockets so that it will not be
			# aborted.
			sockets.delete(nsock)
		end

		return rv
	end

	#
	# Closes the TCP connection
	#
	def disconnect(nsock = self.sock)
		begin
			if (nsock)
				nsock.shutdown
				nsock.close
			end
		rescue IOError
		end

		if (nsock == sock)
			self.sock = nil
		end
	
		# Remove this socket from the list of sockets created by this exploit
		sockets.delete(nsock)
	end

	#
	# Performs cleanup, disconnects the socket if necessary
	#
	def cleanup
		super

		disconnect
	end

	##
	#
	# Wrappers for getters
	#
	##

	#
	# Returns the target host
	#
	def rhost
		datastore['RHOST']
	end

	#
	# Returns the remote port
	#
	def rport
		datastore['RPORT']
	end

	#
	# Returns the local host
	#
	def lhost
		datastore['LHOST']
	end

	#
	# Returns the local port
	#
	def lport
		datastore['LPORT']
	end

protected

	attr_accessor :sock

end


###
#
# This mixin provides a generic interface for running a TCP server of some
# sort that is designed to exploit clients.  Exploits that include this mixin
# automatically take a passive stance.
#
###
module Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Stance' => Msf::Exploit::Stance::Passive))

		register_options(
			[
				OptAddress.new('SRVHOST', [ true, "The local host to listen on."       ]),
				OptPort.new('SRVPORT',    [ true, "The local port to listen on.", 8080 ])
			], Msf::Exploit::Remote::TcpServer)
	end

	#
	# This mixin overrides the exploit method so that it can initiate the
	# service that corresponds with what the client has requested.
	#
	def exploit
		start_service

		print_status("Server started.");
	end

	#
	# Stops the service, if one was created.
	#
	def cleanup
		stop_service

		print_status("Server stopped.");
	end

	#
	# Starts the service.
	#
	def start_service(*args)
	end

	#
	# Stops the service.
	#
	def stop_service
		if (service)
			Rex::ServiceManager.stop_service(self.service)

			self.service.deref
			self.service = nil
		end
	end

	#
	# Returns the local host that is being listened on.
	#
	def srvhost
		datastore['SRVHOST']
	end

	#
	# Returns the local port that is being listened on.
	#
	def srvport
		datastore['SRVPORT']
	end

protected
	
	attr_accessor :service # :nodoc:

end

end