metasploit-framework/lib/msf/core/exploit/tcp.rb

module Msf

###
#
# This module provides methods for establish a connection to a remote host and
# communicating with it.
#
###
module Exploit::Remote::Tcp
	
	def initialize(info = {})
		super

		register_options(
			[
				Opt::RHOST,
				Opt::RPORT,
				Opt::SSL
			], Msf::Exploit::Remote::Tcp)
	end

	#
	# Establishes a TCP connection to the specified RHOST/RPORT
	#
	def connect(global = true)
		nsock = Rex::Socket::Tcp.create(
			'PeerHost'  => datastore['RHOST'],
			'PeerPort'  => datastore['RPORT'].to_i,
			'LocalHost' => datastore['CHOST'] || "0.0.0.0",
			'LocalPort' => datastore['CPORT'] ? datastore['CPORT'].to_i : 0,
			'SSL'       => datastore['SSL'])

		# Set this socket to the global socket as necessary
		self.sock = nsock if (global)

		return nsock
	end

	def handler(nsock = self.sock)
		# If the handler claims the socket, then we don't want it to get closed
		# during cleanup
		if (((rv = super) == Handler::Claimed) and
		    (nsock == self.sock))
			self.sock = nil
		end

		return rv
	end

	#
	# Closes the TCP connection
	#
	def disconnect(nsock = self.sock)
		if (nsock)
			nsock.shutdown
			nsock.close
		end

		if (nsock == sock)
			self.sock = nil
		end
	end

	#
	# Performs cleanup, disconnects the socket if necessary
	#
	def cleanup
		super

		disconnect
	end

	##
	#
	# Wrappers for getters
	#
	##

	#
	# Returns the target host
	#
	def rhost
		datastore['RHOST']
	end

	#
	# Returns the remote port
	#
	def rport
		datastore['RPORT']
	end

	#
	# Returns the local host
	#
	def lhost
		datastore['LHOST']
	end

	#
	# Returns the local port
	#
	def lport
		datastore['LPORT']
	end

protected

	attr_accessor :sock

end


###
#
# TcpServer
# ---------
#
# This mixin provides a generic interface for running a TCP server of some
# sort that is designed to exploit clients.  Exploits that include this mixin
# automatically take a passive stance.
#
###
module Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Stance' => Msf::Exploit::Stance::Passive))

		register_options(
			[
				OptAddress.new('SRVHOST', [ true, "The local host to listen on."       ]),
				OptPort.new('SRVPORT',    [ true, "The local port to listen on.", 8080 ])
			], Msf::Exploit::Remote::TcpServer)
	end

	#
	# This mixin overrides the exploit method so that it can initiate the
	# service that corresponds with what the client has requested.
	#
	def exploit
		start_service

		print_status("Server started.");
	end

	#
	# Stops the service, if one was created.
	#
	def cleanup
		stop_service

		print_status("Server stopped.");
	end

	#
	# Starts the service.
	#
	def start_service(*args)
	end

	#
	# Stops the service.
	#
	def stop_service
		if (service)
			Rex::ServiceManager.stop_service(self.service)

			self.service.deref
			self.service = nil
		end
	end

	#
	# Returns the local host that is being listened on.
	#
	def srvhost
		datastore['SRVHOST']
	end

	#
	# Returns the local port that is being listened on.
	#
	def srvport
		datastore['SRVPORT']
	end

protected
	
	attr_accessor :service

end

end