275 lines
7.1 KiB
Ruby
275 lines
7.1 KiB
Ruby
module Msf
|
|
module Ui
|
|
module Console
|
|
module CommandDispatcher
|
|
|
|
###
|
|
#
|
|
# Exploit module command dispatcher.
|
|
#
|
|
###
|
|
class Exploit
|
|
|
|
include Msf::Ui::Console::ModuleCommandDispatcher
|
|
|
|
@@exploit_opts = Rex::Parser::Arguments.new(
|
|
"-e" => [ true, "The payload encoder to use. If none is specified, ENCODER is used." ],
|
|
"-f" => [ false, "Force the exploit to run regardless of the value of MinimumRank." ],
|
|
"-h" => [ false, "Help banner." ],
|
|
"-j" => [ false, "Run in the context of a job." ],
|
|
"-n" => [ true, "The NOP generator to use. If none is specified, NOP is used." ],
|
|
"-o" => [ true, "A comma separated list of options in VAR=VAL format." ],
|
|
"-p" => [ true, "The payload to use. If none is specified, PAYLOAD is used." ],
|
|
"-t" => [ true, "The target index to use. If none is specified, TARGET is used." ],
|
|
"-z" => [ false, "Do not interact with the session after successful exploitation." ])
|
|
|
|
#
|
|
# Returns the hash of exploit module specific commands.
|
|
#
|
|
def commands
|
|
super.update({
|
|
"check" => "Check to see if a target is vulnerable",
|
|
"exploit" => "Launch an exploit attempt",
|
|
"rcheck" => "Reloads the module and checks if the target is vulnerable",
|
|
"rexploit" => "Reloads the module and launches an exploit attempt",
|
|
"reload" => "Just reloads the module"
|
|
})
|
|
end
|
|
|
|
#
|
|
# Returns the name of the command dispatcher.
|
|
#
|
|
def name
|
|
"Exploit"
|
|
end
|
|
|
|
#
|
|
# Checks to see if a target is vulnerable.
|
|
#
|
|
def cmd_check(*args)
|
|
defanged?
|
|
|
|
begin
|
|
|
|
code = mod.check_simple(
|
|
'LocalInput' => driver.input,
|
|
'LocalOutput' => driver.output)
|
|
|
|
if (code and code.kind_of?(Array) and code.length > 1)
|
|
|
|
if (code == Msf::Exploit::CheckCode::Vulnerable)
|
|
print_good(code[1])
|
|
else
|
|
print_status(code[1])
|
|
end
|
|
|
|
else
|
|
print_error("Check failed: The state could not be determined.")
|
|
end
|
|
|
|
rescue ::Interrupt
|
|
raise $!
|
|
rescue ::Exception => e
|
|
print_error("Exploit check failed: #{e.class} #{e}")
|
|
if(e.class.to_s != 'Msf::OptionValidateError')
|
|
print_error("Call stack:")
|
|
e.backtrace.each do |line|
|
|
break if line =~ /lib.msf.base.simple/
|
|
print_error(" #{line}")
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
#
|
|
# Launches an exploitation attempt.
|
|
#
|
|
def cmd_exploit(*args)
|
|
defanged?
|
|
|
|
opt_str = nil
|
|
payload = mod.datastore['PAYLOAD']
|
|
encoder = mod.datastore['ENCODER']
|
|
target = mod.datastore['TARGET']
|
|
nop = mod.datastore['NOP']
|
|
bg = false
|
|
jobify = false
|
|
force = false
|
|
|
|
# Always run passive exploits in the background
|
|
if (mod.passive?)
|
|
jobify = true
|
|
end
|
|
|
|
@@exploit_opts.parse(args) { |opt, idx, val|
|
|
case opt
|
|
when '-e'
|
|
encoder = val
|
|
when '-f'
|
|
force = true
|
|
when '-j'
|
|
jobify = true
|
|
when '-n'
|
|
nop = val
|
|
when '-o'
|
|
opt_str = val
|
|
when '-p'
|
|
payload = val
|
|
when '-t'
|
|
target = val.to_i
|
|
when '-z'
|
|
bg = true
|
|
when '-h'
|
|
cmd_exploit_help
|
|
return false
|
|
end
|
|
}
|
|
|
|
minrank = RankingName.invert[framework.datastore['MinimumRank']] || 0
|
|
if minrank > mod.rank
|
|
if force
|
|
print_status("Forcing #{mod.refname} to run despite MinimumRank '#{framework.datastore['MinimumRank']}'")
|
|
ilog("Forcing #{mod.refname} to run despite MinimumRank '#{framework.datastore['MinimumRank']}'", 'core')
|
|
else
|
|
print_error("This exploit is below the minimum rank, '#{framework.datastore['MinimumRank']}'.")
|
|
print_error("If you really want to run it, do 'exploit -f' or")
|
|
print_error("setg MinimumRank to something lower ('manual' is")
|
|
print_error("the lowest and would allow running all exploits).")
|
|
return
|
|
end
|
|
end
|
|
|
|
if not payload
|
|
payload = Exploit.choose_payload(mod, target)
|
|
end
|
|
|
|
begin
|
|
session = mod.exploit_simple(
|
|
'Encoder' => encoder,
|
|
'Payload' => payload,
|
|
'Target' => target,
|
|
'Nop' => nop,
|
|
'OptionStr' => opt_str,
|
|
'LocalInput' => driver.input,
|
|
'LocalOutput' => driver.output,
|
|
'RunAsJob' => jobify)
|
|
rescue ::Interrupt
|
|
raise $!
|
|
rescue ::Exception => e
|
|
print_error("Exploit exception (#{mod.refname}): #{e.class} #{e}")
|
|
if(e.class.to_s != 'Msf::OptionValidateError')
|
|
print_error("Call stack:")
|
|
e.backtrace.each do |line|
|
|
break if line =~ /lib.msf.base.simple/
|
|
print_error(" #{line}")
|
|
end
|
|
end
|
|
end
|
|
|
|
# If we were given a session, let's see what we can do with it
|
|
if (session)
|
|
|
|
# If we aren't told to run in the background and the session can be
|
|
# interacted with, start interacting with it by issuing the session
|
|
# interaction command.
|
|
if (bg == false and session.interactive?)
|
|
print_line
|
|
|
|
driver.run_single("sessions -q -i #{session.sid}")
|
|
# Otherwise, log that we created a session
|
|
else
|
|
print_status("Session #{session.sid} created in the background.")
|
|
end
|
|
# If we ran the exploit as a job, indicate such so the user doesn't
|
|
# wonder what's up.
|
|
elsif (jobify)
|
|
if mod.job_id
|
|
print_status("Exploit running as background job.")
|
|
end
|
|
# Worst case, the exploit ran but we got no session, bummer.
|
|
else
|
|
# If we didn't run a payload handler for this exploit it doesn't
|
|
# make sense to complain to the user that we didn't get a session
|
|
unless (mod.datastore["DisablePayloadHandler"])
|
|
print_status("Exploit completed, but no session was created.")
|
|
end
|
|
end
|
|
end
|
|
|
|
def cmd_exploit_help
|
|
print_line "Usage: exploit [options]"
|
|
print_line
|
|
print_line "Launches an exploitation attempt."
|
|
print @@exploit_opts.usage
|
|
end
|
|
|
|
#
|
|
# Reloads an exploit module and checks the target to see if it's
|
|
# vulnerable.
|
|
#
|
|
def cmd_rcheck(*args)
|
|
reload()
|
|
|
|
cmd_check(*args)
|
|
end
|
|
|
|
#
|
|
# Reloads an exploit module and launches an exploit.
|
|
#
|
|
def cmd_rexploit(*args)
|
|
return cmd_rexploit_help if args.include? "-h"
|
|
|
|
# Stop existing job and reload the module
|
|
if reload(true)
|
|
# Delegate to the exploit command unless the reload failed
|
|
cmd_exploit(*args)
|
|
end
|
|
end
|
|
|
|
def cmd_rexploit_help
|
|
print_line "Usage: rexploit [options]"
|
|
print_line
|
|
print_line "Reloads a module, stopping any associated job, and launches an exploitation attempt."
|
|
print @@exploit_opts.usage
|
|
end
|
|
|
|
#
|
|
# Picks a reasonable payload and minimally configures it
|
|
#
|
|
def self.choose_payload(mod, target)
|
|
|
|
# Choose either the real target or an invalid address
|
|
# This is used to determine the LHOST value
|
|
rhost = mod.datastore['RHOST'] || '50.50.50.50'
|
|
|
|
# A list of preferred payloads in the best-first order
|
|
pref = [
|
|
'windows/meterpreter/reverse_tcp',
|
|
'java/meterpreter/reverse_tcp',
|
|
'php/meterpreter/reverse_tcp',
|
|
'php/meterpreter_reverse_tcp',
|
|
'cmd/unix/interact',
|
|
'cmd/unix/reverse',
|
|
'cmd/unix/reverse_perl',
|
|
'cmd/unix/reverse_netcat',
|
|
'windows/meterpreter/reverse_nonx_tcp',
|
|
'windows/meterpreter/reverse_ord_tcp',
|
|
'windows/shell/reverse_tcp',
|
|
'generic/shell_reverse_tcp'
|
|
]
|
|
pset = mod.compatible_payloads.map{|x| x[0] }
|
|
pref.each do |n|
|
|
if(pset.include?(n))
|
|
mod.datastore['PAYLOAD'] = n
|
|
mod.datastore['LHOST'] = Rex::Socket.source_address(rhost)
|
|
return n
|
|
end
|
|
end
|
|
return
|
|
end
|
|
|
|
end
|
|
|
|
end end end end
|
|
|