|
| 1 | +# -*- coding: binary -*- |
| 2 | +module Msf |
| 3 | +module Handler |
| 4 | + |
| 5 | +### |
| 6 | +# |
| 7 | +# This module implements the Bind TCP handler. This means that |
| 8 | +# it will attempt to connect to a remote host on a given port for a period of |
| 9 | +# time (typically the duration of an exploit) to see if a the payload has |
| 10 | +# started listening. This can tend to be rather verbose in terms of traffic |
| 11 | +# and in general it is preferable to use reverse payloads. |
| 12 | +# |
| 13 | +### |
| 14 | +module BindUdp |
| 15 | + |
| 16 | + include Msf::Handler |
| 17 | + |
| 18 | + # |
| 19 | + # Returns the handler specific string representation, in this case |
| 20 | + # 'bind_tcp'. |
| 21 | + # |
| 22 | + def self.handler_type |
| 23 | + return "bind_udp" |
| 24 | + end |
| 25 | + |
| 26 | + # |
| 27 | + # Returns the connection oriented general handler type, in this case bind. |
| 28 | + # |
| 29 | + def self.general_handler_type |
| 30 | + "bind" |
| 31 | + end |
| 32 | + |
| 33 | + # |
| 34 | + # Initializes a bind handler and adds the options common to all bind |
| 35 | + # payloads, such as local port. |
| 36 | + # |
| 37 | + def initialize(info = {}) |
| 38 | + super |
| 39 | + |
| 40 | + register_options( |
| 41 | + [ |
| 42 | + Opt::LPORT(4444), |
| 43 | + OptAddress.new('RHOST', [false, 'The target address', '']), |
| 44 | + ], Msf::Handler::BindUdp) |
| 45 | + |
| 46 | + self.conn_threads = [] |
| 47 | + self.listener_threads = [] |
| 48 | + self.listener_pairs = {} |
| 49 | + end |
| 50 | + |
| 51 | + # |
| 52 | + # Kills off the connection threads if there are any hanging around. |
| 53 | + # |
| 54 | + def cleanup_handler |
| 55 | + # Kill any remaining handle_connection threads that might |
| 56 | + # be hanging around |
| 57 | + conn_threads.each { |thr| |
| 58 | + thr.kill |
| 59 | + } |
| 60 | + end |
| 61 | + |
| 62 | + # |
| 63 | + # Starts a new connecting thread |
| 64 | + # |
| 65 | + def add_handler(opts={}) |
| 66 | + |
| 67 | + # Merge the updated datastore values |
| 68 | + opts.each_pair do |k,v| |
| 69 | + datastore[k] = v |
| 70 | + end |
| 71 | + |
| 72 | + # Start a new handler |
| 73 | + start_handler |
| 74 | + end |
| 75 | + |
| 76 | + # |
| 77 | + # Starts monitoring for an outbound connection to become established. |
| 78 | + # |
| 79 | + def start_handler |
| 80 | + |
| 81 | + # Maximum number of seconds to run the handler |
| 82 | + ctimeout = 150 |
| 83 | + |
| 84 | + # Maximum number of seconds to await initial udp response |
| 85 | + rtimeout = 5 |
| 86 | + |
| 87 | + if (exploit_config and exploit_config['active_timeout']) |
| 88 | + ctimeout = exploit_config['active_timeout'].to_i |
| 89 | + end |
| 90 | + |
| 91 | + # Take a copy of the datastore options |
| 92 | + rhost = datastore['RHOST'] |
| 93 | + lport = datastore['LPORT'] |
| 94 | + |
| 95 | + # Ignore this if one of the required options is missing |
| 96 | + return if not rhost |
| 97 | + return if not lport |
| 98 | + |
| 99 | + # Only try the same host/port combination once |
| 100 | + phash = rhost + ':' + lport.to_s |
| 101 | + return if self.listener_pairs[phash] |
| 102 | + self.listener_pairs[phash] = true |
| 103 | + |
| 104 | + # Start a new handling thread |
| 105 | + self.listener_threads << framework.threads.spawn("BindUdpHandlerListener-#{lport}", false) { |
| 106 | + client = nil |
| 107 | + |
| 108 | + print_status("Started bind handler") |
| 109 | + |
| 110 | + if (rhost == nil) |
| 111 | + raise ArgumentError, |
| 112 | + "RHOST is not defined; bind stager cannot function.", |
| 113 | + caller |
| 114 | + end |
| 115 | + |
| 116 | + stime = Time.now.to_i |
| 117 | + |
| 118 | + while (stime + ctimeout > Time.now.to_i) |
| 119 | + begin |
| 120 | + client = Rex::Socket::Udp.create( |
| 121 | + 'PeerHost' => rhost, |
| 122 | + 'PeerPort' => lport.to_i, |
| 123 | + 'Proxies' => datastore['Proxies'], |
| 124 | + 'Context' => |
| 125 | + { |
| 126 | + 'Msf' => framework, |
| 127 | + 'MsfPayload' => self, |
| 128 | + 'MsfExploit' => assoc_exploit |
| 129 | + }) |
| 130 | + rescue Rex::ConnectionRefused |
| 131 | + # Connection refused is a-okay |
| 132 | + rescue ::Exception |
| 133 | + wlog("Exception caught in bind handler: #{$!.class} #{$!}") |
| 134 | + end |
| 135 | + |
| 136 | + client.extend(Rex::IO::Stream) |
| 137 | + begin |
| 138 | + # If a connection was acknowledged, request a basic response before promoting as a session |
| 139 | + if client |
| 140 | + message = 'syn' |
| 141 | + client.write("echo #{message}\n") |
| 142 | + response = client.get(rtimeout) |
| 143 | + break if response && response.include?(message) |
| 144 | + client.close() |
| 145 | + client = nil |
| 146 | + end |
| 147 | + rescue Errno::ECONNREFUSED |
| 148 | + client.close() |
| 149 | + client = nil |
| 150 | + wlog("Connection failed in udp bind handler continuing attempts: #{$!.class} #{$!}") |
| 151 | + end |
| 152 | + |
| 153 | + # Wait a second before trying again |
| 154 | + Rex::ThreadSafe.sleep(0.5) |
| 155 | + end |
| 156 | + |
| 157 | + # Valid client connection? |
| 158 | + if (client) |
| 159 | + # Increment the has connection counter |
| 160 | + self.pending_connections += 1 |
| 161 | + |
| 162 | + # Timeout and datastore options need to be passed through to the client |
| 163 | + opts = { |
| 164 | + :datastore => datastore, |
| 165 | + :expiration => datastore['SessionExpirationTimeout'].to_i, |
| 166 | + :comm_timeout => datastore['SessionCommunicationTimeout'].to_i, |
| 167 | + :retry_total => datastore['SessionRetryTotal'].to_i, |
| 168 | + :retry_wait => datastore['SessionRetryWait'].to_i, |
| 169 | + :udp_session => true |
| 170 | + } |
| 171 | + |
| 172 | + # Start a new thread and pass the client connection |
| 173 | + # as the input and output pipe. Client's are expected |
| 174 | + # to implement the Stream interface. |
| 175 | + conn_threads << framework.threads.spawn("BindUdpHandlerSession", false, client) { |client_copy| |
| 176 | + begin |
| 177 | + handle_connection(client_copy, opts) |
| 178 | + rescue |
| 179 | + elog("Exception raised from BindUdp.handle_connection: #{$!}") |
| 180 | + end |
| 181 | + } |
| 182 | + else |
| 183 | + wlog("No connection received before the handler completed") |
| 184 | + end |
| 185 | + } |
| 186 | + end |
| 187 | + |
| 188 | + # |
| 189 | + # Nothing to speak of. |
| 190 | + # |
| 191 | + def stop_handler |
| 192 | + # Stop the listener threads |
| 193 | + self.listener_threads.each do |t| |
| 194 | + t.kill |
| 195 | + end |
| 196 | + self.listener_threads = [] |
| 197 | + self.listener_pairs = {} |
| 198 | + end |
| 199 | + |
| 200 | +protected |
| 201 | + |
| 202 | + attr_accessor :conn_threads # :nodoc: |
| 203 | + attr_accessor :listener_threads # :nodoc: |
| 204 | + attr_accessor :listener_pairs # :nodoc: |
| 205 | +end |
| 206 | + |
| 207 | +end |
| 208 | +end |
0 commit comments