@@ -4,30 +4,86 @@ module Msf
4
4
module RPC
5
5
class RPC_Module < RPC_Base
6
6
7
+ # Returns a list of exploit names.
8
+ #
9
+ # @return [Hash] A list of exploit names.
10
+ # * 'modules' [Array] Exploit names, for example: ['windows/wins/ms04_045_wins']
11
+ # @example Here's how you would use this from the client:
12
+ # rpc.call('module.exploits')
7
13
def rpc_exploits
8
14
{ "modules" => self . framework . exploits . keys }
9
15
end
10
16
17
+
18
+ # Returns a list of auxiliary module names.
19
+ #
20
+ # @return [Hash] A list of auxiliary module names.
21
+ # * 'modules' [Array] Auxiliary module names, for example: ['vsploit/pii/web_pii']
22
+ # @example Here's how you would use this from the client:
23
+ # rpc.call('module.auxiliary')
11
24
def rpc_auxiliary
12
25
{ "modules" => self . framework . auxiliary . keys }
13
26
end
14
27
28
+
29
+ # Returns a list of payload module names.
30
+ #
31
+ # @return [Hash] A list of payload module names.
32
+ # * 'modules' [Array] Payload module names, for example: ['windows/x64/shell_reverse_tcp']
33
+ # @example Here's how you would use this from the client:
34
+ # rpc.call('module.payloads')
15
35
def rpc_payloads
16
36
{ "modules" => self . framework . payloads . keys }
17
37
end
18
38
39
+
40
+ # Returns a list of encoder module names.
41
+ #
42
+ # @return [Hash] A list of encoder module names.
43
+ # * 'modules' [Array] Encoder module names, for example: ['x86/unicode_upper']
44
+ # @example Here's how you would use this from the client:
45
+ # rpc.call('module.encoders')
19
46
def rpc_encoders
20
47
{ "modules" => self . framework . encoders . keys }
21
48
end
22
49
50
+
51
+ # Returns a list of NOP module names.
52
+ #
53
+ # @return [Hash] A list of NOP module names.
54
+ # * 'modules' [Array] NOP module names, for example: ['x86/single_byte']
55
+ # @example Here's how you would use this from the client:
56
+ # rpc.call('module.nops')
23
57
def rpc_nops
24
58
{ "modules" => self . framework . nops . keys }
25
59
end
26
60
61
+
62
+ # Returns a list of post module names.
63
+ #
64
+ # @return [Hash] A list of post module names.
65
+ # * 'modules' [Array] Post module names, for example: ['windows/wlan/wlan_profile']
66
+ # @example Here's how you would use this from the client:
67
+ # rpc.call('module.post')
27
68
def rpc_post
28
69
{ "modules" => self . framework . post . keys }
29
70
end
30
71
72
+
73
+ # Returns the metadata of the module.
74
+ #
75
+ # @param [String] mtype Module type. Supported types include (case-sensitive):
76
+ # * exploit
77
+ # * auxiliary
78
+ # * post
79
+ # * nop
80
+ # * payload
81
+ # @param [String] mname Module name. For example: 'windows/wlan/wlan_profile'.
82
+ # @raise [Msf::RPC::Exception] Module not found (either the wrong type or name).
83
+ # @return [Hash] The module's metadata.
84
+ # @example Here's how you would use this from the client:
85
+ # # This gives us the metadata of ms08_067_netapi
86
+ # rpc.call('module.info', 'exploit', 'windows/smb/ms08_067_netapi')
31
87
def rpc_info ( mtype , mname )
32
88
m = _find_module ( mtype , mname )
33
89
res = { }
@@ -74,6 +130,14 @@ def rpc_info(mtype, mname)
74
130
end
75
131
76
132
133
+ # Returns the compatible payloads for a specific exploit.
134
+ #
135
+ # @param [String] mname Exploit module name. For example: 'windows/smb/ms08_067_netapi'.
136
+ # @raise [Msf::RPC::Exception] Module not found (wrong name).
137
+ # @return [Hash] The exploit's compatible payloads.
138
+ # * 'payloads' [Array<string>] A list of payloads. For example: ['generic/custom']
139
+ # @example Here's how you would use this from the client:
140
+ # rpc.call('module.compatible_payloads', 'windows/smb/ms08_067_netapi')
77
141
def rpc_compatible_payloads ( mname )
78
142
m = _find_module ( 'exploit' , mname )
79
143
res = { }
@@ -85,6 +149,15 @@ def rpc_compatible_payloads(mname)
85
149
res
86
150
end
87
151
152
+
153
+ # Returns the compatible sessions for a specific post module.
154
+ #
155
+ # @param [String] mname Post module name. For example: 'windows/wlan/wlan_profile'.
156
+ # @raise [Msf::RPC::Exception] Module not found (wrong name).
157
+ # @return [Hash] The post module's compatible sessions.
158
+ # * 'sessions' [Array<Fixnum>] A list of session IDs.
159
+ # @example Here's how you would use this from the client:
160
+ # rpc.call('module.compatible_sessions', 'windows/wlan/wlan_profile')
88
161
def rpc_compatible_sessions ( mname )
89
162
m = _find_module ( 'post' , mname )
90
163
res = { }
@@ -93,6 +166,17 @@ def rpc_compatible_sessions(mname)
93
166
res
94
167
end
95
168
169
+
170
+ # Returns the compatible target-specific payloads for an exploit.
171
+ #
172
+ # @param [String] mname Exploit module name. For example: 'windows/smb/ms08_067_netapi'
173
+ # @param [Fixnum] target A specific target the exploit module provides.
174
+ # @raise [Msf::RPC::Exception] Module not found (wrong name).
175
+ # @return [Hash] The exploit's target-specific payloads.
176
+ # * 'payloads' [Array<string>] A list of payloads.
177
+ # @example Here's how you would use this from the client:
178
+ # # Find all the compatible payloads for target 1 (Windows 2000 Universal)
179
+ # rpc.call('module.target_compatible_payloads', 'windows/smb/ms08_067_netapi', 1)
96
180
def rpc_target_compatible_payloads ( mname , target )
97
181
m = _find_module ( 'exploit' , mname )
98
182
res = { }
@@ -105,6 +189,21 @@ def rpc_target_compatible_payloads(mname, target)
105
189
res
106
190
end
107
191
192
+
193
+ # Returns the module's datastore options.
194
+ #
195
+ # @param [String] mtype Module type. Supported types include (case-sensitive):
196
+ # * exploit
197
+ # * auxiliary
198
+ # * post
199
+ # * nop
200
+ # * payload
201
+ # @param [String] mname Module name. For example: 'windows/wlan/wlan_profile'.
202
+ # @raise [Msf::RPC::Exception] Module not found (either wrong type or name).
203
+ # @return [Hash] The module's datastore options. This will actually give you each option's
204
+ # data type, requirement state, basic/advanced type, description, default value, etc.
205
+ # @example Here's how you would use this from the client:
206
+ # rpc.call('module.options', 'exploit', 'windows/smb/ms08_067_netapi')
108
207
def rpc_options ( mtype , mname )
109
208
m = _find_module ( mtype , mname )
110
209
res = { }
@@ -131,6 +230,24 @@ def rpc_options(mtype, mname)
131
230
res
132
231
end
133
232
233
+
234
+ # Executes a module.
235
+ #
236
+ # @param [String] mtype Module type. Supported types include (case-sensitive):
237
+ # * exploit
238
+ # * auxiliary
239
+ # * post
240
+ # * payload
241
+ # @param [String] mname Module name. For example: 'windows/smb/ms08_067_netapi'.
242
+ # @param [Hash] opts Options for the module (such as datastore options).
243
+ # @raise [Msf::RPC::Exception] Module not found (either wrong type or name).
244
+ # @return [Hash]
245
+ # * 'job_id' [Fixnum] Job ID.
246
+ # * 'uuid' [String] UUID.
247
+ # @example Here's how you would use this from the client:
248
+ # # Starts a windows/meterpreter/reverse_tcp on port 6669
249
+ # opts = {'LHOST' => '0.0.0.0', 'LPORT'=>6669, 'PAYLOAD'=>'windows/meterpreter/reverse_tcp'}
250
+ # rpc.call('module.execute', 'exploit', 'multi/handler', opts)
134
251
def rpc_execute ( mtype , mname , opts )
135
252
mod = _find_module ( mtype , mname )
136
253
case mtype
@@ -146,11 +263,43 @@ def rpc_execute(mtype, mname, opts)
146
263
147
264
end
148
265
266
+
267
+ # Returns a list of encoding formats.
268
+ #
269
+ # @return [Array] Encoding foramts.
270
+ # @example Here's how you would use this from the client:
271
+ # rpc.call('module.encode_formats')
149
272
def rpc_encode_formats
150
273
# Supported formats
151
274
Msf ::Simple ::Buffer . transform_formats + Msf ::Util ::EXE . to_executable_fmt_formats
152
275
end
153
276
277
+
278
+ # Encoders data with an encoder.
279
+ #
280
+ # @param [String] data Data to encode.
281
+ # @param [encoder] encoder Encoder module name. For example: 'x86/single_byte'.
282
+ # @param [Hash] options Encoding options, such as:
283
+ # * 'format' [String] Encoding format.
284
+ # * 'badchars' [String] Bad characters.
285
+ # * 'platform' [String] Platform.
286
+ # * 'arch' [String] Architecture.
287
+ # * 'ecount' [Fixnum] Number of times to encode.
288
+ # * 'inject' [TrueClass] To enable injection.
289
+ # * 'template' [String] The template file (an executable).
290
+ # * 'template_path' [String] Template path.
291
+ # * 'addshellcode' [String] Custom shellcode.
292
+ # @raise [Msf::RPC::Exception] Invalid format (Error 500).
293
+ # @raise [Msf::RPC::Exception] Failure to encode (Error 500).
294
+ # @return The encoded data
295
+ # * 'encoded' [String] The encoded data in the format you specify.
296
+ # @example Here's how you would use this from the client:
297
+ # # This will encode 'AAAA' with shikata_ga_nai, and prints the following:
298
+ # # unsigned char buf[] =
299
+ # # "\xba\x9e\xb5\x91\x66\xdb\xd2\xd9\x74\x24\xf4\x5f\x29\xc9\xb1"
300
+ # # "\x01\x31\x57\x15\x03\x57\x15\x83\xc7\x04\xe2\x6b\xf4\xd0\x27";
301
+ # result = rpc.call('module.encode', 'AAAA', 'x86/shikata_ga_nai', {'format'=>'c'})
302
+ # puts result['encoded']
154
303
def rpc_encode ( data , encoder , options )
155
304
# Load supported formats
156
305
supported_formats = Msf ::Simple ::Buffer . transform_formats + Msf ::Util ::EXE . to_executable_fmt_formats
0 commit comments