Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
module Msf
2
  module Handler
3
    # Options and methods needed for all handlers that listen for a connection
4
    # from the payload.
5
    module Reverse
6
      autoload :Comm, 'msf/core/handler/reverse/comm'
7
      autoload :SSL, 'msf/core/handler/reverse/ssl'
8

9
      def initialize(info = {})
10
        super
11

12
        register_options(
13
          [
14
            Opt::LHOST,
15
            Opt::LPORT(4444)
16
          ], Msf::Handler::Reverse)
17

18
        register_advanced_options(
19
          [
20
            OptPort.new('ReverseListenerBindPort', [false, 'The port to bind to on the local system if different from LPORT']),
21
            OptBool.new('ReverseAllowProxy', [ true, 'Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST', false]),
22
          ], Msf::Handler::Reverse
23
        )
24
      end
25

26
      def is_loopback_address?(address)
27
        begin
28
           a = IPAddr.new(address.to_s)
29
           return true if IPAddr.new('127.0.0.1/8') === a
30
           return true if IPAddr.new('::1') === a
31
        rescue
32
        end
33
        false
34
      end
35

36
      # A list of addresses to attempt to bind, in preferred order.
37
      #
38
      # @return [Array<String>] a two-element array. The first element will be
39
      #   the address that `datastore['LHOST']` resolves to, the second will
40
      #   be the INADDR_ANY address for IPv4 or IPv6, depending on the version
41
      #   of the first element.
42
      def bind_addresses
43
        # Switch to IPv6 ANY address if the LHOST is also IPv6
44
        addr = Rex::Socket.resolv_nbo(datastore['LHOST'])
45

46
        # First attempt to bind LHOST. If that fails, the user probably has
47
        # something else listening on that interface. Try again with ANY_ADDR.
48
        any = (addr.length == 4) ? "0.0.0.0" : "::0"
49
        addr = Rex::Socket.addr_ntoa(addr)
50

51
        # Checking if LHOST is a loopback address
52
        if is_loopback_address?(addr)
53
          print_warning("You are binding to a loopback address by setting LHOST to #{addr}. Did you want ReverseListenerBindAddress?")
54
        end
55

56
        addrs = [ addr, any ]
57

58
        if not datastore['ReverseListenerBindAddress'].to_s.empty?
59
          # Only try to bind to this specific interface
60
          addrs = [ datastore['ReverseListenerBindAddress'] ]
61

62
          # Pick the right "any" address if either wildcard is used
63
          addrs[0] = any if (addrs[0] == "0.0.0.0" or addrs == "::0")
64
        end
65

66
        addrs
67
      end
68

69
      # @return [Integer]
70
      def bind_port
71
        port = datastore['ReverseListenerBindPort'].to_i
72
        (port > 0) ? port : datastore['LPORT'].to_i
73
      end
74

75
      #
76
      # Starts the listener but does not actually attempt
77
      # to accept a connection.  Throws socket exceptions
78
      # if it fails to start the listener.
79
      #
80
      def setup_handler
81
        if !datastore['Proxies'].blank? && !datastore['ReverseAllowProxy']
82
          raise RuntimeError, "TCP connect-back payloads cannot be used with Proxies. Use 'set ReverseAllowProxy true' to override this behaviour."
83
        end
84

85
        ex = false
86

87
        comm = select_comm
88
        local_port = bind_port
89

90
        bind_addresses.each do |ip|
91
          begin
92
            self.listener_sock = Rex::Socket::TcpServer.create(
93
              'LocalHost' => ip,
94
              'LocalPort' => local_port,
95
              'Comm'      => comm,
96
              'Context'   =>
97
              {
98
                'Msf'        => framework,
99
                'MsfPayload' => self,
100
                'MsfExploit' => assoc_exploit
101
              })
102
          rescue
103
            ex = $!
104
            print_error("Handler failed to bind to #{ip}:#{local_port}:- #{comm} -")
105
          else
106
            ex = false
107
            via = via_string(self.listener_sock.client) if self.listener_sock.respond_to?(:client)
108
            print_status("Started #{human_name} handler on #{ip}:#{local_port} #{via}")
109
            break
110
          end
111
        end
112
        raise ex if (ex)
113
      end
114
    end
115
  end
116
end
117

118