Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
#
2
# This plugin provides an msf daemon interface that spawns a listener on a
3
# defined port (default 55554) and gives each connecting client its own
4
# console interface.  These consoles all share the same framework instance.
5
# Be aware that the console instance that spawns on the port is entirely
6
# unauthenticated, so realize that you have been warned.
7
#
8

9
module Msf
10
  ###
11
  #
12
  # This class implements the msfd plugin interface.
13
  #
14
  ###
15
  class Plugin::Msfd < Msf::Plugin
16

17
    #
18
    # The default local hostname that the server listens on.
19
    #
20
    DefaultHost = '127.0.0.1'.freeze
21

22
    #
23
    # The default local port that the server listens on.
24
    #
25
    DefaultPort = 55554
26

27
    #
28
    # Initializes the msfd plugin.  The following options are supported in the
29
    # hash by this plugin:
30
    #
31
    # ServerHost
32
    #
33
    # 	The local hostname to listen on for connections.  The default is
34
    # 	127.0.0.1.
35
    #
36
    # ServerPort
37
    #
38
    # 	The local port to listen on for connections.  The default is 55554.
39
    #
40
    # SSL
41
    #
42
    #	Use SSL
43
    #
44
    # RunInForeground
45
    #
46
    # 	Instructs the plugin to now execute the daemon in a worker thread and to
47
    # 	instead allow the caller to manage executing the daemon through the
48
    # 	``run'' method.
49
    #
50
    # HostsAllowed
51
    #
52
    #	List of hosts (in NBO) allowed to use msfd
53
    #
54
    # HostsDenied
55
    #
56
    #	List of hosts (in NBO) not allowed to use msfd
57
    #
58
    def initialize(framework, opts)
59
      super
60

61
      # Start listening for connections.
62
      self.server	= Rex::Socket::TcpServer.create(
63
        'LocalHost' => opts['ServerHost'] || DefaultHost,
64
        'LocalPort' => opts['ServerPort'] || DefaultPort,
65
        'SSL' => opts['SSL']
66
      )
67

68
      # If the run in foreground flag is not specified, then go ahead and fire
69
      # it off in a worker thread.
70
      if (opts['RunInForeground'] != true)
71
        Thread.new do
72
          run(opts)
73
        end
74
      end
75
    end
76

77
    #
78
    # Returns 'msfd'
79
    #
80
    def name
81
      'msfd'
82
    end
83

84
    #
85
    # Returns the msfd plugin description.
86
    #
87
    def desc
88
      'Provides a console interface to users over a listening TCP port'
89
    end
90

91
    #
92
    # Runs the msfd plugin by blocking on new connections and then spawning
93
    # threads to handle the console interface for each client.
94
    #
95
    def run(opts = {})
96
      loop do
97
        client = server.accept
98

99
        addr = Rex::Socket.resolv_nbo(client.peerhost)
100

101
        if opts['HostsAllowed'] &&
102
           !opts['HostsAllowed'].find { |x| x == addr }
103
          client.close
104
          next
105
        end
106

107
        if opts['HostsDenied'] &&
108
           opts['HostsDenied'].find { |x| x == addr }
109
          client.close
110
          next
111
        end
112
        msg = "Msfd: New connection from #{client.peerhost}"
113
        ilog(msg, 'core')
114
        print_status(msg)
115

116
        # Spawn a thread for the client connection
117
        Thread.new(client) do |cli|
118
          Msf::Ui::Console::Driver.new(
119
            Msf::Ui::Console::Driver::DefaultPrompt,
120
            Msf::Ui::Console::Driver::DefaultPromptChar,
121
            'Framework' => framework,
122
            'LocalInput' => Rex::Ui::Text::Input::Socket.new(cli),
123
            'LocalOutput' => Rex::Ui::Text::Output::Socket.new(cli),
124
            'AllowCommandPassthru' => false,
125
            'DisableBanner' => opts['DisableBanner'] ? true : false
126
          ).run
127
        rescue StandardError => e
128
          elog('Msfd client error', error: e)
129
        ensure
130
          msg = "Msfd: Closing client connection with #{cli.peerhost}"
131
          ilog(msg, 'core')
132
          print_status(msg)
133
          begin
134
            cli.shutdown
135
            cli.close
136
          rescue IOError
137
          end
138
        end
139
      end
140
    end
141

142
    #
143
    # Closes the listener service.
144
    #
145
    def cleanup
146
      ilog('Msfd: Shutting down server', 'core')
147
      server.close
148
    end
149

150
    protected
151

152
    #
153
    # The listening socket instance.
154
    #
155
    attr_accessor :server
156

157
  end
158
end
159

160