Module: Msf::Exploit::Remote::Tcp

Included in:
Auxiliary::Redis, Auxiliary::Rocketmq, AFP, Arkeia, Asterisk, DB2, DCERPC, DNS::Client, Ftp, Gdb, Imap, Java::Rmi::Client, MSSQL, MYSQL, NDMP, Pop2, Postgres, RDP, RealPort, SMB::Client, SMB::Client::Psexec_MS17_010, SMTPDeliver, Smtp, SunRPC, TNS, Telnet, TincdExploitClient, Web, ZeroMQ
Defined in:
lib/msf/core/exploit/remote/tcp.rb

Overview

This module provides methods for establish a connection to a remote host and communicating with it.

Instance Attribute Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#sock ⇒ Object (protected)

Returns the value of attribute sock.



338
339
340
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 338

def sock
  @sock
end

Instance Method Details

#chost ⇒ Object

Returns the local host for outgoing connections



242
243
244
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 242

def chost
  datastore['CHOST']
end

#cleanup ⇒ Object

Performs cleanup, disconnects the socket if necessary



205
206
207
208
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 205

def cleanup
  super
  disconnect
end

#connect(global = true, opts = {}) ⇒ Object

Establishes a TCP connection to the specified RHOST/RPORT

See Also:

  • Rex::Socket::Tcp
  • Rex::Socket::Tcp.create


91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 91

def connect(global = true, opts={})

  dossl = false
  if(opts.has_key?('SSL'))
    dossl = opts['SSL']
  else
    dossl = ssl
    if (datastore.default?('SSL') and rport.to_i == 443)
      dossl = true
    end
  end

  nsock = Rex::Socket::Tcp.create(
    'PeerHost'      =>  opts['RHOST'] || rhost,
    'PeerHostname'  =>  opts['SSLServerNameIndication'] || opts['VHOST'] || opts['RHOSTNAME'],
    'PeerPort'      => (opts['RPORT'] || rport).to_i,
    'LocalHost'     =>  opts['CHOST'] || chost || "0.0.0.0",
    'LocalPort'     => (opts['CPORT'] || cport || 0).to_i,
    'SSL'           =>  dossl,
    'SSLVersion'    =>  opts['SSLVersion'] || ssl_version,
    'SSLVerifyMode' =>  opts['SSLVerifyMode'] || ssl_verify_mode,
    'SSLKeyLogFile' =>  opts['SSLKeyLogFile'] || sslkeylogfile,
    'SSLCipher'     =>  opts['SSLCipher'] || ssl_cipher,
    'Proxies'       => proxies,
    'Timeout'       => (opts['ConnectTimeout'] || connect_timeout || 10).to_i,
    'Comm'          =>  opts['Comm'],
    'Context'       =>
      {
        'Msf'        => framework,
        'MsfExploit' => self,
      })

  # enable evasions on this socket
  set_tcp_evasions(nsock)

  # Set this socket to the global socket as necessary
  self.sock = nsock if (global)

  # Add this socket to the list of sockets created by this exploit
  add_socket(nsock)

  return nsock
end

#connect_timeout ⇒ Object

Returns the TCP connection timeout



249
250
251
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 249

def connect_timeout
  datastore['ConnectTimeout']
end

#cport ⇒ Object

Returns the local port for outgoing connections



256
257
258
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 256

def cport
  datastore['CPORT']
end

#disconnect(nsock = self.sock) ⇒ Object

Closes the TCP connection



185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 185

def disconnect(nsock = self.sock)
  begin
    if (nsock)
      nsock.shutdown
      nsock.close
    end
  rescue IOError
  end

  if (nsock == sock)
    self.sock = nil
  end

  # Remove this socket from the list of sockets created by this exploit
  remove_socket(nsock)
end

#handler(nsock = self.sock) ⇒ Object 



158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 158

def handler(nsock = self.sock)
  # If the handler claims the socket, then we don't want it to get closed
  # during cleanup
  if ((rv = super) == Handler::Claimed)
    if (nsock == self.sock)
      self.sock = nil
    end

    # Remove this socket from the list of sockets so that it will not be
    # aborted.
    remove_socket(nsock)
  end

  return rv
end

#initialize(info = {}) ⇒ Object

Initializes an instance of an exploit module that exploits a vulnerability in a TCP server.



53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 53

def initialize(info = {})
  super

  register_options(
    [
      Opt::RHOST,
      Opt::RPORT
    ], Msf::Exploit::Remote::Tcp
  )

  register_advanced_options(
    [
      OptBool.new('SSL',        [ false, 'Negotiate SSL/TLS for outgoing connections', false]),
      OptString.new('SSLServerNameIndication', [ false, 'SSL/TLS Server Name Indication (SNI)', nil]),
      Opt::SSLVersion,
      OptEnum.new('SSLVerifyMode',  [ false, 'SSL verification method', 'PEER', %W{CLIENT_ONCE FAIL_IF_NO_PEER_CERT NONE PEER}]),
      OptString.new('SSLCipher',    [ false, 'String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"']),
      OptString.new('SSLKeyLogFile', [ false, 'The SSL key log file', ENV['SSLKeyLogFile']]),
      Opt::Proxies,
      Opt::CPORT,
      Opt::CHOST,
      OptInt.new('ConnectTimeout', [ true, 'Maximum number of seconds to establish a TCP connection', 10])
    ], Msf::Exploit::Remote::Tcp
  )

  register_evasion_options(
    [
      OptInt.new('TCP::max_send_size', [false, 'Maxiumum tcp segment size.  (0 = disable)', 0]),
      OptInt.new('TCP::send_delay', [false, 'Delays inserted before every send.  (0 = disable)', 0])
    ], Msf::Exploit::Remote::Tcp
  )
end

#lhost ⇒ Object

Returns the local host



263
264
265
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 263

def lhost
  datastore['LHOST']
end

#lport ⇒ Object

Returns the local port



270
271
272
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 270

def lport
  datastore['LPORT']
end

#peer ⇒ Object

Returns the rhost:rport



275
276
277
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 275

def peer
  Rex::Socket.to_authority(rhost, rport)
end

#print_prefix ⇒ Object 



210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 210

def print_prefix
  # Only inject a host/port prefix if we have exactly one entry.
  # Otherwise we are logging in the global context where rhost can be any
  # size (being an alias for rhosts), which is not very useful to insert into
  # a single log line.
  unless instance_variable_defined?(:@print_prefix)
    if rhost.present? && Rex::Socket::RangeWalker.new(rhost).length == 1
      @print_prefix = peer + ' - '
    else
      @print_prefix = ''
    end
  end

  super + @print_prefix
end

#proxies ⇒ Object

Returns the proxy configuration



282
283
284
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 282

def proxies
  datastore['Proxies']
end

#replicant ⇒ Object 



226
227
228
229
230
231
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 226

def replicant
  obj = super
  # invalidate the cached print_prefix in case the target changes
  obj.remove_instance_variable(:@print_prefix) if instance_variable_defined?(:@print_prefix)
  obj
end

#rhost ⇒ Object

Returns the target host



289
290
291
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 289

def rhost
  datastore['RHOST']
end

#rport ⇒ Object

Returns the remote port



296
297
298
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 296

def rport
  datastore['RPORT']
end

#set_tcp_evasions(socket) ⇒ Object

Enable evasions on a given client



136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 136

def set_tcp_evasions(socket)

  if( datastore['TCP::max_send_size'].to_i == 0 and datastore['TCP::send_delay'].to_i == 0)
    return
  end

  return if socket.respond_to?('evasive')

  socket.extend(EvasiveTCP)

  if ( datastore['TCP::max_send_size'].to_i > 0)
    socket._send_size = datastore['TCP::max_send_size']
    socket.denagle
    socket.evasive = true
  end

  if ( datastore['TCP::send_delay'].to_i > 0)
    socket._send_delay = datastore['TCP::send_delay']
    socket.evasive = true
  end
end

#shutdown(how = :SHUT_RDWR) ⇒ Object

Shutdown the TCP connection



177
178
179
180
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 177

def shutdown(how = :SHUT_RDWR)
  self.sock.shutdown(how) if self.sock
rescue IOError
end

#ssl ⇒ Object

Returns the boolean indicating SSL



303
304
305
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 303

def ssl
  datastore['SSL']
end

#ssl_cipher ⇒ Object

Returns the SSL cipher to use for the context



332
333
334
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 332

def ssl_cipher
  datastore['SSLCipher']
end

#ssl_verify_mode ⇒ Object

Returns the SSL certification verification mechanism



317
318
319
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 317

def ssl_verify_mode
  datastore['SSLVerifyMode']
end

#ssl_version ⇒ Object

Returns the string indicating SSLVersion



310
311
312
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 310

def ssl_version
  datastore['SSLVersion']
end

#sslkeylogfile ⇒ String

Returns the SSL key log file path

Returns:

  • (String) 


325
326
327
 
# File 'lib/msf/core/exploit/remote/tcp.rb', line 325

def sslkeylogfile
  datastore['SSLKeyLogFile']
end