Class: Msf::Ui::Console::CommandDispatcher::Payload

Inherits:
Object
  • Object
show all
Includes:
ModuleCommandDispatcher, ModuleOptionTabCompletion
Defined in:
lib/msf/ui/console/command_dispatcher/payload.rb

Overview

Payload module command dispatcher.

Constant Summary collapse

@@supported_formats =

Load supported formats

Msf::Simple::Buffer.transform_formats + \
Msf::Util::EXE.to_executable_fmt_formats
@@generate_opts = 
Rex::Parser::Arguments.new(
  '-p' => [ true, 'The platform of the payload' ],
  '-n' => [ true, 'Prepend a nopsled of [length] size on to the payload' ],
  '-f' => [ true, "Output format: #{@@supported_formats.join(',')}" ],
  '-E' => [ false, 'Force encoding' ],
  '-e' => [ true, 'The encoder to use' ],
  '-P' => [ true, 'Total desired payload size, auto-produce appropriate NOP sled length'],
  '-S' => [ true, 'The new section name to use when generating (large) Windows binaries'],
  '-b' => [ true, "The list of characters to avoid example: '\\x00\\xff'" ],
  '-i' => [ true, 'The number of times to encode the payload' ],
  '-x' => [ true, 'Specify a custom executable file to use as a template' ],
  '-k' => [ false, 'Preserve the template behavior and inject the payload as a new thread' ],
  '-o' => [ true, 'The output file name (otherwise stdout)' ],
  '-O' => [ true, "Deprecated: alias for the '-o' option" ],
  '-v' => [ false, 'Verbose output (display stage in addition to stager)' ],
  '-h' => [ false, 'Show this message' ]
)

Instance Attribute Summary

Attributes included from Msf::Ui::Console::CommandDispatcher

#driver

Attributes included from Rex::Ui::Text::DispatcherShell::CommandDispatcher

#shell, #tab_complete_items

Instance Method Summary collapse

Methods included from ModuleOptionTabCompletion

#option_values_actions, #option_values_dispatch, #option_values_encoders, #option_values_nops, #option_values_payloads, #option_values_sessions, #option_values_target_addrs, #option_values_target_ports, #option_values_targets, #tab_complete_datastore_names, #tab_complete_module_datastore_names, #tab_complete_option, #tab_complete_option_names, #tab_complete_option_values, #tab_complete_source_interface

Methods included from ModuleCommandDispatcher

#check_multiple, #check_progress, #check_show_progress, #check_simple, #cmd_check, #cmd_check_help, #cmd_reload, #cmd_reload_help, #mod, #mod=, #reload, #report_vuln

Methods included from ModuleArgumentParsing

#append_datastore_option, #parse_check_opts, #parse_exploit_opts, #parse_opts, #parse_run_opts, #print_module_run_or_check_usage, #quote_whitespaced_value, #resembles_datastore_assignment?, #resembles_rhost_value?

Methods included from Msf::Ui::Console::CommandDispatcher

#active_module, #active_module=, #active_session, #active_session=, #build_range_array, #docs_dir, #framework, #initialize, #load_config, #log_error, #remove_lines

Methods included from Rex::Ui::Text::DispatcherShell::CommandDispatcher

#cmd_help, #cmd_help_help, #cmd_help_tabs, #deprecated_cmd, #deprecated_commands, #deprecated_help, #docs_dir, #help_to_s, included, #initialize, #print, #print_error, #print_good, #print_line, #print_status, #print_warning, #tab_complete_directory, #tab_complete_filenames, #tab_complete_generic, #tab_complete_source_address, #unknown_command, #update_prompt

Instance Method Details

#cmd_generate(*args) ⇒ Object

Generates a payload.



105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 105

def cmd_generate(*args)
  # Parse the arguments
  encoder_name = nil
  sled_size = nil
  pad_nops = nil
  sec_name = nil
  option_str = nil
  badchars = nil
  format = 'ruby'
  ofile = nil
  iter = 1
  force = nil
  template = nil
  plat = nil
  keep = false
  verbose = false

  @@generate_opts.parse(args) do |opt, _idx, val|
    case opt
    when '-b'
      badchars = Rex::Text.dehex(val)
    when '-e'
      encoder_name = val
    when '-E'
      force = true
    when '-n'
      sled_size = val.to_i
    when '-P'
      pad_nops = val.to_i
    when '-S'
      sec_name = val
    when '-f'
      format = val
    when '-o'
      if val.include?('=')
        print_error("The -o parameter of 'generate' is now preferred to indicate the output file, like with msfvenom\n")
        option_str = val
      else
        ofile = val
      end
    when '-O'
      print("Usage of the '-O' parameter is deprecated, prefer '-o' to indicate the output file")
      ofile = val
    when '-i'
      iter = val
    when '-k'
      keep = true
    when '-p'
      plat = val
    when '-x'
      template = val
    when '-v'
      verbose = true
    when '-h'
      cmd_generate_help
      return false
    else
      unless val.include?('=')
        cmd_generate_help
        return false
      end

      mod.datastore.import_options_from_s(val)
    end
  end
  if encoder_name.nil? && mod.datastore['ENCODER']
    encoder_name = mod.datastore['ENCODER']
  end

  # Generate the payload
  begin
    buf = mod.generate_simple(
      'BadChars' => badchars,
      'Encoder' => encoder_name,
      'Format' => format,
      'NopSledSize' => sled_size,
      'PadNops' => pad_nops,
      'SecName' => sec_name,
      'OptionStr' => option_str,
      'ForceEncode' => force,
      'Template' => template,
      'Platform' => plat,
      'KeepTemplateWorking' => keep,
      'Iterations' => iter,
      'Verbose' => verbose
    )
  rescue StandardError
    log_error("Payload generation failed: #{$ERROR_INFO}")
    return false
  end

  if !ofile
    # Display generated payload
    puts(buf)
  else
    print_status("Writing #{buf.length} bytes to #{ofile}...")
    fd = File.open(ofile, 'wb')
    fd.write(buf)
    fd.close
  end
  true
end

#cmd_generate_help ⇒ Object 



93
94
95
96
97
98
99
100
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 93

def cmd_generate_help
  print_line 'Usage: generate [options]'
  print_line
  print_line 'Generates a payload. Datastore options may be supplied after normal options.'
  print_line
  print_line 'Example: generate -f python LHOST=127.0.0.1'
  print @@generate_opts.usage
end

#cmd_generate_tabs(str, words) ⇒ Object

Tab completion for the generate command



211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 211

def cmd_generate_tabs(str, words)
  fmt = {
    '-b' => [ true ],
    '-E' => [ nil ],
    '-e' => [ framework.encoders.map { |refname, _mod| refname } ],
    '-h' => [ nil ],
    '-o' => [ :file ],
    '-P' => [ true ],
    '-S' => [ true ],
    '-f' => [ @@supported_formats ],
    '-p' => [ true ],
    '-k' => [ nil ],
    '-x' => [ :file ],
    '-i' => [ true ],
    '-v' => [ nil ]
  }
  flags = tab_complete_generic(fmt, str, words)
  options = tab_complete_option(active_module, str, words)
  flags + options
end

#cmd_to_handler(*args) ⇒ Object Also known as: cmd_exploit 



48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 48

def cmd_to_handler(*args)
  if args.include?('-r') || args.include?('--reload-libs')
    driver.run_single('reload_lib -a')
  end

  handler = framework.modules.create('exploit/multi/handler')

  handler_opts = {
    'Payload' => mod.refname,
    'LocalInput' => driver.input,
    'LocalOutput' => driver.output,
    'RunAsJob' => true,
    'Options' => {
      'ExitOnSession' => false
    }
  }

  handler.share_datastore(mod.datastore)

  replicant_handler = nil
  handler.exploit_simple(handler_opts) do |yielded_replicant_handler|
    replicant_handler = yielded_replicant_handler
  end

  if replicant_handler.nil?
    print_error('Failed to run module')
    return
  end

  if replicant_handler.error.nil?
    job_id = handler.job_id

    print_status "Payload Handler Started as Job #{job_id}"
  end
end

#commands ⇒ Object

Returns the hash of commands specific to payload modules.



40
41
42
43
44
45
46
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 40

def commands
  super.update(
    'generate' => 'Generates a payload',
    'to_handler' => 'Creates a handler with the specified payload',
    'exploit' => 'Creates a handler with the specified payload'
  )
end

#name ⇒ Object

Returns the command dispatcher name.



89
90
91
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 89

def name
  'Payload'
end