metasploit-gs/lib/msf/core/handler/reverse_ssh.rb

# -*- coding: binary -*-
require 'rex/socket'
require 'thread'
require 'msf/core/handler/reverse_tcp'

module Msf
module Handler

###
#
# This handler implements the SSH tunneling interface.
#
###
module ReverseSsh

  include Msf::Handler::ReverseTcp

  #
  # Returns the string representation of the handler type
  #
  def self.handler_type
    return 'reverse_ssh'
  end

  #
  # Returns the connection-described general handler type, in this case
  # 'tunnel'.
  #
  def self.general_handler_type
    "tunnel"
  end

  # Initializes the reverse SSH handler and ads the options that are required
  # for all reverse SSH payloads, like version string and auth params.
  #
  def initialize(info = {})
    super
    register_advanced_options(
      [
        OptString.new('Ssh::Version', [
          true,
          'The SSH version string to provide',
          Rex::Proto::Ssh::Connection.default_options['local_version']
        ])
      ], Msf::Handler::ReverseSsh
    )
  end

  # A URI describing where we are listening
  #
  # @param addr [String] the address that
  # @return [String] A URI of the form +ssh://host:port/+
  def listener_uri(addr=datastore['ReverseListenerBindAddress'])
    addr = datastore['LHOST'] if addr.nil? || addr.empty?
    uri_host = Rex::Socket.is_ipv6?(addr) ? "[#{addr}]" : addr
    "ssh://#{uri_host}:#{bind_port}"
  end

  # Create an Ssh listener
  #
  # @return [void]
  def setup_handler

    local_addr = nil
    local_port = bind_port
    ex = false

    ssh_opts = Rex::Proto::Ssh::Connection.default_options
    ssh_opts['local_version'] = datastore['Ssh::Version']

    # Start the SSH server service on this host/port
    bind_addresses.each do |ip|
      begin
        self.service = Rex::ServiceManager.start(Rex::Proto::Ssh::Server,
          local_port, ip,
          {
            'Msf'        => framework,
            'MsfExploit' => self,
          },
          comm,
          ssh_opts
        )
        local_addr = ip
      rescue
        ex = $!
        print_error("Handler failed to bind to #{ip}:#{local_port}")
      else
        ex = false
        break
      end
    end

    raise ex if (ex)

    print_status("Started SSH reverse handler on #{listener_uri(local_addr)}")

    if datastore['IgnoreUnknownPayloads']
      print_status("Handler is ignoring unknown payloads")
    end
  end

  # Stops the handler & service
  #
  # @return [void]
  def stop_handler
    if self.service
      if self.sessions == 0
        Rex::ServiceManager.stop_service(self.service)
      end
    end
  end

  attr_accessor :service # :nodoc:

protected


end
end
end