Module: Msf::Exploit::Remote::Tcp

Overview

This module provides methods for establish a connection to a remote host and communicating with it.

Instance Attribute Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#sockObject (protected)

Returns the value of attribute sock.


314
315
316
# File 'lib/msf/core/exploit/remote/tcp.rb', line 314

def sock
  @sock
end

Instance Method Details

#chostObject

Returns the local host for outgoing connections


226
227
228
# File 'lib/msf/core/exploit/remote/tcp.rb', line 226

def chost
  datastore['CHOST']
end

#cleanupObject

Performs cleanup, disconnects the socket if necessary


200
201
202
203
# File 'lib/msf/core/exploit/remote/tcp.rb', line 200

def cleanup
  super
  disconnect
end

#connect(global = true, opts = {}) ⇒ Object

Establishes a TCP connection to the specified RHOST/RPORT

See Also:

  • Rex::Socket::Tcp
  • Rex::Socket::Tcp.create

89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
# File 'lib/msf/core/exploit/remote/tcp.rb', line 89

def connect(global = true, opts={})

  dossl = false
  if(opts.has_key?('SSL'))
    dossl = opts['SSL']
  else
    dossl = ssl
    if (datastore.default?('SSL') and rport.to_i == 443)
      dossl = true
    end
  end

  nsock = Rex::Socket::Tcp.create(
    'PeerHost'      =>  opts['RHOST'] || rhost,
    'PeerPort'      => (opts['RPORT'] || rport).to_i,
    'LocalHost'     =>  opts['CHOST'] || chost || "0.0.0.0",
    'LocalPort'     => (opts['CPORT'] || cport || 0).to_i,
    'SSL'           =>  dossl,
    'SSLVersion'    =>  opts['SSLVersion'] || ssl_version,
    'SSLVerifyMode' =>  opts['SSLVerifyMode'] || ssl_verify_mode,
    'SSLCipher'     =>  opts['SSLCipher'] || ssl_cipher,
    'Proxies'       => proxies,
    'Timeout'       => (opts['ConnectTimeout'] || connect_timeout || 10).to_i,
    'Context'       =>
      {
        'Msf'        => framework,
        'MsfExploit' => self,
      })

  # enable evasions on this socket
  set_tcp_evasions(nsock)

  # Set this socket to the global socket as necessary
  self.sock = nsock if (global)

  # Add this socket to the list of sockets created by this exploit
  add_socket(nsock)

  return nsock
end

#connect_timeoutObject

Returns the TCP connection timeout


233
234
235
# File 'lib/msf/core/exploit/remote/tcp.rb', line 233

def connect_timeout
  datastore['ConnectTimeout']
end

#cportObject

Returns the local port for outgoing connections


240
241
242
# File 'lib/msf/core/exploit/remote/tcp.rb', line 240

def cport
  datastore['CPORT']
end

#disconnect(nsock = self.sock) ⇒ Object

Closes the TCP connection


180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
# File 'lib/msf/core/exploit/remote/tcp.rb', line 180

def disconnect(nsock = self.sock)
  begin
    if (nsock)
      nsock.shutdown
      nsock.close
    end
  rescue IOError
  end

  if (nsock == sock)
    self.sock = nil
  end

  # Remove this socket from the list of sockets created by this exploit
  remove_socket(nsock)
end

#handler(nsock = self.sock) ⇒ Object


153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
# File 'lib/msf/core/exploit/remote/tcp.rb', line 153

def handler(nsock = self.sock)
  # If the handler claims the socket, then we don't want it to get closed
  # during cleanup
  if ((rv = super) == Handler::Claimed)
    if (nsock == self.sock)
      self.sock = nil
    end

    # Remove this socket from the list of sockets so that it will not be
    # aborted.
    remove_socket(nsock)
  end

  return rv
end

#initialize(info = {}) ⇒ Object

Initializes an instance of an exploit module that exploits a vulnerability in a TCP server.


53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
# File 'lib/msf/core/exploit/remote/tcp.rb', line 53

def initialize(info = {})
  super

  register_options(
    [
      Opt::RHOST,
      Opt::RPORT
    ], Msf::Exploit::Remote::Tcp
  )

  register_advanced_options(
    [
      OptBool.new('SSL',        [ false, 'Negotiate SSL/TLS for outgoing connections', false]),
      Opt::SSLVersion,
      OptEnum.new('SSLVerifyMode',  [ false, 'SSL verification method', 'PEER', %W{CLIENT_ONCE FAIL_IF_NO_PEER_CERT NONE PEER}]),
      OptString.new('SSLCipher',    [ false, 'String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"']),
      Opt::Proxies,
      Opt::CPORT,
      Opt::CHOST,
      OptInt.new('ConnectTimeout', [ true, 'Maximum number of seconds to establish a TCP connection', 10])
    ], Msf::Exploit::Remote::Tcp
  )

  register_evasion_options(
    [
      OptInt.new('TCP::max_send_size', [false, 'Maxiumum tcp segment size.  (0 = disable)', 0]),
      OptInt.new('TCP::send_delay', [false, 'Delays inserted before every send.  (0 = disable)', 0])
    ], Msf::Exploit::Remote::Tcp
  )
end

#lhostObject

Returns the local host


247
248
249
# File 'lib/msf/core/exploit/remote/tcp.rb', line 247

def lhost
  datastore['LHOST']
end

#lportObject

Returns the local port


254
255
256
# File 'lib/msf/core/exploit/remote/tcp.rb', line 254

def lport
  datastore['LPORT']
end

#peerObject

Returns the rhost:rport


259
260
261
# File 'lib/msf/core/exploit/remote/tcp.rb', line 259

def peer
  "#{rhost}:#{rport}"
end

205
206
207
208
209
210
211
212
213
214
215
# File 'lib/msf/core/exploit/remote/tcp.rb', line 205

def print_prefix
  # Only inject a host/port prefix if we have exactly one entry.
  # Otherwise we are logging in the global context where rhost can be any
  # size (being an alias for rhosts), which is not very useful to insert into
  # a single log line.
  if rhost && rhost.split(' ').length == 1
    super + peer + ' - '
  else
    super
  end
end

#proxiesObject

Returns the proxy configuration


266
267
268
# File 'lib/msf/core/exploit/remote/tcp.rb', line 266

def proxies
  datastore['Proxies']
end

#rhostObject

Returns the target host


273
274
275
# File 'lib/msf/core/exploit/remote/tcp.rb', line 273

def rhost
  datastore['RHOST']
end

#rportObject

Returns the remote port


280
281
282
# File 'lib/msf/core/exploit/remote/tcp.rb', line 280

def rport
  datastore['RPORT']
end

#set_tcp_evasions(socket) ⇒ Object

Enable evasions on a given client


131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
# File 'lib/msf/core/exploit/remote/tcp.rb', line 131

def set_tcp_evasions(socket)

  if( datastore['TCP::max_send_size'].to_i == 0 and datastore['TCP::send_delay'].to_i == 0)
    return
  end

  return if socket.respond_to?('evasive')

  socket.extend(EvasiveTCP)

  if ( datastore['TCP::max_send_size'].to_i > 0)
    socket._send_size = datastore['TCP::max_send_size']
    socket.denagle
    socket.evasive = true
  end

  if ( datastore['TCP::send_delay'].to_i > 0)
    socket._send_delay = datastore['TCP::send_delay']
    socket.evasive = true
  end
end

#shutdown(how = :SHUT_RDWR) ⇒ Object

Shutdown the TCP connection


172
173
174
175
# File 'lib/msf/core/exploit/remote/tcp.rb', line 172

def shutdown(how = :SHUT_RDWR)
  self.sock.shutdown(how) if self.sock
rescue IOError
end

#sslObject

Returns the boolean indicating SSL


287
288
289
# File 'lib/msf/core/exploit/remote/tcp.rb', line 287

def ssl
  datastore['SSL']
end

#ssl_cipherObject

Returns the SSL cipher to use for the context


308
309
310
# File 'lib/msf/core/exploit/remote/tcp.rb', line 308

def ssl_cipher
  datastore['SSLCipher']
end

#ssl_verify_modeObject

Returns the SSL certification verification mechanism


301
302
303
# File 'lib/msf/core/exploit/remote/tcp.rb', line 301

def ssl_verify_mode
  datastore['SSLVerifyMode']
end

#ssl_versionObject

Returns the string indicating SSLVersion


294
295
296
# File 'lib/msf/core/exploit/remote/tcp.rb', line 294

def ssl_version
  datastore['SSLVersion']
end