Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add lcat command for meterpreter #16282

Merged
merged 2 commits into from
Mar 7, 2022
Merged

Conversation

3V3RYONE
Copy link
Contributor

@3V3RYONE 3V3RYONE commented Mar 5, 2022

This PR implements the suggestion feature #16167

These changes introduce a lcat command for the meterpreter, where-in you can read the contents of a local file (present in the local machine or attacking machine), to the meterpreter terminal. The already present cat command only reads the files that are present in the remote machine.

Before

No command to read the local files in the terminal

After

meterpreter > pwd
/
meterpreter > lpwd
/home/beleswar/metasploit-framework

meterpreter > cat /etc/hosts
127.0.0.1	localhost
127.0.1.1	metasploitable.localdomain	metasploitable

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

meterpreter > lcat /etc/hosts
# Static table lookup for hostnames.
# See hosts(5) for details.

127.0.0.1	localhost
::1		localhost
127.0.1.1	arch.localdomain	arch

meterpreter > lcat -h
Usage: lcat file

Note:

In the above output, cat displays the hosts file of metasploitable (remote machine) and lcat displays the hosts file of arch linux (local machine). The tabs functionality is also added for lcat command.

Verification

List the steps needed to make sure this thing works

  • Open a meterpreter session against a remote machine.
  • run pwd and lpwd to check the current directories in both machines.
  • run lcat <path/to/your/localfile> (ex- lcat msfvenom)
  • Verify that lcat displays the contents of the local file in the terminal
  • Verify the lcat also utilizes tab functionality to autocomplete file names.

Fixes #16167

Copy link
Contributor

@smcintyre-r7 smcintyre-r7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything looks good to me. I appreciate the path expansion and tab completion 🥇 . Nice job.

Testing Output
meterpreter > help

Core Commands
=============

    Command                   Description
    -------                   -----------
    ?                         Help menu
    background                Backgrounds the current session
    bg                        Alias for background
    bgkill                    Kills a background meterpreter script
    bglist                    Lists running background scripts
    bgrun                     Executes a meterpreter script as a background thread
    channel                   Displays information or control active channels
    close                     Closes a channel
    detach                    Detach the meterpreter session (for http/https)
    disable_unicode_encoding  Disables encoding of unicode strings
    enable_unicode_encoding   Enables encoding of unicode strings
    exit                      Terminate the meterpreter session
    get_timeouts              Get the current session timeout values
    guid                      Get the session GUID
    help                      Help menu
    info                      Displays information about a Post module
    irb                       Open an interactive Ruby shell on the current session
    load                      Load one or more meterpreter extensions
    machine_id                Get the MSF ID of the machine attached to the session
    pry                       Open the Pry debugger on the current session
    quit                      Terminate the meterpreter session
    read                      Reads data from a channel
    resource                  Run the commands stored in a file
    run                       Executes a meterpreter script or Post module
    secure                    (Re)Negotiate TLV packet encryption on the session
    sessions                  Quickly switch to another session
    set_timeouts              Set the current session timeout values
    sleep                     Force Meterpreter to go quiet, then re-establish session
    transport                 Manage the transport mechanisms
    use                       Deprecated alias for "load"
    uuid                      Get the UUID for the current session
    write                     Writes data to a channel


Stdapi: File system Commands
============================

    Command       Description
    -------       -----------
    cat           Read the contents of a file to the screen
    cd            Change directory
    checksum      Retrieve the checksum of a file
    chmod         Change the permissions of a file
    cp            Copy source to destination
    del           Delete the specified file
    dir           List files (alias for ls)
    download      Download a file or directory
    edit          Edit a file
    getlwd        Print local working directory
    getwd         Print working directory
    lcat          Read the contents of a local file to the screen
    lcd           Change local working directory
    lls           List local files
    lpwd          Print local working directory
    ls            List files
    mkdir         Make directory
    mv            Move source to destination
    pwd           Print working directory
    rm            Delete the specified file
    rmdir         Remove directory
    search        Search for files
    upload        Upload a file or directory


Stdapi: Networking Commands
===========================

    Command       Description
    -------       -----------
    ifconfig      Display interfaces
    ipconfig      Display interfaces
    portfwd       Forward a local port to a remote service
    resolve       Resolve a set of host names on the target
    route         View and modify the routing table


Stdapi: System Commands
=======================

    Command       Description
    -------       -----------
    execute       Execute a command
    getenv        Get one or more environment variable values
    getpid        Get the current process identifier
    getuid        Get the user that the server is running as
    kill          Terminate a process
    localtime     Displays the target system local date and time
    pgrep         Filter processes by name
    pkill         Terminate processes by name
    ps            List running processes
    shell         Drop into a system command shell
    sysinfo       Gets information about the remote system, such as OS


Stdapi: Audio Output Commands
=============================

    Command       Description
    -------       -----------
    play          play a waveform audio file (.wav) on the target system

meterpreter > lcat ~/.vimrc
colorscheme srcery
set expandtab
set number

" Fix issues with the color scheme when using screen 
if &term =~ '^screen'
  execute "set t_ut="
endif
meterpreter > lcat /etc/hosts
127.0.0.1      localhost localhost.localdomain localhost4 localhost4.localdomain4
::1            localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.159.52 WIN-BPID95ACQ7E
meterpreter > lcat /etc
[-] /etc is a directory
meterpreter > lcat /etc/shadow
[-] Error running command lcat: Errno::EACCES Permission denied @ rb_sysopen - /etc/shadow
meterpreter > 

@smcintyre-r7 smcintyre-r7 self-assigned this Mar 7, 2022
@smcintyre-r7 smcintyre-r7 merged commit c02b3da into rapid7:master Mar 7, 2022
@smcintyre-r7
Copy link
Contributor

Release Notes

This adds the lcat command to Meterpreter which allows the user to cat a local file.

@smcintyre-r7 smcintyre-r7 added the rn-enhancement release notes enhancement label Mar 7, 2022
@3V3RYONE
Copy link
Contributor Author

3V3RYONE commented Mar 7, 2022

Thanks a lot for the mentions 😄

@3V3RYONE 3V3RYONE deleted the add_lcat_cmd branch March 8, 2022 11:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add lcat command for Meterpreter
2 participants