92 lines
6.9 KiB
Plaintext
92 lines
6.9 KiB
Plaintext
|
|
Name: HTTP Fetch, Linux Meterpreter Service, Bind TCP
|
|
Module: payload/cmd/linux/http/x86/metsvc_bind_tcp
|
|
Platform: Linux
|
|
Arch: cmd
|
|
Needs Admin: No
|
|
Total size: 108
|
|
Rank: Normal
|
|
|
|
Provided by:
|
|
Brendan Watters
|
|
Spencer McIntyre
|
|
hdm <x@hdm.io>
|
|
|
|
Basic options:
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
|
|
FETCH_DELETE false yes Attempt to delete the binary after execution
|
|
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8 (Accepted: none, bash, python3.8+)
|
|
FETCH_SRVHOST yes Local IP to use for serving payload
|
|
FETCH_SRVPORT 8080 yes Local port to use for serving payload
|
|
FETCH_URIPATH no Local URI to use for serving payload
|
|
LPORT 4444 yes The listen port
|
|
RHOST no The target address
|
|
|
|
|
|
When FETCH_COMMAND is one of CURL,WGET:
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.
|
|
|
|
|
|
When FETCH_FILELESS is none:
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
FETCH_FILENAME uGdmuNanIf no Name to use on remote system when storing payload; cannot contain spaces or slashes
|
|
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces
|
|
|
|
Description:
|
|
Fetch and execute a x86 payload from an HTTP server.
|
|
Stub payload for interacting with a Meterpreter Service
|
|
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
AppendExit false no Prepend a stub that will break out of a chroot (includes setreuid to root)
|
|
AutoLoadStdapi true yes Automatically load the Stdapi extension
|
|
AutoRunScript no A script to run automatically on session creation.
|
|
AutoSystemInfo true yes Automatically capture system information on initialization.
|
|
AutoUnhookProcess false yes Automatically load the unhook extension and unhook the process
|
|
AutoVerifySessionTimeout 30 no Timeout period to wait for session validation to occur, in seconds
|
|
EXE::Custom no Use custom exe instead of automatically generating a payload exe
|
|
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
|
|
EXE::FallBack false no Use the default template in case the specified one is missing
|
|
EXE::Inject false no Set to preserve the original EXE function
|
|
EXE::OldMethod false no Set to use the substitution EXE generation method.
|
|
EXE::Path no The directory in which to look for the executable template
|
|
EXE::Template no The executable template file name.
|
|
EnableUnicodeEncoding false yes Automatically encode UTF-8 strings as hexadecimal
|
|
FetchHandlerDisable false yes Disable fetch handler
|
|
FetchHttpServerName Apache yes Fetch HTTP server name
|
|
FetchListenerBindAddress no The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST
|
|
FetchListenerBindPort no The port to bind to if different from FETCH_SRVPORT
|
|
HandlerSSLCert no Path to a SSL certificate in unified PEM format, ignored for HTTP transports
|
|
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
|
|
MSI::Custom no Use custom msi instead of automatically generating a payload msi
|
|
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
|
|
MSI::Path no The directory in which to look for the msi template
|
|
MSI::Template no The msi template file name
|
|
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
|
|
MeterpreterDebugBuild false no Use a debug version of Meterpreter
|
|
MeterpreterDebugLogging no The Meterpreter debug logging configuration, see https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter-debugging-meterpreter-sessions.html
|
|
PayloadProcessCommandLine no The displayed command line that will be used by the payload
|
|
PrependChrootBreak false no Prepend a stub that will break out of a chroot (includes setreuid to root)
|
|
PrependFork false no Prepend a stub that starts the payload in its own process via fork
|
|
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
|
|
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
|
|
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
|
|
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
|
|
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
|
|
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
|
|
SessionCommunicationTimeout 300 no The number of seconds of no activity before this session should be killed
|
|
SessionExpirationTimeout 604800 no The number of seconds before this session should be forcibly shut down
|
|
SessionRetryTotal 3600 no Number of seconds try reconnecting for on network failure
|
|
SessionRetryWait 10 no Number of seconds to wait between reconnect attempts
|
|
VERBOSE false no Enable detailed status messages
|
|
WORKSPACE no Specify the workspace for this module
|
|
|