| 1 |
#!/usr/bin/perl |
|---|
| 2 |
############### |
|---|
| 3 |
|
|---|
| 4 |
## |
|---|
| 5 |
# Name: msfcli |
|---|
| 6 |
# Author: H D Moore <hdm [at] metasploit.com> |
|---|
| 7 |
# Author: spoonm <ninjatools [at] hush.com> |
|---|
| 8 |
# Version: $Revision$ |
|---|
| 9 |
# Description: Command line interface to the Metasploit Exploit Framework |
|---|
| 10 |
# License: |
|---|
| 11 |
# |
|---|
| 12 |
# This file is part of the Metasploit Exploit Framework |
|---|
| 13 |
# and is subject to the same licenses and copyrights as |
|---|
| 14 |
# the rest of this package. |
|---|
| 15 |
# |
|---|
| 16 |
## |
|---|
| 17 |
|
|---|
| 18 |
require 5.6.0; |
|---|
| 19 |
|
|---|
| 20 |
use strict; |
|---|
| 21 |
use FindBin qw{$RealBin}; |
|---|
| 22 |
use lib "$RealBin/lib"; |
|---|
| 23 |
use IO::Socket; |
|---|
| 24 |
use Getopt::Std; |
|---|
| 25 |
use POSIX; |
|---|
| 26 |
|
|---|
| 27 |
use Msf::TextUI; |
|---|
| 28 |
use Pex; |
|---|
| 29 |
|
|---|
| 30 |
no utf8; |
|---|
| 31 |
no locale; |
|---|
| 32 |
|
|---|
| 33 |
Msf::UI::ActiveStateSucks(); |
|---|
| 34 |
Msf::UI::BrokenUTF8(); |
|---|
| 35 |
|
|---|
| 36 |
my $ui = Msf::TextUI->new($RealBin); |
|---|
| 37 |
my $FRAMEVERSION = $ui->Version; |
|---|
| 38 |
my $VERSION = '$Revision$'; |
|---|
| 39 |
|
|---|
| 40 |
my %opts; |
|---|
| 41 |
getopts('hv', \%opts); |
|---|
| 42 |
Usage() if($opts{'h'}); |
|---|
| 43 |
Version() if($opts{'v'}); |
|---|
| 44 |
|
|---|
| 45 |
my $mod = shift; |
|---|
| 46 |
my @ARG; |
|---|
| 47 |
my %tenv; |
|---|
| 48 |
|
|---|
| 49 |
# parse the command line options |
|---|
| 50 |
while(my($key, $val) = split('\=', shift(@ARGV))) { |
|---|
| 51 |
if(!defined($val)) { |
|---|
| 52 |
push(@ARG, $key); |
|---|
| 53 |
} |
|---|
| 54 |
else { |
|---|
| 55 |
$tenv{$key} = $val; |
|---|
| 56 |
} |
|---|
| 57 |
} |
|---|
| 58 |
|
|---|
| 59 |
my $exploits = { }; |
|---|
| 60 |
my $payloads = { }; |
|---|
| 61 |
my $exploitsIndex = $ui->LoadExploits; |
|---|
| 62 |
my $payloadsIndex = $ui->LoadPayloads; |
|---|
| 63 |
my $encoders = $ui->LoadEncoders; |
|---|
| 64 |
my $nops = $ui->LoadNops; |
|---|
| 65 |
|
|---|
| 66 |
|
|---|
| 67 |
# A quick note: |
|---|
| 68 |
# The Load methods return a hash of instantiated objects |
|---|
| 69 |
# We should instantiate new objects when we are going to use them |
|---|
| 70 |
# But since the cli only does 1 exploitation a run, its ok. |
|---|
| 71 |
|
|---|
| 72 |
foreach my $key (sort(keys(%{$exploitsIndex}))) { |
|---|
| 73 |
$exploits->{$exploitsIndex->{$key}->SelfEndName}=$exploitsIndex->{$key}; |
|---|
| 74 |
} |
|---|
| 75 |
|
|---|
| 76 |
foreach my $key (keys(%{$payloadsIndex})) { |
|---|
| 77 |
$payloads->{$payloadsIndex->{$key}->SelfEndName} = $payloadsIndex->{$key}; |
|---|
| 78 |
} |
|---|
| 79 |
|
|---|
| 80 |
if(!defined($mod)) { |
|---|
| 81 |
Msf::TextUI::PrintAsciiLogo(); |
|---|
| 82 |
ListExploits(); |
|---|
| 83 |
exit(0); |
|---|
| 84 |
} |
|---|
| 85 |
|
|---|
| 86 |
|
|---|
| 87 |
my $exploit = $exploits->{$mod}; |
|---|
| 88 |
if (! $exploit) { |
|---|
| 89 |
my %matches; |
|---|
| 90 |
foreach my $exp (keys(%{$exploits})) { |
|---|
| 91 |
next if $exp !~ /$mod/i; |
|---|
| 92 |
$matches{$exp}=$exploits->{$exp}; |
|---|
| 93 |
} |
|---|
| 94 |
if (scalar(keys(%matches)) == 0) { |
|---|
| 95 |
Msf::TextUI::PrintAsciiLogo(); |
|---|
| 96 |
ListExploits(); |
|---|
| 97 |
exit(0); |
|---|
| 98 |
} |
|---|
| 99 |
if (scalar(keys(%matches)) == 1) { |
|---|
| 100 |
$exploit = $matches{@{[keys(%matches)]}[0]}; |
|---|
| 101 |
} |
|---|
| 102 |
if (scalar(keys(%matches)) >= 2) { |
|---|
| 103 |
$exploits = \%matches; |
|---|
| 104 |
Msf::TextUI::PrintAsciiLogo(); |
|---|
| 105 |
ListExploits(); |
|---|
| 106 |
exit(0); |
|---|
| 107 |
} |
|---|
| 108 |
} |
|---|
| 109 |
|
|---|
| 110 |
my $exploitName = $exploit->SelfEndName; |
|---|
| 111 |
$ui->LoadTempEnv($exploitName); |
|---|
| 112 |
|
|---|
| 113 |
# merge command line env variables into temp env |
|---|
| 114 |
foreach (keys(%tenv)) { |
|---|
| 115 |
$ui->SetTempEnv($_, $tenv{$_}); |
|---|
| 116 |
} |
|---|
| 117 |
|
|---|
| 118 |
$ui->SetTempEnv('_ExploitsIndex', $exploitsIndex); |
|---|
| 119 |
$ui->SetTempEnv('_PayloadsIndex', $payloadsIndex); |
|---|
| 120 |
$ui->SetTempEnv('_Encoders', $encoders); |
|---|
| 121 |
$ui->SetTempEnv('_Nops', $nops); |
|---|
| 122 |
|
|---|
| 123 |
|
|---|
| 124 |
my $validPayloads = $ui->MatchPayloads($exploit, $payloads) if($exploit->Payload); |
|---|
| 125 |
my $payloadName = $ui->GetEnv('PAYLOAD'); |
|---|
| 126 |
my $payload = $validPayloads->{$payloadName}; |
|---|
| 127 |
|
|---|
| 128 |
|
|---|
| 129 |
# Mmmmm, candy |
|---|
| 130 |
$ui->SetTempEnv('_UI', $ui); |
|---|
| 131 |
$ui->SetTempEnv('_Exploits', $exploits); |
|---|
| 132 |
$ui->SetTempEnv('_Payloads', $payloads); |
|---|
| 133 |
$ui->SetTempEnv('_Exploit', $exploit); |
|---|
| 134 |
$ui->SetTempEnv('_PayloadName', $payloadName); |
|---|
| 135 |
$ui->SetTempEnv('_Payload', $payload); |
|---|
| 136 |
$ui->SetTempEnv('_ValidPayloads', $validPayloads); |
|---|
| 137 |
$exploit->ApplyAutoOpts; |
|---|
| 138 |
|
|---|
| 139 |
if (defined($exploit->Payload) && defined($payloadName) && ! defined($payload) ) |
|---|
| 140 |
{ |
|---|
| 141 |
$ui->PrintLine('[*] Invalid payload specified.'); |
|---|
| 142 |
$ui->Payloads; |
|---|
| 143 |
exit(0); |
|---|
| 144 |
} |
|---|
| 145 |
|
|---|
| 146 |
# Main Dispatch |
|---|
| 147 |
for(uc($ARG[0])) { |
|---|
| 148 |
$_ eq 'S' && do { $ui->Summary; last; }; |
|---|
| 149 |
$_ eq 'O' && do { $ui->Options; last; }; |
|---|
| 150 |
$_ eq 'A' && do { $ui->AdvancedOptions; last; }; |
|---|
| 151 |
$_ eq 'P' && do { $ui->Payloads; last; }; |
|---|
| 152 |
$_ eq 'T' && do { $ui->Targets; last; }; |
|---|
| 153 |
$_ eq 'C' && do { $ui->Check; last; }; |
|---|
| 154 |
$_ eq 'E' && do { $ui->Exploit; last; }; |
|---|
| 155 |
Usage(); |
|---|
| 156 |
} |
|---|
| 157 |
|
|---|
| 158 |
|
|---|
| 159 |
|
|---|
| 160 |
################################################################################ |
|---|
| 161 |
|
|---|
| 162 |
sub Usage { |
|---|
| 163 |
print "\nUsage: $0 <ID> [var=val] [MODE]\n"; |
|---|
| 164 |
print "Modes: \n"; |
|---|
| 165 |
print " (S)UMMARY Show various information about the module\n"; |
|---|
| 166 |
print " (O)PTIONS Show the available options for this module\n"; |
|---|
| 167 |
print " (A)DVANCED Show the advanced options for this module\n"; |
|---|
| 168 |
print " (P)AYLOADS Show available payloads for this module\n"; |
|---|
| 169 |
print " (T)ARGETS Show available targets for this module\n"; |
|---|
| 170 |
print " (C)HECK Determine if the target is vulnerable\n"; |
|---|
| 171 |
print " (E)XPLOIT Attempt to exploit the target\n"; |
|---|
| 172 |
print "\n"; |
|---|
| 173 |
exit(0); |
|---|
| 174 |
} |
|---|
| 175 |
sub Version { |
|---|
| 176 |
my $ver = Pex::Utils::Rev2Ver($VERSION); |
|---|
| 177 |
print STDERR qq{ |
|---|
| 178 |
Framework Version: $FRAMEVERSION |
|---|
| 179 |
Msfcli Version: $ver |
|---|
| 180 |
|
|---|
| 181 |
}; |
|---|
| 182 |
exit(0); |
|---|
| 183 |
} |
|---|
| 184 |
|
|---|
| 185 |
sub ListExploits { |
|---|
| 186 |
print "\n============\n= Exploits\n\n"; |
|---|
| 187 |
print $ui->DumpExploits(2, $exploits); |
|---|
| 188 |
print "\n"; |
|---|
| 189 |
} |
|---|