Documentation
¶
Overview ¶
File dropper download and execute payloads.
The dropper package contains all the code for download and execute payloads. Unlike the other payloads this package is necessarily OS dependent for both the download and execution portions.
Index ¶
- Variables
- type Dropper
- type GroovyPayload
- type PHPPayload
- type UnixPayload
- func (unix *UnixPayload) CurlHTTP(lhost string, lport int, ssl bool, downloadFile string) string
- func (unix *UnixPayload) CurlHTTPDownloadOnly(lhost string, lport int, ssl bool, downloadFile string, output string) string
- func (unix *UnixPayload) EitherHTTP(lhost string, lport int, ssl bool, downloadFile string) string
- func (unix *UnixPayload) Mountv3Only(lhost string, lshareDir string, rshareDir string) string
- func (unix *UnixPayload) WgetHTTP(lhost string, lport int, ssl bool, downloadFile string) string
- type WindowsPayload
- func (win *WindowsPayload) CertutilHTTP(lhost string, lport int, ssl bool, downloadFile string) string
- func (win *WindowsPayload) CertutilHTTPDownloadOnly(lhost string, lport int, ssl bool, downloadFile string, outputPath string) string
- func (win *WindowsPayload) CurlHTTP(lhost string, lport int, ssl bool, downloadFile string) string
- func (win *WindowsPayload) CurlHTTPDownloadOnly(lhost string, lport int, ssl bool, downloadFile string, output string) string
- func (win *WindowsPayload) PowershellHTTP(lhost string, lport int, ssl bool, downloadFile string) string
Constants ¶
This section is empty.
Variables ¶
var ( Unix = &UnixPayload{} Windows = &WindowsPayload{} Groovy = &GroovyPayload{} PHP = &PHPPayload{} )
var ( //go:embed php/dropper.php PHPDropper string //go:embed php/dropper_secure.php PHPDropperSecure string )
Functions ¶
This section is empty.
Types ¶
type GroovyPayload ¶ added in v1.16.0
type GroovyPayload struct{}
type PHPPayload ¶ added in v1.19.0
type PHPPayload struct{}
type UnixPayload ¶
type UnixPayload struct{}
func (*UnixPayload) CurlHTTPDownloadOnly ¶ added in v1.44.0
func (unix *UnixPayload) CurlHTTPDownloadOnly(lhost string, lport int, ssl bool, downloadFile string, output string) string
Download a remote file with curl, but do not execute/delete it. You also need to provide your own full file path, .exe will not be appended like the others. Lastly the full output file path needs to be specified in the output parameter.
func (*UnixPayload) EitherHTTP ¶
Download a remote file with curl or wget, execute it, and delete it.
func (*UnixPayload) Mountv3Only ¶ added in v1.47.0
func (unix *UnixPayload) Mountv3Only(lhost string, lshareDir string, rshareDir string) string
Mount a remote NFS directory using NFS v3. This will mount the attacker controlled share at <lhost>:<lshareDir> and make it available to the attacker at <rshareDir>. Usage example:
Mountv3Only("10.9.49.2","/tmp/nfsshare", "./b")
This function does not attempt to actually execute any files on the share
type WindowsPayload ¶
type WindowsPayload struct{}
func (*WindowsPayload) CertutilHTTP ¶
func (win *WindowsPayload) CertutilHTTP(lhost string, lport int, ssl bool, downloadFile string) string
Download a remote file with certutil.exe, execute it, and delete it (after execution).
func (*WindowsPayload) CertutilHTTPDownloadOnly ¶ added in v1.46.0
func (win *WindowsPayload) CertutilHTTPDownloadOnly(lhost string, lport int, ssl bool, downloadFile string, outputPath string) string
Much like CurlHTTPDownloadOnly, this function will generate the certutil.exe command to download a file and save it to the provided location.
downloadCmd := dropper.Windows.CertutilHTTPDownloadOnly(httpFileServer.HTTPAddr, httpFileServer.HTTPPort, httpFileServer.TLS, httpFileServer.GetRandomName(""), destFilePath)
func (*WindowsPayload) CurlHTTP ¶
Download a remote file with curl.exe, execute it, and delete it (after execution).
func (*WindowsPayload) CurlHTTPDownloadOnly ¶ added in v1.44.0
func (win *WindowsPayload) CurlHTTPDownloadOnly(lhost string, lport int, ssl bool, downloadFile string, output string) string
Download a remote file with curl.exe, but do not execute/delete it. You also need to provide your own full file path, .exe will not be appended like the others. Lastly the full output file path needs to be specified in the output parameter.
func (*WindowsPayload) PowershellHTTP ¶
func (win *WindowsPayload) PowershellHTTP(lhost string, lport int, ssl bool, downloadFile string) string
Download a remote file with PowerShell, execute it, and delete it (after execution).
Source Files