payload

type Arch ¶ added in v1.52.0

type Arch int

Arch represents generalized architecture support for payload selection disambiguation and metadata. This allows a payload to explicitly declare what architectures they support and can be used by an exploit to change behavior dynamically if required.

const (
	None Arch = iota
	AMD64
	I386
	ARMEL
	ARMHF
	ARM64
	MIPS
	MIPSEL
	MIPS64
	MIPS64EL
	PPC
	PPC64
	PPC64EL
	S390X

	//nolint:revive  // alias is not stylistically ok, but most X864 is not clear
	X86_64  Arch = AMD64
	X86     Arch = I386
	POWER8  Arch = PPC64EL
	POWER9  Arch = PPC64EL
	AARCH64 Arch = ARM64
)

func ArchFromString(s string) Arch

func (a Arch) String() string

type Effect ¶ added in v1.52.0

type Effect int

Effect is the type of impact a portion of the exploit employs and any target system side effects. These are relatively loosely defined and focused on the combination between indicators-of-compromise, payload default behavior, and types of network traffic. The payload.Effects map provides a way to define multiple types of effects and define the metadata as arbitrary strings.

const (
	FileCreate Effect = 1 << iota
	FileOverwrite
	FileDelete
	Execute
	InMemory
	ConfigChanges
	IndicatorInLogs
	AccountLockout
	Physical
	WebRequest
	ReverseShellTCP
	ReverseShellUDP
	ReverseShellTLS

	Unknown

	ReverseShellSSL Effect = ReverseShellTLS
)

func (e Effect) String() string

type Effects ¶ added in v1.52.0

type Effects map[Effect][]string

Effects represents an exploits impact on the target, network, and potential side-effects caused by it's usage. An effect can happen multiple times and a human readable string describing the context can be used. For example, defining an effect for an exploit that creates 2 files can be defined as follows:

payload.Effects{
	payload.FileCreate: []string{"/var/www/html/pwnt", "/var/www/html/pwnt2"},
}

These effects are currently only used for metadata definitions and details flags.

type Supported ¶ added in v1.52.0

type Supported struct {
	Type    Type
	Arch    Arch
	Effects Effects
	Default bool
}

Supported struct is passed to exploit definitions for calling RunExploit and informs the exploit of the types, architecture, effects, and whether a payload is the default type the exploit should use. An exploit developer can add support for a payload type to an exploit with config.AddPayload, which in turn enables enables the contextual flags for custom payload usage.

If Default is set, the exploit will use the set payload. Additionally, if only a single payload is used Default does not have to be set and if no Default is set with multiple payloads the exploit logic will select the first processed supported type.

Multiple payloads being defined enables the -payload-type flag that allows for string selection between the supported payloads. In addition, using multiple payloads of the same type but with different architectures will enable -payload-arch flag to further allow selection.

An example of defining multiple payloads to support an exploit with a command execution or a payload upload with multiple architectures can be defined as follows:

[]payload.Supported{
	{
		Type:    payload.GenericCommand,
		Arch:    payload.None,
		Effects: payload.NoEffects,
		Default: true,
	},
	{
		Type:    payload.LinuxELF,
		Arch:    payload.AMD64,
		Effects: payload.NoEffects,
	},
	{
		Type: payload.LinuxELF,
		Arch: payload.ARM64,
		Effects: payload.Effects{
			payload.FileCreate: []string{"/var/www/html/pwnt", "/var/www/html/pwnt2"},
		},
	},
}

func (s Supported) String() string

type Type ¶ added in v1.52.0

type Type int

Type defines the different types of payload can be. These fall into 2 buckets: command and payload based. We define each of the types to be specific both for exploit payload metadata, but also because it is possible to support an exploit that targets different types depending on required behavior.

const (
	// GenericCommand is used for arbitrary command line execution
	// without OS specificity.
	GenericCommand Type = iota
	// WindowsCommand is used for command line execution, generally via
	// cmd.exe or local execution on Windows systems.
	WindowsCommand
	// WindowsPowerShellCommand represents command line execution of PowerShell.
	WindowsPowerShellCommand
	// MacCommand is used command line execution on a macOS system.
	MacCommand
	// LinuxCommand is used for shell execution in a Linux environment.
	LinuxCommand
	// LinuxELF is used for payloads containing ELF binaries for execution.
	LinuxELF
	// LinuxSO is used for payloads containing ELF shared object
	// binaries for execution via some library loading mechanism or via
	// dropping.
	LinuxSO
	// WindowsEXE is used for Windows PE executable files.
	WindowsEXE // PE
	// WindowsDLL is used for Windows DLL files binaries for execution
	// via some library loading mechanism or via dropping.
	WindowsDLL
	// Webshell is used for arbitrary web shells that represent
	// payloads that get dropped to targets.
	Webshell
	UnspecifiedType
)

func TypeFromString(s string) Type

func (t Type) IsCommand() bool

if conf.HasCustomPayload() {
	if conf.SelectedPayload.Type.IsCommand() {
		output.PrintfStatus("using '%s' in place of default", string(conf.CustomPayload))
	} else {
		output.PrintfStatus("using binary len %d in place of default", len(string(conf.CustomPayload)))
	}
}

func (t Type) IsPayload() bool

if conf.HasCustomPayload() {
	if conf.SelectedPayload.Type.IsPayload() {
		output.PrintfStatus("using binary len %d in place of default", len(string(conf.CustomPayload)))
	} else {
		output.PrintfStatus("using '%s' in place of default", string(conf.CustomPayload))
	}
}

func (t Type) String() string