Revive MetaSSH for the Public - #10
Open
sempervictus wants to merge 1 commit into
Open
Conversation
Semper Victus' fork of Metasploit contains a number of legacy tools no longer maintained upstream or even known in the community - one such tool is the MetaSSH Metasploit Plugin written by @dirtyfilthy. During a recent engagement, SFTP-only access was provided which we needed to use to BF file-parsing systems on the client's back-end. Despite @zeroSteiner's excellent SSH session upgrade upstream, the Framework does not handle SFTP-only access correctly quite yet. Scalpel, blow torch, and lightning rod in-hand, we again brought this plugin back from the beyond to serve our engagement needs. This commit publishes the current state of the MetaSSH plugin as extracted from the Semper Victus Framework environment in the hope of upstreaming it proper to Rapid7's Metasploit repo (which will require @dirtyfilthy's blessing since this is their code and we're just keeping it fresh/improving on the original work). Notes: This is gory stuff - there are Arch-related evals, dynamic constant assignment, and linguistic abuse in the plugin to make everything work. Session, payload, and handler types are addressed but the paradigm never fit this sort of design since we (Framework) have yet to decouple the notions of transport, protocol, platform, runtime, and architecture in logic and implementation. Linting and housekeeping chores on the code still remain - my msftidy is not playing nice nowadays, so i'll leave that up to the next brave soul looking to dig into this code. This commit back into the plugin repository squashes years of changes and tweaking made to fit functional needs - bears review by qualified parties and fixing of horros i've written into this commit. Testing: Still have a live, working session days into engagement. This needs wide testing if we're ever to upstream it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Semper Victus' fork of Metasploit contains a number of legacy tools no longer maintained upstream or even known in the community - one such tool is the MetaSSH Metasploit Plugin written by @dirtyfilthy.
During a recent engagement, SFTP-only access was provided which we needed to use to BF file-parsing systems on the client's back-end. Despite @zeroSteiner's excellent SSH session upgrade upstream, the Framework does not handle SFTP-only access correctly quite yet. Scalpel, blow torch, and lightning rod in-hand, we again brought this plugin back from the beyond to serve our engagement needs.
This commit publishes the current state of the MetaSSH plugin as extracted from the Semper Victus Framework environment in the hope of upstreaming it proper to Rapid7's Metasploit repo (which will require @dirtyfilthy's blessing since this is their code and we're just keeping it fresh/improving on the original work).
Notes:
This is gory stuff - there are Arch-related evals, dynamic
constant assignment, and linguistic abuse in the plugin to make everything work. Session, payload, and handler types are addressed but the paradigm never fit this sort of design since we (Framework) have yet to decouple the notions of transport, protocol, platform, runtime, and architecture in logic and implementation.
Linting and housekeeping chores on the code still remain - my
msftidy is not playing nice nowadays, so i'll leave that up to the next brave soul looking to dig into this code.
This commit back into the plugin repository squashes years of
changes and tweaking made to fit functional needs - bears review by qualified parties and fixing of horros i've written into this commit.
Testing:
Still have a live, working session days into engagement.
This needs wide testing if we're ever to upstream it.