Created
October 23, 2014 13:14
-
-
Save KronicDeth/02973726552f6ab49593 to your computer and use it in GitHub Desktop.
File paths for a metasploit-framework module, including staged payloads where the reference name of the payload Class does not match the path to the stage and stager
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# 1. Run `msfconsole` | |
# 2. Select an module `use payload/windows/patchupdllinject/bind_tcp_rc4` | |
# 2. Enter `irb` mode | |
# active_module is the module selected with `use` | |
module_ancestors = active_module.class.ancestors.select { |ancestor| | |
ancestor.name.try(:start_with?, 'Msf::Modules::') | |
} | |
hex_unpacked_module_ancestor_full_names = module_ancestors.map(&:name).map { |name| | |
name.sub(/^Msf::Modules::Mod/, '') | |
.sub(/::Metasploit\d$/, '') | |
} | |
module_ancestor_full_names = hex_unpacked_module_ancestor_full_names.map { |name| | |
[name].pack('H*') | |
} | |
module_ancestor_relative_paths = module_ancestor_full_names.map { |name| | |
type, reference_name = name.split('/', 2) | |
directory = Msf::Modules::Loader::Base::DIRECTORY_BY_TYPE[type] | |
"#{directory}/#{reference_name}#{Msf::Modules::Loader::Base::MODULE_EXTENSION}" | |
} | |
module_paths = framework.modules.send(:module_paths) | |
module_ancestor_full_paths = module_ancestor_relative_paths.map { |relative_path| | |
full_path = "Full path not found for #{relative_path}" | |
module_paths.each do |module_path| | |
potential_full_path = File.join(module_path, relative_path) | |
if File.exist?(potential_full_path) | |
full_path = potential_full_path | |
break | |
end | |
end | |
full_path | |
} | |
puts "#{active_module.fullname} is composed of modules in the following files:" | |
module_ancestor_full_paths.each do |full_path| | |
puts " #{full_path}" | |
end |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment