Vsftpd dual target - #21861
Open
prithvee07 wants to merge 2 commits into
Open
Conversation
…load for vsftpd_234_backdoor
Per bwatters-r7's review feedback on rapid7#21792 (revanth3205's fix-vsftpd-234-payload-compat branch): rather than globally restricting the module's Compat block to cmd_interact (which would filter out the existing cmd/linux/* fetch payloads for every user), split into two targets so each payload family is scoped to its own target: - Target 0 "Linux/Unix Command" (default, unchanged from current master): keeps cmd/linux/http/x86/meterpreter_reverse_tcp and the rest of the cmd/linux/* fetch payloads working exactly as before. - Target 1 "Backdoor Command Shell": restores direct interaction with the backdoor via cmd/unix/interact, scoped with its own Payload => Compat => { PayloadType: cmd_interact, ConnectionType: find }. This relies on Msf::Module::Compatibility#compatible? merging target['Payload']['Compat'] on top of the module-level Compat hash when a specific target is selected (lib/msf/core/module/compatibility.rb), so the cmd_interact restriction only applies when a user explicitly selects Target 1 instead of narrowing payload selection for everyone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ae2LTwjw9tvJqqGqqwjerz
Contributor
|
Are we good to close #21792? |
Contributor
Contributor
|
yup, got my PRs mixed up and quick clicked! My fault, sorry for the confusion |
Contributor
TestingTested on Metasploitable2Target 0 — Fetch MeterpreterTarget 1 — Interact |
bwatters-r7
moved this from In Progress
to What about Second Review?
in Metasploit Kanban
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Addresses bwatters-r7's review feedback on #21792 ("Fix #21780: Fix vsftpd_234_backdoor: restore cmd/unix/interact payload compatibility"), applied on top of
fix-vsftpd-234-payload-compatso it can be merged into that PR before it lands upstream.The original PR added a module-level
'Payload' => { 'Compat' => { 'PayloadType' => 'cmd_interact', 'ConnectionType' => 'find' } }block and switched the defaultPAYLOADtocmd/unix/interact. Because thatCompatblock lives at the module level, it applies to every target — narrowing payload selection tocmd_interact-type payloads only, for all users, and dropping support for the existingcmd/linux/*fetch-based payloads (e.g.cmd/linux/http/x86/meterpreter_reverse_tcp) that legacy-target users still rely on.Per bwatters-r7:
This PR does that:
Compatblock; the top-levelPayloadhash is back to its current-master shape (Space,BadChars,DisableNopsonly).DefaultTarget => 0, unchanged from current master):DefaultOptions['PAYLOAD']stayscmd/linux/http/x86/meterpreter_reverse_tcp— the fetch-payload path works exactly as it does today.'Payload' => { 'Compat' => { 'PayloadType' => 'cmd_interact', 'ConnectionType' => 'find' } }plusDefaultOptions['PAYLOAD'] => 'cmd/unix/interact', restoring direct interaction with the backdoor for users who select this target.This relies on
Msf::Module::Compatibility#compatible?mergingtarget['Payload']['Compat']on top of the module-levelCompathash only when that specific target is selected (lib/msf/core/module/compatibility.rb, theif self.respond_to?("target") and self.target and self.target['Payload'] and self.target['Payload']['Compat']branch) — so thecmd_interactrestriction only kicks in for Target 1, not globally.Related Issue: Addresses review comments on #21792 (fixes #21780)
Breaking Changes
None for Target 0 users (default target, default payload unchanged from current master). Target 1 is new; anyone currently relying on the single-target behavior added by the original PR (
cmd/unix/interactas the sole default) will need to explicitlyset TARGET 1to get that behavior back — but that behavior wasn't in master yet, only in the still-open PR this builds on.Reviewer Notes
Single-file diff,
modules/exploits/unix/ftp/vsftpd_234_backdoor.rbonly. Worth double-checking theCompatmerge behavior inlib/msf/core/module/compatibility.rbagainst this module directly in a console (use,set TARGET 1,show payloads) to confirm Target 1 narrows tocmd/unix/interact-type payloads while Target 0 still lists the fullcmd/linux/*set.Verification Steps
ruby -c modules/exploits/unix/ftp/vsftpd_234_backdoor.rb— confirms syntax (already run, passes).use exploit/unix/ftp/vsftpd_234_backdoor; show targets— confirm both targets are listed.set TARGET 0; show payloads— confirmcmd/linux/*fetch payloads are listed andcmd/linux/http/x86/meterpreter_reverse_tcpis the default.set TARGET 1; show payloads— confirm the list narrows tocmd_interact-type payloads andcmd/unix/interactis the default.Test Evidence
ruby -cpasses clean (see Verification Step 1). Flagging a gap honestly: I could not runtools/dev/msftidy.rbin this environment — it hard-requires therubocopgem, which isn't installed here, andbundle execalso fails because the bundle isn't fully set up in this sandbox. I have not run this against a live FTP/vsftpd 2.3.4 target (e.g. Metasploitable 2) either — steps 2–5 above still need real console output from testing before this should be considered fully verified. Please runrubocop -a/msftidy.rblocally before merge.Environment
AI Usage Disclosure
Claude (Anthropic) was used to design and implement the dual-target fix requested in review: tracing the framework's
Compatmerge logic to confirm a per-targetPayload => Compatoverride actually works as bwatters-r7 described, then restructuring the module'sTargetsblock accordingly. This has been syntax-checked only (see Test Evidence) — it has not been run against a live target or through the project's fullmsftidy/rubocop lint due to environment limitations in this session.Pre-Submission Checklist
lib/changes — n/a, nolib/changes here)tools/dev/msftidy.rb/rubocop -alocally and resolved all issues (not runnable in this session — see Test Evidence)