FunnyWolf
commented
2 years ago termux 适配不了,因为msf本身就不支持termux,https://github.com/rapid7/metasploit-framework/issues/11023
Closed 2096779623 closed 2 years ago
FunnyWolf
commented
2 years ago termux 适配不了,因为msf本身就不支持termux,https://github.com/rapid7/metasploit-framework/issues/11023
2096779623
commented
2 years ago termux 适配不了,因为msf本身就不支持termux,rapid7/metasploit-framework#11023
虽然termux官方不打包，处理msf相关的问题，但是可以在termux上跑msf
FunnyWolf
commented
2 years ago termux 适配不了,因为msf本身就不支持termux,rapid7/metasploit-framework#11023
虽然termux官方不打包，处理msf相关的问题，但是可以在termux上跑msf
msf是能跑起来的?在termux上?
2096779623
commented
2 years ago termux 适配不了,因为msf本身就不支持termux,rapid7/metasploit-framework#11023
虽然termux官方不打包，处理msf相关的问题，但是可以在termux上跑msf
msf是能跑起来的?在termux上?
在使用官方msf的情况下，当然可以，CobaltStrike还能转移会话到msf，用vipermsf会出现redis的问题。
FunnyWolf
commented
2 years ago termux 适配不了,因为msf本身就不支持termux,rapid7/metasploit-framework#11023
虽然termux官方不打包，处理msf相关的问题，但是可以在termux上跑msf
msf是能跑起来的?在termux上?
在使用官方msf的情况下，当然可以，CobaltStrike还能转移会话到msf，用vipermsf会出现redis的问题。
我又看了一下错误日志,应该不是redis版本问题,是vipermsf和viperpython读取redis密码(从配置文件里面读)失败了.
viperpython
vipermsf
我理解termux应该是没有/root/这种目录的,所以redis连接就失败了,可以把redis绑定在60004端口上,密码改成foobared规避一下
FunnyWolf
commented
2 years ago viper的很多文件接口直接写死了/root/.msf4/这种目录,可能也有问题
2096779623
commented
2 years ago termux 适配不了,因为msf本身就不支持termux,rapid7/metasploit-framework#11023
虽然termux官方不打包，处理msf相关的问题，但是可以在termux上跑msf
msf是能跑起来的?在termux上?
在使用官方msf的情况下，当然可以，CobaltStrike还能转移会话到msf，用vipermsf会出现redis的问题。
我又看了一下错误日志,应该不是redis版本问题,是vipermsf和viperpython读取redis密码(从配置文件里面读)失败了. viperpython
vipermsf
我理解termux应该是没有/root/这种目录的,所以redis连接就失败了,可以把redis绑定在60004端口上,密码改成foobared规避一下
改了目录之后能读取到yml，是不是跳转不到else
FunnyWolf
commented
2 years ago 改了目录之后能读取到yml，是不是跳转不到else
改成60004和foobared应该vipermsf能连上了,viperpython还是连不上,还需要把REDIS_URL改成
REDIS_URL = f"redis://:foobared@127.0.0.1:60004/"viper的很多文件接口直接写死了/root/.msf4/这种目录,可能也有问题
之前改过
FunnyWolf
commented
2 years ago 不是vipermsf,是viperpython里面
2096779623
commented
2 years ago 不是vipermsf,是viperpython里面
也改过😉
FunnyWolf
commented
2 years ago 不是vipermsf,是viperpython里面
也改过😉
那应该没有问题了,试试跑一下
2096779623
commented
2 years ago 不是vipermsf,是viperpython里面
也改过😉
那应该没有问题了,试试跑一下
msf6 > reload_all
[*] Reloading modules from all module paths...
[-] Error while running command reload_all: unsupported
Call stack:
/data/data/com.termux/files/home/metasploit-framework/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb:150:in `initialize'
/data/data/com.termux/files/home/metasploit-framework/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb:150:in `new'
/data/data/com.termux/files/home/metasploit-framework/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb:150:in `initialize_instance_variables'
/data/data/com.termux/files/home/metasploit-framework/modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb:112:in `initialize'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/module_set.rb:53:in `new'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/module_set.rb:53:in `create'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:52:in `block (3 levels) in refresh_metadata'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:48:in `each'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:48:in `block (2 levels) in refresh_metadata'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:45:in `each'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:45:in `block in refresh_metadata'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:42:in `synchronize'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/modules/metadata/cache.rb:42:in `refresh_metadata'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/module_manager/cache.rb:123:in `refresh_cache_from_module_files'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/core/module_manager/reloading.rb:51:in `reload_modules'
/data/data/com.termux/files/home/metasploit-framework/lib/msf/ui/console/command_dispatcher/modules.rb:967:in `cmd_reload_all'
/data/data/com.termux/files/home/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:581:in `run_command'
/data/data/com.termux/files/home/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:530:in `block in run_single'
/data/data/com.termux/files/home/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:524:in `each'
/data/data/com.termux/files/home/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:524:in `run_single'
/data/data/com.termux/files/home/metasploit-framework/lib/rex/ui/text/shell.rb:163:in `run'
/data/data/com.termux/files/home/metasploit-framework/lib/metasploit/framework/command/console.rb:48:in `start'
/data/data/com.termux/files/home/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in `start'
./msfconsole:23:in `<main>'vipermsf没问题了，但是viper还有点问题，我再改改
2096779623
commented
2 years ago 不是vipermsf,是viperpython里面
也改过😉
那应该没有问题了,试试跑一下
.../nginx/conf.d $ cat viper.conf
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
include /data/data/com.termux/files/home/viper/Docker/nginxconfig/viper.conf;
ssl on;
ssl_certificate /data/data/com.termux/files/home/viper/Docker/nginxconfig/server.crt;
ssl_certificate_key /data/data/com.termux/files/home/viper/Docker/nginxconfig/server.key;
ssl_session_timeout 60m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
server_name webhost;
gzip on;
gzip_min_length 1k;
gzip_comp_level 9;
gzip_types text/plain application/javascript application/x-javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png;
gzip_vary on;
gzip_disable "MSIE [1-6]\.";
client_max_body_size 200m;
error_page 497 https://$host:$server_port$uri;
access_log /data/data/com.termux/files/home/viper/Docker/log/access.log;
error_log /data/data/com.termux/files/home/viper/Docker/log/error.log;
location / {
root /data/data/com.termux/files/home/viper/dist;
try_files $uri $uri/ /index.html;
}
location /api {
uwsgi_connect_timeout 3000;
uwsgi_read_timeout 3000;
uwsgi_send_timeout 3000;
uwsgi_pass unix:/data/data/com.termux/files/home/viper/uwsgi.sock;
include /data/data/com.termux/files/usr/etc/nginx/uwsgi_params;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location /ws {
proxy_pass http://unix:/data/data/com.termux/files/home/viper/daphne.sock;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}改成https之后：
2022/04/16 17:07:26 [error] 14285#14285: *166 upstream timed out (110: Connection timed out) while SSL handshaking to upstream, client: 192.168.1.98, server: webhost, request: "GET /ws/v1/websocket/heartbeat/?&token=c0a248f15dc9ebd643d7379df50986b49fad5e7f HTTP/1.1", upstream: "https://unix:/data/data/com.termux/files/home/viper/daphne.sock/ws/v1/websocket/heartbeat/?&token=c0a248f15dc9ebd643d7379df50986b49fad5e7f", host: "192.168.1.130:60000"
~/metasploit-framework $ ./msfrpcd
Calling `DidYouMean::SPELL_CHECKERS.merge!(error_name => spell_checker)' has been deprecated. Please call `DidYouMean.correct_error(error_name, spell_checker)' instead.
[*] Use old token in /data/data/com.termux/files/home/.msf4/token.yml.
[+] Token : UFmNDvVOuZ
[*] JSON-RPC starting on 127.0.0.1:55553 (NO SSL)...
[*] URI: /api/v1/json-rpc
[*] JSON-RPC server log: /data/data/com.termux/files/home/.msf4/logs/msf-json-rpc.log
[*] JSON-RPC server PID file: /data/data/com.termux/files/home/.msf4/msf-json-rpc.pid
[*] MSF JSON-RPC web service is already running as PID 29381
[*] Start JSON-RPC server finish.
~/metasploit-framework $ ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
u0_a308 2078 0.0 0.1 35896 3844 pts/1 S<s+ 1970 0:00 /data/data/com.termux/files/usr/bin/bash -l
u0_a308 3128 1.3 0.2 39160 7048 ? R<s 1970 0:31 /data/data/com.termux/files/usr/bin/sshd -R
u0_a308 3141 0.0 0.1 35896 3892 pts/3 S<s 1970 0:00 /data/data/com.termux/files/usr/bin/bash -l
u0_a308 3145 0.0 0.2 39156 6736 ? S<s 1970 0:00 /data/data/com.termux/files/usr/bin/sshd -R
u0_a308 3146 0.0 0.1 35896 3928 pts/4 S<s 1970 0:00 /data/data/com.termux/files/usr/bin/bash -l
u0_a308 3213 0.5 0.1 36096 3316 pts/4 S<+ 1970 0:11 /system/bin/top
u0_a308 9183 0.0 0.0 246108 2668 ? S<sl 1970 0:00 /data/data/com.termux/files/usr/bin/postgres -D /data/data/com.termux/files/usr/var/lib/postgresql
u0_a308 9188 0.0 0.0 246108 1384 ? S<s 1970 0:00 postgres: checkpointer
u0_a308 9189 0.0 0.0 246108 1344 ? S<s 1970 0:00 postgres: background writer
u0_a308 9190 0.0 0.0 246108 1300 ? S<s 1970 0:00 postgres: walwriter
u0_a308 9191 0.0 0.0 248668 1812 ? S<s 1970 0:00 postgres: autovacuum launcher
u0_a308 9192 0.0 0.0 100740 1368 ? S<s 1970 0:00 postgres: stats collector
u0_a308 9193 0.0 0.0 246108 1588 ? S<s 1970 0:00 postgres: logical replication launcher
u0_a308 11891 1.1 2.9 249328 86048 pts/3 S<l 1970 0:16 /data/data/com.termux/files/usr/bin/python3 /data/data/com.termux/files/usr/bin/daphne -u /data/data/com.termux/files/home/viper/daphne.sock --access-log /data/data/com.termux/files/
u0_a308 11893 0.0 0.3 51384 9848 ? S< 1970 0:00 uwsgi --ini /data/data/com.termux/files/home/viper/Docker/uwsgi.ini
u0_a308 11895 0.0 0.1 44772 5756 ? S<s 1970 0:00 nginx: master process nginx
u0_a308 11897 17.4 3.3 567888 96804 ? S<l 1970 4:07 uwsgi --ini /data/data/com.termux/files/home/viper/Docker/uwsgi.ini
u0_a308 14167 1.1 3.2 5296660 93236 ? S<l 1970 2:38 com.termux
u0_a308 14222 0.0 0.0 39156 1516 ? S<s 1970 0:00 sshd
u0_a308 20619 0.8 0.2 44772 6456 ? S< 1970 0:03 nginx: worker process
u0_a308 22917 0.2 0.2 225616 6500 ? S<l 1970 0:18 /data/data/com.termux/files/usr/bin/python3 /data/data/com.termux/files/usr/bin/daphne -u /data/data/com.termux/files/home/viper/daphne.sock --access-log /data/data/com.termux/files/
u0_a308 23480 0.1 0.3 118324 9080 ? S<l 1970 0:11 /data/data/com.termux/files/usr/bin/python3 /data/data/com.termux/files/usr/bin/mitmdump -s /data/data/com.termux/files/home/viper/STATICFILES/Tools/proxyscan.py --ssl-insecure -p 28
u0_a308 24587 1.5 0.1 35896 3916 ? S<s 1970 0:00 /data/data/com.termux/files/usr/bin/bash -c export LANG="en_US";export LANGUAGE="en_US";export LC_ALL="en_US";free;echo finalshell_separator;uptime;echo finalshell_separator;cat /pro
u0_a308 24594 0.5 0.0 35888 2872 ? S< 1970 0:00 sleep 1
u0_a308 24595 3.0 0.1 33836 2972 pts/3 R<+ 1970 0:00 ps aux
u0_a308 29381 11.5 12.9 645492 376268 ? S<l 1970 10:08 thin server (127.0.0.1:55553) [msf-json-rpc]
u0_a308 30757 0.4 0.0 107948 1780 ? S<l 1970 0:19 redis-server 127.0.0.1:60004
u0_a308 32390 1.5 0.1 110508 4612 ? S<l 1970 0:54 redis-server 127.0.0.1:6379~/viper $ cat CONFIG.py
DEBUG = False
import yaml
def get_token():
token = "foobared"
try:
with open('/data/data/com.termux/files/home/.msf4/token.yml', 'r', encoding='utf-8') as f:
token = yaml.load(f.read(), Loader=yaml.Loader).get("token")
except Exception as E:
pass
return token
JSON_RPC_IP = '127.0.0.1'
JSON_RPC_PORT = 55553
JSON_RPC_URL = f"http://{JSON_RPC_IP}:{JSON_RPC_PORT}/api/v1/json-rpc"
RPC_TOKEN = get_token()
MSFDIR = "/data/data/com.termux/files/home/.msf4/"
REDIS_URL = f"redis://default:{RPC_TOKEN}@127.0.0.1:6379/"
CACHES = {
"default": {
"BACKEND": "django_redis.cache.RedisCache",
"LOCATION": f"{REDIS_URL}1",
"OPTIONS": {
"CLIENT_CLASS": "django_redis.client.DefaultClient",
}
}
}
CHANNEL_LAYERS = {
"default": {
"BACKEND": "channels_redis.core.RedisChannelLayer",
"CONFIG": {
"hosts": [{"address": "/data/data/com.termux/files/usr/var/run/redis/redis-server.sock", "password": f"{RPC_TOKEN}"}],
"capacity": 5000,
"expiry": 5,
},
},
}
MSFLOOTTRUE = "/data/data/com.termux/files/home/.msf4/loot" # 为了调试
还是redis的密码问题,应该是CHANNEL_LAYERS这
2096779623
commented
2 years ago 还是redis的密码问题,应该是CHANNEL_LAYERS这
~/viper $ cat CONFIG.py
DEBUG = False
import yaml
def get_token():
token = "foobared"
try:
with open('/data/data/com.termux/files/home/.msf4/token.yml', 'r', encoding='utf-8') as f:
token = yaml.load(f.read(), Loader=yaml.Loader).get("token")
except Exception as E:
pass
return token
JSON_RPC_IP = '127.0.0.1'
JSON_RPC_PORT = 55553
JSON_RPC_URL = f"http://{JSON_RPC_IP}:{JSON_RPC_PORT}/api/v1/json-rpc"
RPC_TOKEN = get_token()
MSFDIR = "/data/data/com.termux/files/home/.msf4/"
REDIS_URL = f"redis://default:{RPC_TOKEN}@127.0.0.1:6379/"
CACHES = {
"default": {
"BACKEND": "django_redis.cache.RedisCache",
"LOCATION": f"{REDIS_URL}1",
"OPTIONS": {
"CLIENT_CLASS": "django_redis.client.DefaultClient",
}
}
}
CHANNEL_LAYERS = {
"default": {
"BACKEND": "channels_redis.core.RedisChannelLayer",
"CONFIG": {
"hosts": [{"address": "/data/data/com.termux/files/usr/var/run/redis/redis-server.sock", "password": "aXOxWLAFve"],
"capacity": 5000,
"expiry": 5,
},
},
}
MSFLOOTTRUE = "/data/data/com.termux/files/home/.msf4/loot" # 为了调试
~/viper/Docker $ cat /data/data/com.termux/files/home/viper/daphne.sock
cat: /data/data/com.termux/files/home/viper/daphne.sock: No such device or address
~/viper/Docker $ cd ..
~/viper $ ls
CONFIG.py Core Docker LICENSE Lib MODULES MODULES_DATA Msgrpc PostLateral PostModule README.md STATICFILES Viper WebSocket __pycache__ daphne.sock daphne.sock.lock dist installed.txt manage.py uwsgi.pid uwsgi.sock viper.py
~/viper $
$ redis-cli -p 6379
127.0.0.1:6379> auth aXOxWLAFve
OK
127.0.0.1:6379> ping
PONG
127.0.0.1:6379> 还是redis的密码问题,应该是CHANNEL_LAYERS这
Redis没问题了，轮到msfrpcd了
[WARNING][2022-04-17 20:54:59][rpcclient][call][47][ThreadPoolExecutor-0_0] : msf连接失败,检查 http://127.0.0.1:55553/api/v1/json-rpc 是否可用
2022-04-17 20:54:59,319 WARNING msf连接失败,检查 http://127.0.0.1:55553/api/v1/json-rpc 是否可用~/metasploit-framework $ msfrpcd
Calling `DidYouMean::SPELL_CHECKERS.merge!(error_name => spell_checker)' has been deprecated. Please call `DidYouMean.correct_error(error_name, spell_checker)' instead.
[*] Use old token in /data/data/com.termux/files/home/.msf4/token.yml.
[+] Token : foobared
[*] JSON-RPC starting on 127.0.0.1:55553 (NO SSL)...
[*] URI: /api/v1/json-rpc
[*] JSON-RPC server log: /data/data/com.termux/files/home/.msf4/logs/msf-json-rpc.log
[*] JSON-RPC server PID file: /data/data/com.termux/files/home/.msf4/msf-json-rpc.pid
[*] Start JSON-RPC server finish.~/.msf4 $ redis-cli
127.0.0.1:6379>
127.0.0.1:6379> auth foobared
OK
127.0.0.1:6379> ping
PONG
127.0.0.1:6379> exit
~/.msf4 $ redis-cli -p^C
~/.msf4 $ redis-cli -p 60004
127.0.0.1:60004> auth foobared
OK
127.0.0.1:60004> ping
PONG
127.0.0.1:60004> exit
~/.msf4 $ cat token.yml
token: "foobared"
~/.msf4 $ cat redis.yml
redis_username: "default"
redis_password: "foobared"
redis_sock: "/data/data/com.termux/files/usr/var/run/redis/redis-server.sock"
~/.msf4 $ ~/metasploit-framework $ cat /data/data/com.termux/files/home/.msf4/logs/msf-json-rpc.log
2022-04-17 20:52:07 +0800 Exiting!
2022-04-17 20:52:44 +0800 Writing PID to /data/data/com.termux/files/home/.msf4/msf-json-rpc.pid~/viper $ cat CONFIG.py
DEBUG = False
import yaml
def get_token():
token = "foobared"
try:
with open('/data/data/com.termux/files/home/.msf4/token.yml', 'r', encoding='utf-8') as f:
token = yaml.load(f.read(), Loader=yaml.Loader).get("token")
except Exception as E:
pass
return token
JSON_RPC_IP = '127.0.0.1'
JSON_RPC_PORT = 55553
JSON_RPC_URL = "http://127.0.0.1:55553/api/v1/json-rpc"
RPC_TOKEN = get_token()
MSFDIR = "/data/data/com.termux/files/home/.msf4/"
REDIS_URL = "unix://default:foobared@/data/data/com.termux/files/usr/var/run/redis-server.sock?db="
CACHES = {
"default": {
"BACKEND": "django_redis.cache.RedisCache",
"LOCATION": f"{REDIS_URL}1",
"OPTIONS": {
"CLIENT_CLASS": "django_redis.client.DefaultClient",
}
}
}
CHANNEL_LAYERS = {
"default": {
"BACKEND": "channels_redis.core.RedisChannelLayer",
"CONFIG": {
"hosts": ["redis://default:foobared@127.0.0.1:6379/1"],
"capacity": 5000,
"expiry": 5,
},
},
}
MSFLOOTTRUE = "/data/data/com.termux/files/home/.msf4/loot" # 为了调试msfrpd -S 出现这个：
~/.msf4 $ msfrpcd -S
Calling `DidYouMean::SPELL_CHECKERS.merge!(error_name => spell_checker)' has been deprecated. Please call `DidYouMean.correct_error(error_name, spell_checker)' instead.
[*] Use old token in /data/data/com.termux/files/home/.msf4/token.yml.
[+] Token : foobared
[*] JSON-RPC starting on 127.0.0.1:55553 (SSL)...
[*] URI: /api/v1/json-rpc
[*] JSON-RPC server log: /data/data/com.termux/files/home/.msf4/logs/msf-json-rpc.log
[*] JSON-RPC server PID file: /data/data/com.termux/files/home/.msf4/msf-json-rpc.pid
[*] Start JSON-RPC server finish.2022-04-17 20:55:11 +0800 Thin web server (v1.8.1 codename Infinite Smoothie)
2022-04-17 20:55:11 +0800 Maximum connections set to 1024
2022-04-17 20:55:11 +0800 Listening on 127.0.0.1:55553, CTRL+C to stop
2022-04-17 21:02:44 +0800 Exiting!
2022-04-17 21:03:36 +0800 Writing PID to /data/data/com.termux/files/home/.msf4/msf-json-rpc.pid还是redis的密码问题,应该是CHANNEL_LAYERS这
除了MSFCONSOLE进不去别的都正常，部分木马不能生成（termux没有mingw）
为什么Android/meterpreter里的都是暂无数据？
FunnyWolf
commented
2 years ago bared [] JSON-RPC starting on 127.0.0.1:55553 (SSL)... [] URI: /api/v1/json-r
android的载荷没有适配,现在只实现了创建监听
描述Bug
如何复现 请说明如何复现Bug:
2.用浏览器登录viper或者用viper自定义的msf连接到Redis
3.Bug出现了
截图
提醒
我在termux上运行的viper
可能的解决方法
vipermsf
redis.conf
适配redis高版本(6.x)
@Funnywolf