CLI improvements #23
Comments
|
Some ideas:
Example: @Bind public class SomeExploit {
@Bind private Payload payload;
@Bind private URL url;
...
}
@Bind class SomeExecPayload {
@Bind private String cmd;
...
}
@Bind class SomeFileWritePayload {
@Bind private String path;
@Bind private String contents;
...
}
@Bind class SomeBypass {
@Bind private Payload inner;
...
}$ java ... SomeExploit
Usage:
-payload [CHOICE]
* SomeExecPayload
* SomeFileWritePayload
* SomeBypass
-url [URL]
$ java ... SomeExploit -payload SomeExecPayload
-url [URL]
-payload.cmd [String]
$ java ... SomeExploit -url http://someurl -payload SomeExecPayload -payload.cmd "somecommand"
[Successfully executed]
$ java ... SomeExploit -url http://someurl -payload SomeBypass
Usage:
-payload.inner [CHOICE]
* SomeExecPayload
* SomeFileWritePayload
* SomeBypass
$ java ... SomeExploit -url http://someurl -payload SomeBypass -payload.inner SomeFileWritePayload
Usage:
-payload.inner.path [String]
-payload.inner.contents [String]
$ java ... SomeExploit -url http://someurl -payload SomeBypass -payload.inner SomeFileWritePayload -payload.inner.path "app/webshell.jsp" -payload.inner.contents "<html>webshell-here</html>"
[Successfully executed]Might be able to abbreviate option names where it wouldn't introduce ambiguity as well. For example, $ java ... SomeExploit -u http://someurl -p SomeBypass -i SomeFileWritePayload -path "app/webshell.jsp" -contents "<html>webshell-here</html>"
[Successfully executed]Something like this seems like it would accommodate pretty much anything in the future, but I'm concerned that it may be to complex or confusing. |
|
Another useful CLI parameter could be the encoding of the serialized exploit. Based on the real word scenario I saw, useful encoding could be:
Thank you for your great job! |
|
I think the approach is very flexible and should allow future gadgets with special needs. The only thing I would add is that gadgets should also define what output formats they support so they can be generated in different formats as JavaSer (default and mandatory), XStream, Kryo, etc |
CLI arg/param parsing should support the following:
The text was updated successfully, but these errors were encountered: