metassh icon indicating copy to clipboard operation
metassh copied to clipboard

Revive MetaSSH for the Public

Open sempervictus opened this issue 1 year ago • 0 comments

Semper Victus' fork of Metasploit contains a number of legacy tools no longer maintained upstream or even known in the community - one such tool is the MetaSSH Metasploit Plugin written by @dirtyfilthy.

During a recent engagement, SFTP-only access was provided which we needed to use to BF file-parsing systems on the client's back-end. Despite @zeroSteiner's excellent SSH session upgrade upstream, the Framework does not handle SFTP-only access correctly quite yet. Scalpel, blow torch, and lightning rod in-hand, we again brought this plugin back from the beyond to serve our engagement needs.

This commit publishes the current state of the MetaSSH plugin as extracted from the Semper Victus Framework environment in the hope of upstreaming it proper to Rapid7's Metasploit repo (which will require @dirtyfilthy's blessing since this is their code and we're just keeping it fresh/improving on the original work).

Notes: This is gory stuff - there are Arch-related evals, dynamic constant assignment, and linguistic abuse in the plugin to make everything work. Session, payload, and handler types are addressed but the paradigm never fit this sort of design since we (Framework) have yet to decouple the notions of transport, protocol, platform, runtime, and architecture in logic and implementation. Linting and housekeeping chores on the code still remain - my msftidy is not playing nice nowadays, so i'll leave that up to the next brave soul looking to dig into this code. This commit back into the plugin repository squashes years of changes and tweaking made to fit functional needs - bears review by qualified parties and fixing of horros i've written into this commit.

Testing: Still have a live, working session days into engagement. This needs wide testing if we're ever to upstream it.

sempervictus avatar Feb 05 '23 13:02 sempervictus