Metasploit-framework: Ability to filter the --list output

[noraj]

tags : [msfvenom, feature request]
priority : low
easiness : easy  || medium

Description

When running msfvenom --list payloads --platform linux it lists all payloads (for linux, java, osx, windows, etc.), it would be great that when --platform is used it filter the --list output.

This could avoid the usage of grep 'linux/' or more complex patterns when waiting to filter through several criteria payloads, encoders, nops, platforms, archs, encrypt, formats, all.

Ex:

• payloads could be filtered by platform, archs
• encoders could be filtered by archs
• maybe more

[wvu-r7]

Quick 10-minute PoC seems to be working nicely:

wvu@kharak:/rapid7/metasploit-framework:master$ ./msfvenom -l payloads -a x64 --platform linux

Framework Payloads (556 total) [--payload <value>]
==================================================

    Name                                  Description
    ----                                  -----------
    generic/custom                        Use custom string or file as payload. Set either PAYLOADFILE or PAYLOADSTR.
    generic/shell_bind_tcp                Listen for a connection and spawn a command shell
    generic/shell_reverse_tcp             Connect back to attacker and spawn a command shell
    linux/x64/exec                        Execute an arbitrary command
    linux/x64/meterpreter/bind_tcp        Inject the mettle server payload (staged). Listen for a connection
    linux/x64/meterpreter/reverse_tcp     Inject the mettle server payload (staged). Connect back to the attacker
    linux/x64/meterpreter_reverse_http    Run the Meterpreter / Mettle server payload (stageless)
    linux/x64/meterpreter_reverse_https   Run the Meterpreter / Mettle server payload (stageless)
    linux/x64/meterpreter_reverse_tcp     Run the Meterpreter / Mettle server payload (stageless)
    linux/x64/pingback_bind_tcp           Accept a connection from attacker and report UUID (Linux x64)
    linux/x64/pingback_reverse_tcp        Connect back to attacker and report UUID (Linux x64)
    linux/x64/shell/bind_tcp              Spawn a command shell (staged). Listen for a connection
    linux/x64/shell/reverse_tcp           Spawn a command shell (staged). Connect back to the attacker
    linux/x64/shell_bind_ipv6_tcp         Listen for an IPv6 connection and spawn a command shell
    linux/x64/shell_bind_tcp              Listen for a connection and spawn a command shell
    linux/x64/shell_bind_tcp_random_port  Listen for a connection in a random port and spawn a command shell. Use nmap to discover the open port: 'nmap -sS target -p-'.
    linux/x64/shell_find_port             Spawn a shell on an established connection
    linux/x64/shell_reverse_ipv6_tcp      Connect back to attacker and spawn a command shell over IPv6
    linux/x64/shell_reverse_tcp           Connect back to attacker and spawn a command shell

wvu@kharak:/rapid7/metasploit-framework:master$

[wvu-r7]

Encoders can already filter by arch:

wvu@kharak:/rapid7/metasploit-framework:master$ ./msfvenom -l encoders -a x64

Framework Encoders (architectures: x64) [--encoder <value>]
===========================================================

    Name              Rank    Description
    ----              ----    -----------
    generic/eicar     manual  The EICAR Encoder
    generic/none      normal  The "none" Encoder
    x64/xor           normal  XOR Encoder
    x64/xor_context   normal  Hostname-based Context Keyed Payload Encoder
    x64/xor_dynamic   normal  Dynamic key XOR Encoder
    x64/zutto_dekiru  manual  Zutto Dekiru

wvu@kharak:/rapid7/metasploit-framework:master$

[noraj]

@wvu-r7 Great!

[ccondon-r7]

@wvu-r7 was this implemented?

[wvu-r7]

Apparently it was. Huh.

[wvu-r7]

Apparently I never committed it, much less PR'd it. The patch is gone now. This is less an enhancement request and nearly a bug report, since the behavior indicated is expected of multiple options. Let me see what I can come up with in 10 minutes. :joy:

[wvu-r7]

Reopening as an anti-bug request. :P

[wvu-r7]

wvu@kharak:/rapid7/metasploit-framework:master$ ./msfvenom -l payloads -a x64 --platform linux

Framework Payloads (559 total) [--payload <value>]
==================================================

    Name                                  Description
    ----                                  -----------
    generic/custom                        Use custom string or file as payload. Set either PAYLOADFILE or PAYLOADSTR.
    generic/shell_bind_tcp                Listen for a connection and spawn a command shell
    generic/shell_reverse_tcp             Connect back to attacker and spawn a command shell
    linux/x64/exec                        Execute an arbitrary command
    linux/x64/meterpreter/bind_tcp        Inject the mettle server payload (staged). Listen for a connection
    linux/x64/meterpreter/reverse_tcp     Inject the mettle server payload (staged). Connect back to the attacker
    linux/x64/meterpreter_reverse_http    Run the Meterpreter / Mettle server payload (stageless)
    linux/x64/meterpreter_reverse_https   Run the Meterpreter / Mettle server payload (stageless)
    linux/x64/meterpreter_reverse_tcp     Run the Meterpreter / Mettle server payload (stageless)
    linux/x64/pingback_bind_tcp           Accept a connection from attacker and report UUID (Linux x64)
    linux/x64/pingback_reverse_tcp        Connect back to attacker and report UUID (Linux x64)
    linux/x64/shell/bind_tcp              Spawn a command shell (staged). Listen for a connection
    linux/x64/shell/reverse_tcp           Spawn a command shell (staged). Connect back to the attacker
    linux/x64/shell_bind_ipv6_tcp         Listen for an IPv6 connection and spawn a command shell
    linux/x64/shell_bind_tcp              Listen for a connection and spawn a command shell
    linux/x64/shell_bind_tcp_random_port  Listen for a connection in a random port and spawn a command shell. Use nmap to discover the open port: 'nmap -sS target -p-'.
    linux/x64/shell_find_port             Spawn a shell on an established connection
    linux/x64/shell_reverse_ipv6_tcp      Connect back to attacker and spawn a command shell over IPv6
    linux/x64/shell_reverse_tcp           Connect back to attacker and spawn a command shell

wvu@kharak:/rapid7/metasploit-framework:master$

That took longer than expected. But still 10 minutes since reopening!