Exploit Format

From Metasploit Unleashed

The format of an Exploit in Metasploit is similar to that of an Auxiliary but there are more fields.

There is always a Payload information block. An Exploit without a Payload is simply an Auxiliary module.
A listing of available Targets is outlined.
Instead of defining run(), exploit() and check() are used.

Exploit Skeleton

class Metasploit3 < Msf::Exploit::Remote

      include Msf::Exploit::Remote::TCP

      def initialize
           super(
               'Name'          => 'Simplified Exploit Module',
               'Description'   => 'This module sends a payload',
               'Author'        => 'My Name Here',
               'Payload'       => {'Space' => 1024, 'BadChars' => “\x00”},
               'Targets'       => [ ['Automatic', {} ] ],
               'Platform'      => 'win',
           )
           register_options( [
               Opt::RPORT(12345)
           ], self.class)
      end

      # Connect to port, send the payload, handle it, disconnect
      def exploit
           connect()
           sock.put(payload.encoded)
           handler()
           disconnect()
      end
end

Defining Vulnerability Tests

Although it is rarely implemented, a method called check() should be defined in your exploit modules whenever possible.

The check() method verifies all options except for payloads.
The purpose of doing the check is to determine is the target is vulnerable or not.
Returns a defined Check value.

The return values for check() are:

CheckCode::Safe - not exploitable
CheckCode::Detected - service detected
CheckCode::Appears - vulnerable version
CheckCode::Vulnerable - confirmed
CheckCode::Unsupported - check is not supported for this module.

Sample check() Method

def check
     # connect to get the FTP banner
     connect

     # disconnect since have cached it as self.banner
     disconnect
    
     case banner
          when /Serv-U FTP Server v4\.1/
               print_status('Found version 4.1.0.3, exploitable')
               return Exploit::CheckCode::Vulnerable

          when /Serv-U FTP Server/
               print_status('Found an unknown version, try it!');
               return Exploit::CheckCode::Detected

          else
               print_status('We could not recognize the server banner')
               return Exploit::CheckCode::Safe
     end

     return Exploit::CheckCode::Safe
end

Exploit Development > Exploit Format