Skip to content

Add report_host to Exploit::Remote::Tcp#21427

Open
g0tmi1k wants to merge 2 commits intorapid7:masterfrom
g0tmi1k:tcp_report_host
Open

Add report_host to Exploit::Remote::Tcp#21427
g0tmi1k wants to merge 2 commits intorapid7:masterfrom
g0tmi1k:tcp_report_host

Conversation

@g0tmi1k
Copy link
Copy Markdown
Contributor

@g0tmi1k g0tmi1k commented May 8, 2026

Related: #21380 (comment)

The idea is, use report_host to record if the host is up, but the service isn't.
Previously would only record if the host & service was up.

I had put it into the FTP mixin, @cdelafuente-r7 suggested doing it in the TCP.


Demo 1

There is telnet service on the target, but its not vulnerable to it:

Before

...picking a random exploit which will not work (target is metaploitable 2):

$ ./msfconsole -q -x 'db_status; workspace -D;
use exploit/windows/telnet/goodtech_telnet;
set LHOST tap0;
set RHOSTS 10.0.0.10;
run;'
[*] Connected to msf. Connection type: postgresql.
[*] Deleted workspace: default
[*] Recreated the default workspace
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
LHOST => tap0
RHOSTS => 10.0.0.10
[*] Started reverse TCP handler on 10.0.0.1:4444
[-] 10.0.0.10:2380 - Exploit failed [unreachable]: Rex::ConnectionRefused The connection was refused by the remote host (10.0.0.10:2380).
[*] Exploit completed, but no session was created.
msf exploit(windows/telnet/goodtech_telnet) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  0      0         0      0      0      0

msf exploit(windows/telnet/goodtech_telnet) >

After

$ git checkout tcp_report_host
Switched to branch 'tcp_report_host'
Your branch is up to date with 'origin/tcp_report_host'.
$ ./msfconsole -q -x 'db_status; workspace -D;
use exploit/windows/telnet/goodtech_telnet;
set LHOST tap0;
set RHOSTS 10.0.0.10;
run;'
[*] Connected to msf. Connection type: postgresql.
[*] Deleted workspace: default
[*] Recreated the default workspace
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
LHOST => tap0
RHOSTS => 10.0.0.10
[*] Started reverse TCP handler on 10.0.0.1:4444
[-] 10.0.0.10:2380 - Exploit failed [unreachable]: Rex::ConnectionRefused The connection was refused by the remote host (10.0.0.10:2380).
[*] Exploit completed, but no session was created.
msf exploit(windows/telnet/goodtech_telnet) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      0         0      0      0      0

msf exploit(windows/telnet/goodtech_telnet) > hosts

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
10.0.0.10

msf exploit(windows/telnet/goodtech_telnet) >

Demo 2

There isn't rdp service on the target at all.

Before

$ git checkout master
Switched to branch 'master'
Your branch is up to date with 'origin/master'.

$ ./msfconsole -q -x 'db_status; workspace -D;
use exploit/windows/rdp/rdp_doublepulsar_rce;
set LHOST tap0;
set RHOSTS 10.0.0.10;
run;'
[*] Connected to msf. Connection type: postgresql.
[*] Deleted workspace: default
[*] Recreated the default workspace
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
LHOST => tap0
RHOSTS => 10.0.0.10
[*] Started reverse TCP handler on 10.0.0.1:4444
[-] 10.0.0.10:3389 - Exploit aborted due to failure: disconnected: The connection was refused by the remote host (10.0.0.10:3389).
[*] Exploit completed, but no session was created.
msf exploit(windows/rdp/rdp_doublepulsar_rce) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  0      0         0      0      0      0

msf exploit(windows/rdp/rdp_doublepulsar_rce) >

After

$ git checkout tcp_report_host
Switched to branch 'tcp_report_host'
Your branch is up to date with 'origin/tcp_report_host'.

$ ./msfconsole -q -x 'db_status; workspace -D;
use exploit/windows/rdp/rdp_doublepulsar_rce;
set LHOST tap0;
set RHOSTS 10.0.0.10;
run;'
[*] Connected to msf. Connection type: postgresql.
[*] Deleted workspace: default
[*] Recreated the default workspace
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
LHOST => tap0
RHOSTS => 10.0.0.10
[*] Started reverse TCP handler on 10.0.0.1:4444
[-] 10.0.0.10:3389 - Exploit aborted due to failure: disconnected: The connection was refused by the remote host (10.0.0.10:3389).
[*] Exploit completed, but no session was created.
msf exploit(windows/rdp/rdp_doublepulsar_rce) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      0         0      0      0      0

msf exploit(windows/rdp/rdp_doublepulsar_rce) >

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

2 participants