水面以下的Metasploit

type msfconsole
msfconsole is /opt/metasploit-framework/bin/msfconsole

file /opt/metasploit-framework/bin/msfconsole
/opt/metasploit-framework/bin/msfconsole: POSIX shell script text executable, ASCII text

cmd=`basename $0`
EMBEDDED=$SCRIPTDIR/../embedded
BIN=$EMBEDDED/bin
FRAMEWORK=$EMBEDDED/framework

if [ -e "$FRAMEWORK/$cmd" ]; then

  if [ $cmd = "msfconsole" ]; then
    if [ -n "`find $FRAMEWORK/$cmd -mmin +20160`" ]; then
      (>&2 echo "This copy of metasploit-framework is more than two weeks old.")
      (>&2 echo " Consider running 'msfupdate' to update to the latest version.")
    fi
#   Uncomment to enable libedit support
#   cmd="$cmd -L"
    cmd="$cmd $db_args"
  fi

  $BIN/ruby $FRAMEWORK/$cmd "$@"
else
  if [ "$FROM_CONSOLE_PATH" = true ]; then
    (cd $FRAMEWORK && $BIN/ruby $BIN/$cmd "$@")
  else
    $BIN/ruby $BIN/$cmd "$@"
  fi
fi

$BIN/ruby $FRAMEWORK/$cmd "$@"

begin
  require Pathname.new(__FILE__).realpath.expand_path.parent.join('config', 'boot')
  require 'metasploit/framework/command/console'
  require 'msf/core/payload_generator'
  Metasploit::Framework::Command::Console.start
rescue Interrupt
  puts "\nAborting..."
  exit(1)
end

Metasploit::Framework::Command::Console.start

  def start
    case parsed_options.options.subcommand
    when :version
      $stderr.puts "Framework Version: #{Metasploit::Framework::VERSION}"
    else
      spinner unless parsed_options.options.console.quiet
      driver.run
    end
  end

driver.run

# Based on pattern used for lib/rails/commands in the railties gem.
class Metasploit::Framework::Command::Console < Metasploit::Framework::Command::Base

  # Provides an animated spinner in a seperate thread.
  #
  # See GitHub issue #4147, as this may be blocking some
  # Windows instances, which is why Windows platforms
  # should simply return immediately.

  def spinner
    return if Rex::Compat.is_windows
    return if Rex::Compat.is_cygwin
    return if $msf_spinner_thread
    $msf_spinner_thread = Thread.new do
      base_line = "[*] Starting the Metasploit Framework console..."
      cycle = 0
      loop do
        %q{/-\|}.each_char do |c|
          status = "#{base_line}#{c}\r"
          cycle += 1
          off    = cycle % base_line.length
          case status[off, 1]
          when /[a-z]/
            status[off, 1] = status[off, 1].upcase
          when /[A-Z]/
            status[off, 1] = status[off, 1].downcase
          end
          $stderr.print status
          ::IO.select(nil, nil, nil, 0.10)

  # The console UI driver.
  #
  # @return [Msf::Ui::Console::Driver]
  def driver
    unless @driver
      # require here so minimum loading is done before {start} is called.
      require 'msf/ui'

      @driver = Msf::Ui::Console::Driver.new(
          Msf::Ui::Console::Driver::DefaultPrompt,
          Msf::Ui::Console::Driver::DefaultPromptChar,
          driver_options
      )
    end

    @driver
  end

class Driver < Msf::Ui::Driver
  # ...

  # Initializes a console driver instance with the supplied prompt string and
  # prompt character.  The optional hash can take extra values that will
  # serve to initialize the console driver.
  def initialize(prompt = DefaultPrompt, prompt_char = DefaultPromptChar, opts = {})
    # ...

    # Process things before we actually display the prompt and get rocking
    on_startup(opts)
    # ...
  end

  # Called before things actually get rolling such that banners can be
  # displayed, scripts can be processed, and other fun can be had.
  #
  def on_startup(opts = {})
    # Check for modules that failed to load
    if framework.modules.module_load_error_by_path.length > 0
      print_error("WARNING! The following modules could not be loaded!")

      framework.modules.module_load_error_by_path.each do |path, error|
        print_error("\t#{path}: #{error}")
      end
    end

    if framework.modules.module_load_warnings.length > 0
      print_warning("The following modules were loaded with warnings:")
      framework.modules.module_load_warnings.each do |path, error|
        print_warning("\t#{path}: #{error}")
      end
    end

    framework.events.on_ui_start(Msf::Framework::Revision)

    if $msf_spinner_thread
      $msf_spinner_thread.kill
      $stderr.print "\r" + (" " * 50) + "\n"
    end

    run_single("banner") unless opts['DisableBanner']

    opts["Plugins"].each do |plug|
      run_single("load '#{plug}'")
    end if opts["Plugins"]

    self.on_command_proc = Proc.new { |command| framework.events.on_ui_command(command) }
  end

run_single("banner") unless opts['DisableBanner']

###
#
# The dispatcher shell class is designed to provide a generic means
# of processing various shell commands that may be located in
# different modules or chunks of codes.  These chunks are referred
# to as command dispatchers.  The only requirement for command dispatchers is
# that they prefix every method that they wish to be mirrored as a command
# with the cmd_ prefix.
#
###
module DispatcherShell
  # ...
  run_command(dispatcher, method, arguments)

dispatcher.send('cmd_' + method, *arguments)

    # Console Command Dispatchers to be loaded after the Core dispatcher.
    CommandDispatchers = [
      CommandDispatcher::Modules,
      CommandDispatcher::Jobs,
      CommandDispatcher::Resource,
      CommandDispatcher::Developer
    ]
    # ...

    # Add the core command dispatcher as the root of the dispatcher
    # stack
    enstack_dispatcher(CommandDispatcher::Core)
    # ...

    # Load the other "core" command dispatchers
    CommandDispatchers.each do |dispatcher|
      enstack_dispatcher(dispatcher)
    end

  # Display one of the fabulous banners.
  #
  def cmd_banner(*args)
    banner  = "%cya" + Banner.to_s + "%clr\n\n"
    # ...
    banner << ("       =[ %-#{banner_trailers[:padding]+8}s]\n" % banner_trailers[:version])
    banner << ("+ -- --=[ %-#{banner_trailers[:padding]}s]\n" % banner_trailers[:exp_aux_pos])
    banner << ("+ -- --=[ %-#{banner_trailers[:padding]}s]\n" % banner_trailers[:pay_enc_nop])

    # TODO: People who are already on a Pro install shouldn't see this.
    # It's hard for Framework to tell the difference though since
    # license details are only in Pro -- we can't see them from here.
    banner << ("+ -- --=[ %-#{banner_trailers[:padding]}s]\n" % banner_trailers[:free_trial])
    # Display the banner
    print_line(banner)

  def self.to_s
    return self.readfile ENV['MSFLOGO'] if ENV['MSFLOGO']

    logos = []

    # Easter egg (always a cow themed logo): export/set GOCOW=1
    if ENV['GOCOW']
      logos.concat(Dir.glob(::Msf::Config.logos_directory + File::SEPARATOR + 'cow*.txt'))
    # Easter egg (always a halloween themed logo): export/set THISISHALLOWEEN=1
    elsif ( ENV['THISISHALLOWEEN'] || Time.now.strftime("%m%d") == "1031" )
      logos.concat(Dir.glob(::Msf::Config.logos_directory + File::SEPARATOR + '*.hwtxt'))
    elsif ( ENV['APRILFOOLSPONIES'] || Time.now.strftime("%m%d") == "0401" )
      logos.concat(Dir.glob(::Msf::Config.logos_directory + File::SEPARATOR + '*.aftxt'))
    else
      logos.concat(Dir.glob(::Msf::Config.logos_directory + File::SEPARATOR + '*.txt'))
      logos.concat(Dir.glob(::Msf::Config.user_logos_directory + File::SEPARATOR + '*.txt'))
    end

    logos = logos.map { |f| File.absolute_path(f) }
    self.readfile logos[rand(logos.length)]
  end

  # Default configuration locations.
  Defaults    =
    {
      'ConfigDirectory'     => get_config_root,
      'ConfigFile'          => "config",
      'ModuleDirectory'     => "modules",
      'ScriptDirectory'     => "scripts",
      'LogDirectory'        => "logs",
      'LogosDirectory'      => "logos",
      'SessionLogDirectory' => "logs/sessions",
      'PluginDirectory'     => "plugins",
      'DataDirectory'       => "data",
      'LootDirectory'       => "loot",
      'LocalDirectory'      => "local"
    }

def run
  raise NotImplementedError
end

# The console driver processes various framework notified events.
include FrameworkEventManager
# The console driver is a command shell.
include Rex::Ui::Text::DispatcherShell

include Rex::Ui::Text::Resource

include Resource

# DispatcherShell derives from shell.
include Shell

  # Run the command processing loop.
  #
  def run(&block)

    begin

      while true
        # If the stop flag was set or we've hit EOF, break out
        break if self.stop_flag || self.stop_count > 1

        init_tab_complete
        update_prompt

        line = get_input_line

        # If you have sessions active, this will give you a shot to exit
        # gracefully. If you really are ambitious, 2 eofs will kick this out
        if input.eof? || line == nil
          self.stop_count += 1
          next if self.stop_count > 1
          run_single("quit")

        # If a block was passed in, pass the line to it.  If it returns true,
        # break out of the shell loop.
        elsif block
          break if block.call(line)

        # Otherwise, call what should be an overriden instance method to
        # process the line.
        else
          ret = run_single(line)
          # don't bother saving lines that couldn't be found as a
          # command, create the file if it doesn't exist, don't save dupes
          if ret && self.histfile && line != @last_line
            File.open(self.histfile, "a+") { |f| f.puts(line) }
            @last_line = line
          end
          self.stop_count = 0
        end

      end
    # Prevent accidental console quits
    rescue ::Interrupt
      output.print("Interrupt: use the 'exit' command to quit\n")
      retry
    end
  end

    def cmd_help_help
      print_line "There's only so much I can do"
    end

# command_dispatcher/modules.rb
          def commands
            {
              "back"       => "Move back from the current context",
              "advanced"   => "Displays advanced options for one or more modules",
              "info"       => "Displays information about one or more modules",
              "options"    => "Displays global options or for one or more modules",
              "loadpath"   => "Searches for and loads modules from a path",
              "popm"       => "Pops the latest module off the stack and makes it active",
              "pushm"      => "Pushes the active or list of modules onto the module stack",
              "previous"   => "Sets the previously loaded module as the current module",
              "reload_all" => "Reloads all modules from all defined module paths",
              "search"     => "Searches module names and descriptions",
              "show"       => "Displays modules of a given type, or all modules",
              "use"        => "Selects a module by name",
            }
          end

    CommandDispatchers = [
      CommandDispatcher::Modules,
      CommandDispatcher::Jobs,
      CommandDispatcher::Resource,
      CommandDispatcher::Developer
    ]

  # Run a single command line.
  def run_single(line, propagate_errors: false)
    arguments = parse_line(line)
    method    = arguments.shift
    found     = false
    error     = false
    # ...
    if (method)
      entries = dispatcher_stack.length

      dispatcher_stack.each { |dispatcher|
        next if not dispatcher.respond_to?('commands')
        begin
          # here!
          if (dispatcher.commands.has_key?(method) or dispatcher.deprecated_commands.include?(method))
            self.on_command_proc.call(line.strip) if self.on_command_proc
            run_command(dispatcher, method, arguments)
            found = true
          end

  # Uses a module.
  def cmd_use(*args)
    if args.length == 0 || args.first == '-h'
      cmd_use_help
      return false
    end

    # Divert logic for dangerzone mode
    args = dangerzone_codename_to_module(args)

    # Try to create an instance of the supplied module name
    mod_name = args[0]

    # ...
    begin
      mod = framework.modules.create(mod_name)
      unless mod
        # Try one more time; see #4549
        sleep CMD_USE_TIMEOUT
        mod = framework.modules.create(mod_name)
        unless mod
          print_error("Failed to load module: #{mod_name}")
          return false
        end
      end
    # ...
    end

    return false if (mod == nil)

    # Creates a module instance using the supplied reference name.
    #
    # @param name [String] A module reference name.  It may optionally
    #   be prefixed with a "<type>/", in which case the module will be
    #   created from the {Msf::ModuleSet} for the given <type>.
    #   Otherwise, we step through all sets until we find one that
    #   matches.
    # @return (see Msf::ModuleSet#create)
    def create(name)
      # Check to see if it has a module type prefix.  If it does,
      # try to load it from the specific module set for that type.
      names = name.split("/")
      potential_type_or_directory = names.first

      # if first name is a type
      if Msf::Modules::Loader::Base::DIRECTORY_BY_TYPE.has_key? potential_type_or_directory
        type = potential_type_or_directory
      # if first name is a type directory
      else
        type = TYPE_BY_DIRECTORY[potential_type_or_directory]
      end

      module_instance = nil
      if type
        module_set = module_set_by_type[type]

        # First element in names is the type, so skip it
        module_reference_name = names[1 .. -1].join("/")
        module_instance = module_set.create(module_reference_name)
      else
        # ...
      end

      module_instance
    end

    # Enstack the command dispatcher for this module type
    dispatcher = nil
    case mod.type
      when Msf::MODULE_ENCODER
        dispatcher = Msf::Ui::Console::CommandDispatcher::Encoder
      when Msf::MODULE_EXPLOIT
        dispatcher = Msf::Ui::Console::CommandDispatcher::Exploit
      when Msf::MODULE_NOP
        dispatcher = Msf::Ui::Console::CommandDispatcher::Nop
      when Msf::MODULE_PAYLOAD
        dispatcher = Msf::Ui::Console::CommandDispatcher::Payload
      when Msf::MODULE_AUX
        dispatcher = Msf::Ui::Console::CommandDispatcher::Auxiliary
      when Msf::MODULE_POST
        dispatcher = Msf::Ui::Console::CommandDispatcher::Post
      else
        print_error("Unsupported module type: #{mod.type}")
        return false
    end

    # If there's currently an active module, enqueque it and go back
    if (active_module)
      @previous_module = active_module
      cmd_back()
    end

    if (dispatcher != nil)
      driver.enstack_dispatcher(dispatcher)
    end

    # Update the active module
    self.active_module = mod
    # ...
  end

  # Launches an exploitation attempt.
  def cmd_exploit(*args)
    opt_str = nil
    payload = mod.datastore['PAYLOAD']
    encoder = mod.datastore['ENCODER']
    target  = mod.datastore['TARGET']
    nop     = mod.datastore['NOP']
    bg      = false
    jobify  = false
    force   = false

    # ...

    if not payload
      payload = Exploit.choose_payload(mod, target)
    end

    begin
      session = mod.exploit_simple(
        'Encoder'        => encoder,
        'Payload'        => payload,
        'Target'         => target,
        'Nop'            => nop,
        'OptionStr'      => opt_str,
        'LocalInput'     => driver.input,
        'LocalOutput'    => driver.output,
        'RunAsJob'       => jobify)
      # ...
    end

    # If we were given a session, let's see what we can do with it
    if (session)

      # If we aren't told to run in the background and the session can be
      # interacted with, start interacting with it by issuing the session
      # interaction command.
      if (bg == false and session.interactive?)
        print_line

        driver.run_single("sessions -q -i #{session.sid}")
      # Otherwise, log that we created a session
      else
        print_status("Session #{session.sid} created in the background.")
      end
    # ..
    # Worst case, the exploit ran but we got no session, bummer.
    else
      # If we didn't run a payload handler for this exploit it doesn't
      # make sense to complain to the user that we didn't get a session
      unless mod.datastore["DisablePayloadHandler"]
        fail_msg = 'Exploit completed, but no session was created.'
        print_status(fail_msg)
        begin
          framework.events.on_session_fail(fail_msg)
        # ...