go|go hack（五）使用go rpc和metasploit联动 gohack（五）使用gorpc和metasplo

go网络安全代码地址
准备工作

开启metasploit的rpc通信
- kali中msfconsole 进入交互模式
- load msgrpc Pass=123 Serverhost=0.0.0.0 开启rpc
【go|go hack（五）使用go rpc和metasploit联动】metasploit使用messagePack进行通信，
- go get gopkg.in/vmihailenco/msgpack.v2 使用第三方的messagepack包

基础知识

metaploit api
flag \`msgpack:",asArray"\` \`msgpck:",omitempty"\`
msgpack强制为索引数组 _msgpack struct{} \`msgpack:",asArray"\`

package rpcimport ( "bytes" "fmt" "log" "net/http""gopkg.in/vmihailenco/msgpack.v2" )// sessionlist 请求的结构体 type SessionListReq struct { _msgpack struct{} `msgpack:",asArray"` // 当做索引数组解析 Methodstring Tokenstring }// sessionList 的响应 type SessionListRes struct { IDuint32 `msgpack:",omitempty"` // 可选参数 Typestring `msgpack:"type"` TunnelLocal string `msgpack:"tunnel_local"` TunnelPeerstring `msgpack:"tunnel_peer"` ViaExploitstring `msgpack:"via_exploit"` ViaPayloadstring `msgpack:"via_payload"` Descstring `msgpack:"desc"` Infostring `msgpack:"info"` Workspacestring `msgpack:"workspack"` SessionHost string `msgpack:"session_host"` SessionPort int`msgpack:"session_port"` Usernamestring `msgpack:"username"` UUIDstring `msgpack:"uuid"` ExploitUUID string `msgpack:"exploit_uuid"` }// 登录请求 type loginReq struct { _msgpack struct{} `msgpack:",asArray"` Methodstring Username string Passstring }// 登录返回 type loginRes struct { Resultstring `msgpack:"result"` Tokenstring `msgpack:"token"` Errorbool`msgpack:"error"` ErrorClassstring `msgpack:"error_class"` ErrorMessage string `msgpack:"error_message"` }//登出请求 type logoutReq struct { _msgpackstruct{} `msgpack:",asArray"` Methodstring Tokenstring LogoutToken string }// 登出响应 type logoutRes struct { Result string `msgpack:"result"` }// 通用信息 type Msf struct { hoststring userstring passstring token string }// 初始化 func New(host, user, pass string) (*Msf, error) { rtn := &Msf{ host: host, user: user, pass: pass, }if err := rtn.Login(); err != nil { return nil, err }return rtn, nil }func (msf *Msf) send(req interface{}, res interface{}) error { buf := new(bytes.Buffer) //https://blog.csdn.net/flyfreelyit/article/details/80291945bytes.Buffer 使用 // encodereq放到buf中msgpack.NewEncoder(buf).Encode(req) dst := fmt.Sprintf("http://%s/api", msf.host) resp, err := http.Post(dst, "binary/message-pack", buf) if err != nil { log.Printf("%s", err) return err }defer resp.Body.Close()if err = msgpack.NewDecoder(resp.Body).Decode(res); err != nil { log.Printf("%s", err) return err } fmt.Println(res)return nil}func (msf *Msf) Login() error { ctx := &loginReq{ Method:"auth.login", Username: msf.user, Pass:msf.pass, } var res loginRes // send 的第二个参数为interface 可以接收任何类型 if err := msf.send(ctx, &res); err != nil { log.Printf("%s", err) return err } msf.token = res.Token return nil }func (msf *Msf) Logout() error { ctx := &logoutReq{ Method:"auth.logout", Token:msf.token, LogoutToken: msf.token, } var res logoutResif err := msf.send(ctx, &res); err != nil { log.Println(err) return err }msf.token = "" return nil }func (msf *Msf) SessionList() (map[uint32]SessionListRes, error) { req := &SessionListReq{ Method: "session.list", Token:msf.token, }res := make(map[uint32]SessionListRes)if err := msf.send(req, &res); err != nil { log.Fatal(err) return nil, err }for id, session := range res { session.ID = id res[id] = session }return res, nil }