FileDropper

Msf::Exploit::FileDropper tracks files and directories placed on a target by an exploit or post module so they can be removed later. Its implementation is lib/msf/core/exploit/file_dropper.rb.

include

include Msf::Exploit::FileDropper

Main APIs

Method	Purpose
register_file_for_cleanup(path)	Schedule a file for removal
register_files_for_cleanup(*paths)	Schedule multiple files
register_dir_for_cleanup(path)	Schedule a directory for removal
register_dirs_for_cleanup(*paths)	Schedule multiple directories
cleanup	Attempt removal on exit (hooked by the mixin)

Examples

def exploit
  remote = '/tmp/' + Rex::Text.rand_text_alpha(8)
  write_file_via_vuln(remote, payload.encoded)
  register_file_for_cleanup(remote)

  execute_remote(remote)
end

vars_form_data = [
  {
    'name' => 'upload',
    'data' => payload.encoded,
    'filename' => 'shell.php',
    'content_type' => 'application/octet-stream'
  }
]
send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'upload.php'),
  'vars_form_data' => vars_form_data
)
register_file_for_cleanup('shell.php')

It also tries to remove files after a session is obtained. Removal is not always possible, so record what was placed in the writeup or notes.