changelog v1.2 20/3/2016:
+ core.py : Updated to allow msfvenom instead of msfpayload.
Liffy is a Local File Inclusion Exploitation tool.
Current features include:
– data:// for code execution
– expect:// for code execution
– input:// for code execution
– filter:// for arbitrary file reads
– /proc/self/environ for code execution in CGI mode
– Apache access.log poisoning
– Linux auth.log SSH poisoning
– Direct payload delivery with no stager
– Support for absolute and relative paths
– Support for cookies
! I have had issues with access log poisoning on current versions of Apache. This not an issue with the payload delivery and or poisoning. This is more of an issue with the request after the poisoning to kick off your shell. This may require a browser refresh. !
git clone https://github.com/hvqzao/liffy && cd liffy
Liffy requires the following libraries: requests, argparse, blessings, urlparse, daemon using pip.
python liffy.py -h
Update – Liffy now has built-in web serving functionality for all techniques that use the staged approach. This is built upon Python’s simpleHTTPServer module, and is being daemonized once spawned as a process within core.py. I have had some issues with socket reuse and the child process not being killed correctly, so QA would be appreciated, and or suggestions on how to design it better.
Original source : https://github.com/rotlogix/liffy