User input passed as a variable to subprocess.call

Question

Im trying to pass a variable into another program that is being launched. I having issues with the variable working

here is the code It all works up until the passing of RHOST, metasploit takes it as %RHOST

I need to pass the RHOST variable straight after set RHOSTS . Help please :)

#!/usr/bin/python
import os,sys,re,subprocess
RHOST=raw_input("Enter ipaddress range:")
print ("Your Address range is\n" + RHOST + "!")
subprocess.call("xterm -e msfconsole -x 'sleep 2; use auxiliary/scanner/discovery/arp_sweep; set RHOSTS '%RHOST'; exploit'",shell=True)
end = raw_input('Hit Enter to Exit.')

do you want to pass your RHOST value instead of %RHOST in a call? — midori, Jan 16 '16 at 00:38

score 0 · Accepted Answer · answered Jan 16 '16 at 00:34

0

use string format:

"xterm -e msfconsole -x 'sleep 2; use auxiliary/scanner/discovery/arp_sweep; set RHOSTS '\%{0}'; exploit'".format(RHOST)

answered Jan 16 '16 at 00:34

midori

4,807
5
34
62

Be aware that if RHOST comes from an untrusted source, this could lead to security problems is RHOST could contain special shell characters like ' and ; – Penguin Brian Jan 16 '16 at 02:15

User input passed as a variable to subprocess.call

1 Answers1