CI Code Climate Gem Version


ronin-post_ex is a Ruby API for Post-Exploitation.

This library is used by ronin-payloads, ronin-c2, and ronin-exploits to provide a Post-Exploitation API around payloads, C2 sessions, or even exploits.

ronin-post_ex is part of the ronin-rb project, a Ruby toolkit for security research and development.



  • Does not currently support Windows systems.
  • Does not fully support bidirectional fully interactive shell commands.


Bind Shell

session = Ronin::PostEx::Sessions::BindShell.connect(host,port)
system  = session.system'/')
# => "..."

Reverse Shell

session = Ronin::PostEx::Sessions::ReverseShell.listen(host,port)
system  = session.system'/')
# => "..."

Custom Session Class

Define a custom session class which defines the Post-Exploitation API methods:

class RATSession < Ronin::PostEx::Sessions::Session

  def initialize(host,port)
    # ...

  def rpc_call(method,*arguments)
    # ...

  def fs_read(path)

  def shell_exec(command)

  # ...


session =
system  = session.system


Interact with the system's remote files as if they were local files:

file ='/etc/passwd')

file.each_line do |line|
  user, x, uid, gid, name, home_dir, shell = line.split(':')

  puts "User Detected: #{user} (id=#{uid})"

Get information about the current process:
# => 1234

# => 1001

# => {"HOME"=>"...", "PATH"=>"...", ...}

Execute commands on the remote system:'/')
# => "bin\nboot\ndev\netc\nhome\nlib\nlib64\nlost+found\nmedia\nmnt\nopt\nproc\nroot\nrun\nsbin\nsnap\nsrv\nsys\ntmp\nusr\nvar\n""find -type f -name '*.xls' /srv") do |path|
  puts "Found XLS file: #{path}"

Spawn an interactive command shell:

Spawn an interactive post-exploitation system shell:

ronin-post_ex> help
  help [COMMAND]                    Prints the list of commands or additional help
  fs.chdir DIR                      Changes the current working directory
  fs.pwd                            Prints the current working directory
  fs.readfile FILE                  Reads the contents of a given FILE
  fs.readlink SYMLINK               Reads the destination path of a symlink
  fs.readdir DIR                    Reads the contents of a given directory
  fs.hexdump FILE                   Hexdumps a given file
  fs.copy SRC DEST                  Copies the SRC file to the DEST path
  fs.unlink FILE                    Deletes a given file
  fs.rmdir DIR                      Removes a given directory SRC DEST                    Moves or renames a given file or directory SRC DEST                  Creates a link from the source to the destination
  fs.chown USER PATH                Changes the owner of a given file or directory
  fs.chgrp GROUP PATH               Changes the group of a given file or directory
  fs.chmod MODE PATH                Changes the permission mode of a given file or directory
  fs.stat PATH                      Prints file system information about a given file or directory PATH [MODE]               Opens a file for reading or writing
  files                             Lists opened files FILE_ID POS [WHENCE]    Seeks to a position within the file FILE_ID LENGTH          Reads LENGTH of data from an opened file
  file.write FILE_ID DATA           Writes data to an opened file
  file.close FILE_ID                Closes an open file



$ gem install ronin-post_ex


gem 'ronin-post_ex', '~> 0.1'


gem.add_dependency 'ronin-post_ex', '~> 0.1'


  1. Fork It!
  2. Clone It!
  3. cd ronin-post_ex/
  4. bundle install
  5. git checkout -b my_feature
  6. Code It!
  7. bundle exec rake spec
  8. git push origin my_feature


Copyright (c) 2007-2023 Hal Brodigan (postmodern.mod3 at

ronin-post_ex is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

ronin-post_ex is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public License along with ronin-post_ex. If not, see