github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-01-14 17:37:27 +01:00
Code Releases Activity

Building, but not working yet

Browse Source 
Got an issue where certain functions aren't being resolved and hence are
null when being invoked. Need to debug the loading of the DLL to see why
this is the case.
This commit is contained in:
OJ 2020-05-26 09:40:19 +10:00
parent f4dd751b23
commit 7fab0b200a
No known key found for this signature in database
GPG Key ID: 10D3B9A154E6DF61
4 changed files with 65 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
c/meterpreter/Makefile
View File

@ -9,7 +9,7 @@ meterpreter: meterpreter-x86 meterpreter-x64
meterpreter-x86: meterpreter-x86-gen meterpreter-x86-build
meterpreter-x86-gen:
@cmake -S workspace -B workspace/build/mingw-x86 -Wno-dev -DBUILD_SNIFFER=NO -DBUILD_ARCH=Win32 -DUSE_STATIC_MSVC_RUNTIMES=ON -DCMAKE_TOOLCHAIN_FILE=i686-w64-mingw32.cmake -DDBGTRACE=ON
@cmake -S workspace -B workspace/build/mingw-x86 -Wno-dev -DBUILD_SNIFFER=NO -DBUILD_ARCH=Win32 -DUSE_STATIC_MSVC_RUNTIMES=ON -DCMAKE_TOOLCHAIN_FILE=i686-w64-mingw32.cmake
meterpreter-x86-build:
@cmake --build workspace/build/mingw-x86 --config Release
@ -20,7 +20,7 @@ meterpreter-x86-clean:
meterpreter-x64: meterpreter-x64-gen meterpreter-x64-build
meterpreter-x64-gen:
@cmake -S workspace -B workspace/build/mingw-x64 -Wno-dev -DBUILD_SNIFFER=NO -DBUILD_ARCH=x64 -DUSE_STATIC_MSVC_RUNTIMES=ON -DCMAKE_TOOLCHAIN_FILE=x86_64-w64-mingw32.cmake -DDBGTRACE=ON
@cmake -S workspace -B workspace/build/mingw-x64 -Wno-dev -DBUILD_SNIFFER=NO -DBUILD_ARCH=x64 -DUSE_STATIC_MSVC_RUNTIMES=ON -DCMAKE_TOOLCHAIN_FILE=x86_64-w64-mingw32.cmake
meterpreter-x64-build:
@cmake --build workspace/build/mingw-x64 --config Release

3
c/meterpreter/source/extensions/kiwi/main.c
View File

@ -47,6 +47,7 @@ DWORD request_exec_cmd(Remote *remote, Packet *packet)
// While this implies that powershell is in use, this is just a naming thing,
// it's not actually using powershell.
wchar_t* output = powershell_reflective_mimikatz(cmd);
dprintf("[KIWI] Executed command: %S", cmd);
if (output != NULL)
{
met_api->packet.add_tlv_wstring(response, TLV_TYPE_KIWI_CMD_RESULT, output);
@ -55,7 +56,7 @@ DWORD request_exec_cmd(Remote *remote, Packet *packet)
{
result = ERROR_OUTOFMEMORY;
}
free(cmd);
//LocalFree(cmd);
}
else
{

2
c/meterpreter/workspace/CMakeLists.txt
View File

@ -108,6 +108,7 @@ set(
ext_server_winpmem
ext_server_lanattacks
ext_server_extapi
ext_server_kiwi
)
if(MSVC)
@ -117,7 +118,6 @@ if(MSVC)
ext_server_peinjector
ext_server_mimikatz
ext_server_powershell
ext_server_kiwi
ext_server_python
)
endif()

74
c/meterpreter/workspace/ext_server_kiwi/CMakeLists.txt
View File

@ -5,16 +5,52 @@ project(${PROJECT_NAME} C)
include(${CMAKE_CURRENT_SOURCE_DIR}/../CMakeListsFuncs.txt)
add_definitions(
-D_WINDLL
-D_USRDLL
-DUNICODE
-D_UNICODE
-D_POWERKATZ
)
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /MP")
if(MSVC)
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} /MP")
else()
add_definitions(
'-D_WIN32_WINNT=0x601'
'-D__deref=SAL__deref'
'-D__deref_opt_bcount=SAL__deref_opt_bcount'
'-D__deref_opt_out_bcount=SAL__deref_opt_out_bcount'
'-D__deref_opt_out_opt=SAL__deref_opt_out_opt'
'-D__deref_out=SAL__deref_out'
'-D__deref_out_bcount=SAL__deref_out_bcount'
'-D__deref_out_bcount_opt=SAL__deref_out_bcount_opt'
'-D__deref_out_bcount_full=SAL__deref_out_bcount_full'
'-D__deref_out_ecount_full=SAL__deref_out_ecount_full'
'-D__field_bcount=DISCARD'
'-D__field_ecount=DISCARD'
'-D__field_xcount=DISCARD'
'-D__in_bcount_opt=SAL__in_bcount_opt'
'-D__in_ecount_opt=SAL__in_ecount_opt'
'-D__in_ecount_opt=SAL__in_ecount_opt'
'-D__format_string=SAL__format_string'
'-D__in_z='
'-D__inout_bcount_opt=SAL__inout_bcount_opt'
'-D__inout_bcount_part_opt=SAL__inout_bcount_part_opt'
'-D__out_bcount_full_opt=SAL__out_bcount_full_opt'
'-D__out_bcount_opt=SAL__out_bcount_opt'
'-D__out_bcount_part_opt=SAL__out_bcount_part_opt'
'-D__out_ecount_opt=SAL__out_ecount_opt'
'-D__out_xcount_opt=SAL__out_bcount_opt'
'-D__range=DISCARD2'
'-D__reserved=SAL__reserved'
'-D__success=DISCARD'
'-D__FUNCTION__=""'
'-D__struct_bcount=DISCARD'
)
endif()
include_directories(../../source/common)
include_directories(../../source/ReflectiveDllInjection/common)
include_directories(../../source/ReflectiveDLLInjection/common)
include_directories(../../source/extensions/kiwi/mimikatz/inc)
set(SRC_DIR ../../source/extensions/kiwi)
@ -43,8 +79,10 @@ list(REMOVE_ITEM SRC_FILES ${CMAKE_CURRENT_SOURCE_DIR}/${SRC_DIR}/mimikatz/mimik
add_library(${PROJECT_NAME} SHARED ${SRC_FILES})
set_target_properties(${PROJECT_NAME} PROPERTIES OUTPUT_NAME ${PROJECT_NAME}.${TARGET_ARCH})
set_target_properties(${PROJECT_NAME} PROPERTIES LINK_FLAGS "/DEF:\"${MOD_DEF_DIR}/extension.def\"")
set_source_files_properties(${MOD_DEF_DIR}/extension.def PROPERTIES HEADER_FILE_ONLY TRUE)
if(MSVC)
set_target_properties(${PROJECT_NAME} PROPERTIES LINK_FLAGS "/DEF:\"${MOD_DEF_DIR}/extension.def\"")
set_source_files_properties(${MOD_DEF_DIR}/extension.def PROPERTIES HEADER_FILE_ONLY TRUE)
endif()
if(IS_X86)
set(KIWI_LIB_DIR ${WORKSPACE_ROOT_DIR}/../source/extensions/kiwi/mimikatz/lib/Win32)
@ -53,22 +91,30 @@ else()
endif()
set(LINK_LIBS
advapi32
psapi
crypt32
Shlwapi
Secur32
Wtsapi32
shlwapi
secur32
wtsapi32
winscard
wldap32
Netapi32
Rpcrt4
SetupAPI
Userenv
Cabinet
Dnsapi
netapi32
rpcrt4
setupapi
userenv
cabinet
dnsapi
version
msxml2
)
if(MSVC)
set(LINK_LIBS
${LINK_LIBS}
msxml2
)
endif()
# Add all the custom libs that come with the mimikatz source
set(LINK_LIBS
${LINK_LIBS}