github/metasploit-payloads
1
Fork 0
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-03-24 18:16:24 +01:00
Code Releases Activity

Add fix up tracking the process handle

Browse Source 
This allows the process handle to be closed when the process was not
started by the Meterpreter instance.
This commit is contained in:
Spencer McIntyre 2023-03-02 15:54:37 -05:00
parent 5f79b77c3d
commit e01dbdbb5d
2 changed files with 29 additions and 25 deletions

2
python/meterpreter/ext_server_stdapi.py

@ -1353,6 +1353,8 @@ def stdapi_sys_process_attach(request, response):
handle = OpenProcess(permissions, inherit, pid) handle = OpenProcess(permissions, inherit, pid)
if not handle: if not handle:
return error_result_windows(), response return error_result_windows(), response
meterpreter.processes[handle] = None
debug_print('[*] added process id: ' + str(pid) + ', handle: ' + str(handle))
response += tlv_pack(TLV_TYPE_HANDLE, handle) response += tlv_pack(TLV_TYPE_HANDLE, handle)
return ERROR_SUCCESS, response return ERROR_SUCCESS, response

52
python/meterpreter/meterpreter.py

@ -1259,6 +1259,21 @@ class PythonMeterpreter(object):
self.next_channel_id += 1 self.next_channel_id += 1
return idx return idx
def close_channel(self, channel_id):
if channel_id not in self.channels:
return False
channel = self.channels[channel_id]
try:
channel.close()
except Exception:
debug_traceback('[-] failed to close channel id: ' + str(channel_id))
return False
del self.channels[channel_id]
if channel_id in self.interact_channels:
self.interact_channels.remove(channel_id)
debug_print('[*] closed and removed channel id: ' + str(channel_id))
return True
def add_process(self, process): def add_process(self, process):
if has_windll: if has_windll:
PROCESS_ALL_ACCESS = 0x1fffff PROCESS_ALL_ACCESS = 0x1fffff
@ -1274,37 +1289,24 @@ class PythonMeterpreter(object):
return handle return handle
def close_process(self, proc_h_id): def close_process(self, proc_h_id):
proc_h = self.processes.pop(proc_h_id, None) if proc_h_id not in self.processes:
if not proc_h:
return False return False
for channel_id, channel in self.channels.items(): proc_h = self.processes.pop(proc_h_id)
if not isinstance(channel, MeterpreterProcess): if proc_h:
continue # proc_h is only set when we started the process via execute and not when we attached to it
if not channel.proc_h is proc_h: for channel_id, channel in self.channels.items():
continue if not isinstance(channel, MeterpreterProcess):
self.close_channel(channel_id) continue
break if not channel.proc_h is proc_h:
continue
self.close_channel(channel_id)
break
if has_windll: if has_windll:
CloseHandle = ctypes.windll.kernel32.CloseHandle CloseHandle = ctypes.windll.kernel32.CloseHandle
CloseHandle.argtypes = [ctypes.c_void_p] CloseHandle.argtypes = [ctypes.c_void_p]
CloseHandle.restype = ctypes.c_long CloseHandle.restype = ctypes.c_long
CloseHandle(proc_h_id) CloseHandle(proc_h_id)
debug_print('[*] closed and removed process id: ' + str(proc_h.pid) + ', handle: ' + str(proc_h_id)) debug_print('[*] closed and removed process handle: ' + str(proc_h_id))
return True
def close_channel(self, channel_id):
if channel_id not in self.channels:
return False
channel = self.channels[channel_id]
try:
channel.close()
except Exception:
debug_traceback('[-] failed to close channel id: ' + str(channel_id))
return False
del self.channels[channel_id]
if channel_id in self.interact_channels:
self.interact_channels.remove(channel_id)
debug_print('[*] closed and removed channel id: ' + str(channel_id))
return True return True
def get_packet(self): def get_packet(self):