1
mirror of https://github.com/rapid7/metasploit-payloads synced 2024-12-21 05:35:54 +01:00
Commit Graph

1557 Commits

Author SHA1 Message Date
Brent Cook
9a629da783 Land #5214, initial meterpreter session recovery support 2015-05-04 16:25:27 -05:00
Brent Cook
c7617615e4 Land #155, remove file and console output from kiwi 2015-05-04 15:10:16 -05:00
David Maloney
e0665a2ba5 add some additional function comments
add some basic function documentation in
the form of comments. not eprfect, but a start
on propper documentation

MSP-12356
2015-05-04 11:14:42 -05:00
David Maloney
dee9a5efab some more code smell cleanup
bad memory cleanup issues around CAPI
and another constant for the length of a hash string

MSP-12356
2015-05-04 10:47:49 -05:00
David Maloney
8e93c26ce8 add constants for HASH Length
added constants for byte length of a hash
as well as athe null terminated length

MSP-12356
2015-05-04 10:41:48 -05:00
Brent Cook
5f52fefbef expand glob match 2015-05-04 03:56:15 -05:00
Brent Cook
b85528720b teach pymet how to glob on ls as well 2015-05-04 03:56:14 -05:00
OJ
b5f5d0ae17 Remove console and file output from kiwi
This PR removes both log file and console output from kiwi. This is done so that those people who are unfortunate enough to migrate to a console app before running kiwi don't end up rendering all of the console output to a window that the user can see.
2015-05-04 09:14:37 +10:00
David Maloney
651e7a5135 Revert "Revert "Merge branch 'master' into feature/MSP-12356/ntds-parser""
This reverts commit 5a7d2ae84f830242486301cad0b26168f3ec973b.
2015-05-01 10:32:15 -05:00
David Maloney
a208343153 and again
another missing free

MSP-12356
2015-04-30 16:01:22 -05:00
David Maloney
c9cf6be97a more memory cleanup
more missing free calls

MSP-12356
2015-04-30 15:43:58 -05:00
David Maloney
e2f4438dc4 do account reads in batches
a channel read on the ntds channel will now read
up to 20 accounts at a time. when we run out of accounts
we set the EOF flag to let the other side know
we are done

MSP-12356
2015-04-30 14:05:10 -05:00
David Maloney
8ff6ebab85 add channel close
the channel close will now initiate the jet engine
shutdown, and free the context

MSP-12356
2015-04-30 13:23:39 -05:00
David Maloney
5c1c9c317d free the useraccount each time too
make sure we are doing good memory cleanup

MSP-12356
2015-04-30 13:18:55 -05:00
David Maloney
3ebf0513b0 properly cleanup memory around hash history
we were not freeing the buffers we created
as palceholders for decrypting hash history.
this would cause crashes when we wold start dealing
with multiple accounts in a row with a hash history.
freeing the buffers seems to fix the problem

MSP-12356
2015-04-30 13:15:17 -05:00
OJ
1c9c199e74 Fix up issues with transport hopping
Transport hopping checks for prev/next weren't right. Also, moving from TCP comms was resulting failure due to the fact that it's close to impossible to get Windows to flush the buffer to MSF prior to terminating the socket without doing all kinds of horrible stuff to the socket options (which would ultimately bloat the stagers).

Instead we rely on MSf to clean things up.
2015-04-30 22:39:24 +10:00
David Maloney
1612fce10c Revert "Merge branch 'master' into feature/MSP-12356/ntds-parser"
This reverts commit 336fb48756942c73846f191135751e5d4e9b552d, reversing
changes made to be7e34858b88bbc816f208d16259b058c5819ad8.
2015-04-29 15:08:17 -05:00
Matt Buck
cbd53ce8a4 Merge branch 'master' into staging/rails-4.0
Conflicts:
	Gemfile.lock
	plugins/nessus.rb
2015-04-28 15:33:46 -05:00
David Maloney
6dc046eeea Merge branch 'master' into feature/MSP-12356/ntds-parser 2015-04-28 08:23:17 -05:00
OJ
a046d80877 More transport features, UUID fetcher
Users can now add transports without switching to them straight away. They can then move forward and backwards using the next and prev commands in MSF. There's also the get UUID facility too.
2015-04-28 20:20:40 +10:00
OJ
b36c6d96b7 Generate config on the fly for the sake of migration
Migration now works again, and supports all the transports while migrating as well. At the moment we don't have the ability to take extensions across as well, though that might come when we have fixed up the issues with stageless meterpreter.
2015-04-28 17:43:22 +10:00
OJ
479b501fec Remove commented out stuff from header files 2015-04-28 14:03:24 +10:00
Brent Cook
4693429496 Land #151, #152 - transport switching and recovery 2015-04-27 22:54:26 -05:00
OJ
26b82dfb83 Remove guesswork and SOCKADDR persistence from remote
Instead, we'll rely on the configuration block for the transport.
2015-04-28 13:50:13 +10:00
OJ
c33e486ccc Prevent transport deletion on failure 2015-04-28 12:50:03 +10:00
OJ
04429dc6de Remove crud code 2015-04-28 12:35:09 +10:00
OJ
081d89f23e Re-add the session exiry to transport switching 2015-04-28 12:30:13 +10:00
OJ
b8f3eafb6e Fix transport switching
Creation of transports for switching is done a little differently now. But the transports do cycle correctly now when things fail, each with their respective retry times.
2015-04-28 11:23:37 +10:00
Brent Cook
c268efc325 disable debug by default 2015-04-27 12:12:24 -05:00
Brent Cook
644bef77f6 remove duplicate check in SAFE_FREE 2015-04-27 11:43:35 -05:00
OJ
87a2bf6189 Fix small issues, code tidy 2015-04-25 20:38:17 +10:00
OJ
9d8489a972 First pass of configuration changes for multi transport
This relies on some work done to the RDI repository, need to get
that landed before I can get this going.
2015-04-25 11:11:29 +10:00
David Maloney
6914b3947a move on to the next user each time 2015-04-24 13:33:37 -05:00
David Maloney
3bfeec2a7a w00t pulled an account down
successfully pulled an account down over the chanel

MSP-12356
2015-04-24 13:04:36 -05:00
David Maloney
52571872c4 move to the first user record
move through the datatable until we find
the first sam user object.

MSP-12356
2015-04-23 16:51:07 -05:00
David Maloney
9d5c3c1610 pass CRYPT_VERIFYCONTEXT flag
not passing this flag was causing an error attempting
to open the keyset. by setting this we are telling the
CAPI that we only care about ephemeral keys, and so we don't
run into the container issues.

MSP-12356
2015-04-23 15:27:00 -05:00
David Maloney
ac0978abcd attaching database correctly
we have the database attaching properly
seems to be an error decrypting the PEK though

MSP-12356
2015-04-23 14:43:28 -05:00
David Maloney
54b91aab08 clean build
the project now builds cleanly. the code isn't fully itnegrated
but it's in there and it builds which means it's nearly
perfect =P

MSP-12356
2015-04-23 11:53:33 -05:00
David Maloney
2769d986fe migrate all the poc code in
all of the poc libs are migrated in,
compiler warnings are blocking compile at this moment
2015-04-23 10:39:25 -05:00
OJ
1b600dbfbe Couple of small tweaks to make posix happy again 2015-04-23 20:00:57 +10:00
OJ
fe566d5f07 Moved transport stuff from core to metsrv
Lots of transported related things were in the core library which didn't make any sense given that the only thing that needed it was metsrv. This moves the functionality out into metsrv, reformats stuff and gets rid of some dead code.

TODO: Make this work with POSIX.
2015-04-23 19:41:25 +10:00
David Maloney
85987b9cbe start migrating ntds code in
moving the code chunks from the poc into
the actual meterp project
2015-04-22 16:03:30 -05:00
Brent Cook
a1b2e2c327 fix crash on fork with OSX Python meterpreter using SystemConfiguration
Calling into SystemConfiguration before forking seems to allow the child
process to use it without a null pointer dereference.
2015-04-21 17:17:27 -05:00
David Maloney
1d1ebe0592 Merge branch 'master' into feature/MSP-12356/ntds-parser 2015-04-21 09:46:34 -05:00
David Maloney
b6d8909227 testing channel creation
just a simple test to make sure i
understand streampool channel creation
2015-04-21 09:45:30 -05:00
OJ
969b8fb4af Update of code from Windows 2015-04-21 20:11:53 +10:00
OJ
5f0422943f Merge branch 'connection-recovery' of github.com:OJ/meterpreter into connection-recovery 2015-04-21 20:02:54 +10:00
OJ
4ca9daa254 Merge branch 'upstream/master' into connection-recovery 2015-04-21 19:59:16 +10:00
OJ
60c4749a91 Land #150 : WinHttp send/receive code dedupe 2015-04-21 19:57:50 +10:00
Brent Cook
9269a14e6a Merge common WinHttp init code between send and receive functions.
So we don't have any missing initialization between send and receive, this
factors out the common bits.
2015-04-20 16:30:26 -05:00