1
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-04-24 10:09:49 +02:00

437 Commits

Author SHA1 Message Date
OJ
33d7c55429 Land : short file names, file list fixes 2015-03-19 13:03:27 +10:00
OJ
c93ba9608c Fix bad POSIX support for stageless meterpreter
* Make sure POSIX has the new extension command enumeration function.
* Add support for deinit of extensions.
* Make sure extensions are tracked like they in Windows.
* Fix up a few export definitions.
* Stop using strncpy_s in POSIX code.
2015-03-19 11:07:22 +10:00
Brent Cook
eba69cf20e add short name support to filesystem listing.
Also, fix path builder order for stat.
2015-03-18 16:05:30 -05:00
OJ
85783773d5 Land : filesystem refactor and initial unicode support 2015-03-18 18:01:05 +10:00
Brent Cook
e8318f8c5b correct various issues listing files
* bury common _snprintf that snuck in while testing the Windows version back
   into the platform-specific code.
 * remove now-unneeded separator defines
 * don't free a stack variable on windows
2015-03-18 02:11:13 -05:00
Brent Cook
8944ca5156 modify fs_getwd so it allocates the path 2015-03-17 15:28:27 -05:00
Brent Cook
95e102a90c cast size_t on read/write to proper result for the TLV 2015-03-17 15:27:48 -05:00
Brent Cook
7c8b723c15 convert windows filesystem operations to unicode 2015-03-17 14:32:20 -05:00
Brent Cook
f0eac5877a Refactor filesystem operations
Separate the stdapi handling code from the OS-dependent code. This makes
testing and maintaining the code easier.

This also happens to fix a number of bugs as a side-effect, because it is
clearer what is happening now.
2015-03-17 14:32:20 -05:00
OJ
0393927159 Add extension names, enuemrators, etc
This commit contains a bunch of code tidying (formatting, spaces, naming, etc) as well as new exports for each of the modules so that the extension can be identified. The plan is for the loader to know which modules are loaded so that when stageless meterpreter fires up MSF can query the existing extensions and load the appropriate functionality on the client side.
2015-03-09 21:28:27 +10:00
Brent Cook
a4f81a51b5 make real_dprintf available even if DEBUGTRACE is not set
By making this a static _inline, it is not necessary to guard it, since
an inline is only instantiated if it is used. This also allows adding
one-off debug message for use during debugging sessions, without turning
on DEBUGTRACE all over the place.

Convert a few of the extensions to also do this as well, making them perhaps
slightly smaller.

I am curious why Windows builds define debug this way, vs posix that
just includes it in common.c. Could I just do that instead, assuming
there's no historical reason.

Finally, correct the docs in the posix version of real_dprintf.
2015-02-25 13:03:18 -06:00
Brent Cook
38c9460ba4 enumerate all processes even if we cannot read the executable type 2015-02-12 10:54:44 -06:00
William Vu
eb3b163951 Add arch to Linux ps
Uses /proc/<PID>/exe and e_ident[EI_CLASS].
2015-02-12 08:15:58 -06:00
OJ
5e0fbedd30 Make state destruction set pointers to NULL 2015-01-31 08:23:54 +10:00
OJ
c9d9e5978c Fix issue with double-start of clipboard
If a user attempts to start the clipboard monitor when it is already started then the code path that is taken results in the current clipboard monitor state pointers being lost. The net effect of this is that the existing monitor thread will never be shut down. Not a good thing!

This code fixes that case so that the monitor doesn't create a new monitor thread and doesn't reset important pointers to NULL.

This change also results in a "success" status being returned to the caller. This means it looks like the clipboard monitor has been started even if it was already running. I think this is acceptable and is better than an obscure error.
2015-01-31 07:00:06 +10:00
Brent Cook
6299e2de5b handle zero-byte reads and writes gracefully
Otherwise, doing an empty file open, like:

  ::File.open(local_file_name, "")

or write_file("meterpreter-test", "") in test/modules/post/test/file.rb
fails

Before:
```
$ touch hello
$ ./msfconsole -q
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.56.1
lhost => 192.168.56.1
msf exploit(handler) > run

[*] Started reverse handler on 192.168.56.1:4444
[*] Starting the payload handler...
[*] Sending stage (787456 bytes) to 192.168.56.1
[*] Meterpreter session 1 opened (192.168.56.1:4444 ->
192.168.56.1:55621) at 2015-01-27 11:23:09 -0600

meterpreter > upload hello
[-] Error running command upload: Errno::ENOENT No such file or
directory @ rb_file_s_stat - hello
meterpreter > upload hello
[*] uploading  : hello -> hello
[-] core_channel_write: Operation failed: The parameter is incorrect.
```

After:
```
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.56.1
lhost => 192.168.56.1
msf exploit(handler) > run

[*] Started reverse handler on 192.168.56.1:4444
[*] Starting the payload handler...
[*] Sending stage (770048 bytes) to 192.168.56.10
[*] Meterpreter session 1 opened (192.168.56.1:4444 ->
192.168.56.10:49833) at 2015-01-27 11:26:03 -0600

meterpreter > upload hello
[*] uploading  : hello -> hello
[*] uploaded   : hello -> hello
```
2015-01-27 11:24:21 -06:00
Brent Cook
0d59fc7447 support building on newer Linux systems and Makefile cleanups
- try to share some bits between different makefiles, make modifying
   global compiler flags not such a huge pain.
 - directly specify we should be using the gold rather than bpf linker
 - make compiler output largely quiet except where we care - allow
   warnings to actually be visible
 - don't delete downloaded tarballs with --really-clean
 - add missing dependencies between libraries
   (--no-add-needed/--no-copy-dt-needed-entries causes lots of trouble)
 - update readme to show what to install to build

I made minimal changes to the loader makefile - it breaks easily.
 -Os prevents if from being able to load libc, for instance
2015-01-13 16:33:56 -06:00
Tod Beardsley
74cb136099 Land , add direct access reg methods 2015-01-07 14:56:12 -06:00
Tod Beardsley
43ce54e6af Undo the 755 mode change 2015-01-07 14:32:57 -06:00
jvazquez-r7
22975bd716 Require getsid only on windows 2015-01-01 19:04:10 -06:00
Brent Cook
0f2dcf50d0 add direct access registry methods
This adds registry access methods that do an atomic open/<action>/close on
registry keys. They improve efficiency and safety, since we're not passing
HKEY's back and forth to enumerate or read registry keys. This fits the common
use pattern in MSF better anyway.
2014-12-16 15:31:11 -06:00
Brent Cook
405d55f8c9 invert error check for POSIX filesytem functions
Fixes 
2014-12-16 15:11:27 -06:00
OJ
061439edb2 Final tweaks to adsi 2014-12-09 14:27:50 -06:00
OJ
76a492ab56 Fix silly typo 2014-12-09 14:27:50 -06:00
OJ
c7a8645709 Update adsi to use group functionality
Now includes group nesting which will require work on the MSF side to
fully support it. But this option is way better as we don't lose info
thanks to serialising to strings.
2014-12-09 14:27:50 -06:00
OJ
fe70c6a733 Updated service enumeration to use group tlv api 2014-12-09 14:27:50 -06:00
OJ
3aeda7ed2a Refactor group Tlv usage in window enumeration 2014-12-09 14:27:50 -06:00
OJ
4a88e93496 Add the getsid command
Added support for a the getsid command so that it's easy to
determine the SID of the current user. This will be useful for
a number of different use cases.
2014-11-07 10:36:36 +10:00
OJ
867df868c4 Merge branch 'upstream/master' into update-kiwi 2014-07-12 08:29:38 +10:00
OJ
15d11f0e9f Update to Mimikatz commit 8d83d5ab93396263b8c8be8401381b02868fdad6
This fixes the breakages on patched systems (I think). There's also a fix
here for an infinite loop in the MSV Code.
2014-07-10 15:07:51 +10:00
OJ
4e1201d73c Update to Mimikatz commit ba14c8b425d6650276e2357f370dcb700c72ea81
Commit 3b0b875fe80ceec098e147d9adad54a0fcbda092 was not included because it only
contained changes to mimilib.
2014-07-10 14:14:26 +10:00
OJ
2fcebdefc2 Update to mimikatz commit c509bbfbf75883a84d56475cac4bc92b9a8350fa 2014-07-10 13:49:08 +10:00
OJ
420ca2861a Remove lots of stuff that Kiwi doesn't need
mimilib and mimidrv aren't required in MSF.
2014-07-10 13:26:33 +10:00
OJ
6c23fc5764 Updated to Mimikatz commit fd667773cbc004dafd857fd77dc6a06fc8c6d33c
Without the powershell stuff. Commit f861bb41aa608363b008233dee4234b7392fb502 will
not be included as it's not relevant.
2014-07-10 13:10:31 +10:00
jvazquez-r7
5a58d88e3a Return errno when fopen fails 2014-07-08 12:12:45 -05:00
OJ
fed3ebd43f Update to Mimikatz commit 2cb6326ba2658e0d226d7a341fd6bf3bba2dbceb 2014-07-08 20:02:44 +10:00
OJ
e7974b4707 Update to Mimikatz commit 5571133a4bc4a9a690cbdcab5f7db6f8ff8bc7e3 2014-07-08 19:49:34 +10:00
OJ
940c94e946 Update to Mimikatz commit 4e6f3e17587c849517e32cfc7f87fb01ee5b0ff3 2014-07-08 18:35:16 +10:00
OJ
bfba1ed97c Updated to Mimikatz commit 568b71c590ae60582195c34a71ec8c37a3a809da 2014-07-08 17:45:22 +10:00
OJ
5b387c5bee Update to Mimikatz commit 9347714eb1683b74e2537a100b5014268d27f5f0 2014-07-08 17:36:13 +10:00
OJ
05c968a877 Updated to Mimikatz commit 853ee232f061cef4c75cdbfcf7390fb16e53811d 2014-07-08 17:06:36 +10:00
OJ
5b721a8fe9 Updated to Mimikatz commit e85d87f6bb2e0afa5c57f22c73d12b8e25e84c9f
This comes with some other changes as well which include code changes that
were probably made to the kerberos code prior to moving to github. As a result,
the actual changset was lots because the history of mimikatz wasn't imported
into github, and the change history is no longer available on google code.
2014-07-08 16:48:11 +10:00
William Vu
c4e8e007a1 Land , IMAGE_BASE TLV truncated pointer fix 2014-07-07 18:11:55 -05:00
jvazquez-r7
32564013bc Fix strncpy usage on linux fs_expand_path 2014-07-07 16:04:59 -05:00
OJ
f6dcee657f Change IMAGE_BASE tlv to QWORD value 2014-07-07 17:16:40 +10:00
Meatballs
a19ce5e6dc Land , x86 -> x64 thread creation
Also fixes a number of PTR truncation issues...
2014-06-06 20:44:12 +01:00
OJ
6b0637e45c Updated various types from UINT to QWORD
The goal is to avoid pointer truncation where possible so this commit
changes parameter types to qword where it makes the most sense. This
includes all handles (event, process, thread, registry), addresses
and generic parameters.
2014-06-04 20:53:44 +10:00
OJ
4043a6ff2b Update memory alloc to use QWORD types
DWORD was being used, resulting in x64 being unhappy thanks to
pointer truncation. This fixes the problem.
2014-06-01 21:26:09 +10:00
OJ
cabf3af8df Merge branch 'upstream/master' into fix_thread_create 2014-06-01 21:04:01 +10:00
Meatballs
0bc00a4b72 Land , Fix WMI Queries for x64 2014-06-01 11:04:14 +01:00