Spencer McIntyre
8e79f5435a
Merge pull request #2 from Invoke-Mimikatz/pedantics
...
secure memzero
2022-09-13 09:09:38 -04:00
joe
73e8f4f78e
secure memzero
2022-09-12 20:18:52 -04:00
Spencer McIntyre
a39d50e2fc
Merge pull request #1 from smcintyre-r7/pr/collab/588
...
Switch to COFFLoader to a submodule
2022-09-12 08:48:11 -04:00
Spencer McIntyre
4582587df4
Pull upstream changes, stop disabing warnings
2022-09-09 13:54:07 -04:00
Spencer McIntyre
09001bd539
Get MinGW bofloader builds working
2022-09-09 13:54:07 -04:00
Spencer McIntyre
a3e6d86026
Revert accidental change
2022-09-09 13:54:07 -04:00
Spencer McIntyre
1f62d226a0
Use multiple TLVs instead of load_and_run
2022-09-09 13:53:55 -04:00
Spencer McIntyre
f2de5624e3
Rename some things that are not commands
2022-09-08 17:48:22 -04:00
Spencer McIntyre
cb230d93e5
Refactor a few things
2022-09-08 16:07:00 -04:00
Spencer McIntyre
d7005e679e
Switch to using a submodule of TrustedSec/COFFLoader
2022-09-08 15:56:56 -04:00
Spencer McIntyre
b680804951
Don't assume the buffer is null terminated
...
Apparently values returned by RegQueryValueExW may not actually be null
terminated.
See: https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryvalueexw#return-value
2022-09-08 12:07:49 -04:00
Spencer McIntyre
d40b95c1c2
Ensure that the parsed buffer is terminated
...
This copies the input buffer to a private copy which is the easiest way
to guarantee that it has two null terminiating characters.
2022-09-07 12:07:42 -04:00
Spencer McIntyre
2e6fb9c2f3
Add docs for the new functions
2022-09-07 12:07:42 -04:00
Spencer McIntyre
18a3d8d85d
Fix REG_MULTI_SZ handling
...
This updates the registry handling for the native Windows Meterpreter to
handle REG_MULTI_SZ values as UTF-8 encoded strings in a buffer with an
additional NULL terminator. This is basically what RegSetValueExW wants
but Meterpreter will encode the UTF-8 strings into UTF-16. They are
however split with a NULL byte and no longer \0.
2022-09-07 12:07:32 -04:00
Spencer McIntyre
89aa11e177
Fix reading REG_MULTI_SZ values for Windows
2022-09-07 09:32:16 -04:00
Spencer McIntyre
d720a549a4
Use RegOpenKeyExW for checking existance
...
This has two benefits:
1. It's the same function as what's used to open keys, ensuring that the
options is consistent.
2. It allows the desired permissions to be explicitly set instead of
being inferred from the "default securitya ccess mask". See:
https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regopenkeya#return-value
2022-09-07 09:32:05 -04:00
skylerknecht
cc6b6a1236
Don't delete responses joe!
2022-09-06 23:59:44 -04:00
joe
00aea8da1a
visualstudio builds
2022-09-06 21:04:39 -04:00
joe
9412beeef4
dprintf
2022-09-05 20:14:11 -04:00
joe
b05945da8a
no need to free mem, meterpreter takes care of it
2022-09-04 20:02:20 -04:00
joe
35d3dc0737
debugtrace
2022-09-04 19:40:53 -04:00
joe
5de520f527
bofloader nocrash
2022-09-04 19:28:41 -04:00
joe
35f950b4d2
wip++ hopefully working c portion
2022-09-03 16:35:44 -04:00
Spencer McIntyre
de242ce067
Log opening keys and fix error propagation
2022-09-02 15:36:25 -04:00
Spencer McIntyre
56ee6899f3
Add registry_check_key_exists for Python
2022-09-02 15:18:27 -04:00
Kevin Clark
327125a3a4
add bofloader folder
2022-08-20 13:56:55 -07:00
Metasploit
9d11bb84b1
Bump metasploit-payloads to 2.0.95
2022-06-23 12:48:18 -05:00
Spencer McIntyre
20980dc9eb
Land #577 , Add 6th getsystem technique EfsPotato
2022-06-23 12:28:45 -04:00
Spencer McIntyre
e4b0ce2aa8
Fix docker builds
2022-06-23 11:31:39 -04:00
Christophe De La Fuente
3d322137f9
Fix from code review
2022-06-22 13:19:35 +02:00
Christophe De La Fuente
6cb3d86ffd
Add EFSRPC Named Pipe Impersonation (EfsPotato) elevation technique
2022-06-14 20:24:19 +02:00
Metasploit
97febce676
Bump metasploit-payloads to 2.0.94
2022-05-17 14:31:51 -05:00
Grant Willcox
5d26021080
Land #571 , Update ReflectiveDLLInjection to include #12 and remove a few RWX memory sections.
2022-05-17 14:18:28 -05:00
Metasploit
0f42e2eb5e
Bump metasploit-payloads to 2.0.93
2022-05-16 13:46:03 -05:00
Grant Willcox
20b240e1f5
Land #575 , fix android meterpreter > play audio command
2022-05-16 13:34:51 -05:00
Tim W
4577bb4666
fix android audio output
2022-05-13 11:23:09 +01:00
Metasploit
85a7563cad
Bump metasploit-payloads to 2.0.92
2022-05-11 10:12:22 -05:00
adfoster-r7
44c5ea4887
Land #574 , Remove logging artifacts that made their way into the release build
2022-05-11 16:02:08 +01:00
dwelch-r7
f84aecff87
Add conditional logic to remove logging artifacts that made their way into the release build
2022-05-11 12:22:10 +01:00
Metasploit
e25dbc0da6
Bump metasploit-payloads to 2.0.91
2022-05-06 11:46:48 -05:00
adfoster-r7
62660817a0
Land #570 , Fix order of closing channels
2022-05-06 17:36:26 +01:00
Metasploit
7a7e7328a2
Bump metasploit-payloads to 2.0.90
2022-05-05 05:17:56 -05:00
adfoster-r7
8672e2212f
Land #572 , Fix argument order for array join
2022-05-05 11:09:02 +01:00
sjanusz
ed25e6fefa
Fix argument order for array join
2022-05-05 10:34:34 +01:00
Metasploit
b245a235c7
Bump metasploit-payloads to 2.0.89
2022-05-04 15:42:57 -05:00
Spencer McIntyre
329f70d7ca
Land #562 , Fix AF_INET constants in PHP Meterpreter
2022-05-04 16:33:36 -04:00
Spencer McIntyre
683a986c7f
Update to include ReflectiveDllInjection#12
2022-05-04 15:01:52 -04:00
sjanusz
d289909fac
Fix order of closing channels
2022-05-04 17:51:10 +01:00
Metasploit
5dca4f5989
Bump metasploit-payloads to 2.0.88
2022-05-03 14:47:11 -05:00
jheysel-r7
bac639d94d
Land #565 , update mimikatz
...
Updates mimikatz (the kiwi extension)
2022-05-03 12:35:29 -07:00
