1
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-03-30 22:19:17 +02:00

51 Commits

Author SHA1 Message Date
OJ
db20322182
Fix TLV type defs and config size for HTTP migrate 2017-10-04 10:42:40 +10:00
OJ
0792d9dc1b
Add HTTP header support for custom HTTP headers
Fixes config size management issues and gets things working in both
WinHTTP and WinINET
2017-09-11 14:39:10 +10:00
OJ
bc6c2039fb
Add debug statements, and fix one that was causing crashes 2017-08-09 13:03:12 +10:00
OJ
005ba6a8c0
Merge branch upstream into packet-pivot 2017-08-08 17:37:59 +10:00
OJ
b363584648
Merge branch 'upstream/master' into transport-agnostic-packet-encryption 2017-08-08 17:37:25 +10:00
OJ
2ede006025
First working packet pivot session! 2017-07-16 19:33:24 +10:00
OJ
6d2582102d
Slow progress on pipe packet pivots 2017-07-10 20:00:37 +10:00
OJ
f96fe3542f
Next phase of packet pivot work 2017-07-06 15:40:32 +10:00
OJ
fc6c593eb7
Add the first pass of named pipe pivot code 2017-07-05 16:15:06 +10:00
Brent Cook
1a9bfc8c68 disable thread error reporting globally 2017-06-29 01:07:22 -04:00
OJ
8858acb618
Initial attempt to AES encryption at the packet level 2017-06-20 17:50:58 +10:00
OJ
3554aff9de
Remove SSL from all but the python extension
Re-implement MD5 and SHA1 file hashing using CSP.
2017-06-14 21:40:20 +10:00
Brent Cook
28a9f42e14 more ssl flensing 2017-06-14 04:56:47 -05:00
Brent Cook
36771d6309 initial pass at flensing openssl code from reverse_tcp 2017-06-14 04:56:47 -05:00
OJ
cf575a05dd
Add session GUID support to Meterpreter payloads 2017-06-06 17:24:36 +10:00
OJ
d06d7e1807
Include UUID in each request, update UUID on migrate 2016-10-14 10:53:21 +10:00
OJ
c692e76332 Finalise stageless initialisation scripts 2015-11-10 20:00:34 +10:00
OJ
175d6d93f1 First pass of stageless initialisation script 2015-11-10 15:43:59 +10:00
OJ
f572570b7d Initial work to get python talking to metsrv's ssl 2015-10-30 15:23:01 -05:00
OJ
2422f0926b Support transport failover for SSL cert failures
This commit will result in SSL cert failures causing failovers to other
transports, even to itself, instead of shutting the session down. This
will result in repeated calls back to the endpoint, every "retry wait"
seconds, and will continue to do so until the session expires, or the
SSL verification works.

Be warned, this can be noisy in your console if you haven't configured
things properly. The result is a lot of callbacks over the life of the
session.
2015-09-25 12:47:18 +10:00
Brent Cook
eb7c696f00 Land , support deleting transports 2015-06-19 15:46:10 -05:00
OJ
149e4c2a7e Implement transport removal 2015-06-16 11:37:09 +10:00
OJ
d89cd69bc5 Implement a sleep in windows that lasts longer 2015-06-03 14:06:17 +10:00
Brent Cook
bb00b00b2c do not log UUID as a string 2015-05-17 09:25:33 -05:00
OJ
5f7c2e7207 Fix handling of UUIDs in Meterpreter
The original implementation assumed that the UUIDs were coming through a strings, but this was changed at some point to use the 16-byte UUID format straight out of MSF.

This was causing issues when UUIDs had null bytes in them because the UUID was being truncated and the result was that UUIDs that were being parsed in MSF were too small, resulting in exceptions.
2015-05-17 17:43:59 +10:00
OJ
f6c1485ebe Add support for the sleep command 2015-05-15 15:03:47 -05:00
OJ
70397a5c42 Only write socket when SSL comms in place 2015-05-08 14:32:12 +10:00
OJ
76b61f22d6 Update POSIX for configuration support 2015-05-05 08:58:21 +10:00
OJ
1c9c199e74 Fix up issues with transport hopping
Transport hopping checks for prev/next weren't right. Also, moving from TCP comms was resulting failure due to the fact that it's close to impossible to get Windows to flush the buffer to MSF prior to terminating the socket without doing all kinds of horrible stuff to the socket options (which would ultimately bloat the stagers).

Instead we rely on MSf to clean things up.
2015-04-30 22:39:24 +10:00
OJ
b36c6d96b7 Generate config on the fly for the sake of migration
Migration now works again, and supports all the transports while migrating as well. At the moment we don't have the ability to take extensions across as well, though that might come when we have fixed up the issues with stageless meterpreter.
2015-04-28 17:43:22 +10:00
OJ
26b82dfb83 Remove guesswork and SOCKADDR persistence from remote
Instead, we'll rely on the configuration block for the transport.
2015-04-28 13:50:13 +10:00
OJ
c33e486ccc Prevent transport deletion on failure 2015-04-28 12:50:03 +10:00
OJ
b8f3eafb6e Fix transport switching
Creation of transports for switching is done a little differently now. But the transports do cycle correctly now when things fail, each with their respective retry times.
2015-04-28 11:23:37 +10:00
OJ
87a2bf6189 Fix small issues, code tidy 2015-04-25 20:38:17 +10:00
OJ
9d8489a972 First pass of configuration changes for multi transport
This relies on some work done to the RDI repository, need to get
that landed before I can get this going.
2015-04-25 11:11:29 +10:00
OJ
fa0d3fc95c Porting of connection reslience work to POSIX 2015-04-17 18:08:26 +10:00
OJ
4807375480 More work moving towards POSIX 2015-04-17 16:41:47 +10:00
OJ
f83dfb46f4 Merge branch 'upstream/master' into connection-recovery
Conflicts:
	source/common/arch/win/i386/base_dispatch.c
	source/server/server_setup_win.c
2015-04-17 14:41:27 +10:00
OJ
22b207a7a4 More tidying/refactoring, gearing up for POSIX 2015-04-14 13:06:27 +10:00
OJ
dbf33e2fb9 Remove second instance of the SSL check string
The mechanism used for validation of the SSL cert string was the same as for many of the other global replacement options. However, the string value that was used for checking was also the same. The result was that the patch mechanism wasn't patching the right instance of the string.

DERP!

Why this hit stageless only I'm really not sure.
2015-04-14 07:53:31 +10:00
OJ
5c1f39623e Rejigging of timeouts for session resliency 2015-04-09 17:59:06 +10:00
OJ
8a65f4770a Fix small issue with incorrect URL 2015-04-08 15:44:05 +10:00
OJ
e5a3c8748c More refactoring and code tidying 2015-04-08 14:42:26 +10:00
OJ
b3b9726b4b Refactored TCP/HTTP transport functions
Updated the code so that the TCP stuff is moved into its own file and doesn't pollute the main server file with stuff that is specific to TCP transports.

Updated the winhttp functionality in the same way so that functionality is properly segregated.

Modified the global parameters so that they're part of a structure that can be passed around.

Added a stack of documnetation as well.
2015-04-08 12:48:07 +10:00
OJ
6de5738e21 Merge branch 'upstream/master' into cert-hash-switching
Conflicts:
	source/server/server_setup_win.c - line endings
2015-04-08 08:10:10 +10:00
OJ
ba70b2b222 Begin work on connection recovery when things go wrong 2015-04-07 22:14:27 +10:00
OJ
bea5c1a4ff Merge branch 'upstream/master' into bind-ipv6-and-ipv4 2015-04-06 15:18:27 +10:00
OJ
e9b7ec97c0 Implement support for ssl cert verify toggling
Querying of the status of SSL cert verification is now possible. This commit allows for this to be enabled and disabled on the fly.
2015-04-06 14:42:38 +10:00
OJ
8b637d7248 Refactored windows transport hopping
Instead of basing everything on URLs, the transport hopping now actually supports the creation of a whole new transport on the fly. The transport instance is stored in the remote as a "next transport" pointer.

This better facilitates the notion of being able to set all of the parameters on the transport when doing the switch, and is a step closer to being able to support chains of transports.
2015-04-02 22:51:12 +10:00
OJ
934525d2e7 Remove traces of wininet from the source
WinInet won't work any more thanks to use making modifications on the MSF that will cause it to break. We're basically all-in for WinHTTP now.
2015-04-02 12:36:17 +10:00