Spencer McIntyre
80e8b721ef
Close the handle when it wasn't copied
...
Close the hObject handle when it wasn't copied into token_list.
2022-11-10 16:08:16 -05:00
Spencer McIntyre
d0ab25e521
Close memory and handle leaks
2022-11-10 13:31:28 -05:00
bwatters-r7
a5473e71df
land #588 , Add TrustedSec's COFFLoader as Meterpreter Extension
...
Merge branch 'land-588' into upstream-master
2022-09-29 10:16:12 -05:00
Spencer McIntyre
b0ce0fb421
Update the COFFLoader submodule
2022-09-26 08:49:08 -04:00
Spencer McIntyre
36f3783279
Code and docs cleanups
2022-09-21 17:01:37 -04:00
joe
73e8f4f78e
secure memzero
2022-09-12 20:18:52 -04:00
Spencer McIntyre
4582587df4
Pull upstream changes, stop disabing warnings
2022-09-09 13:54:07 -04:00
Spencer McIntyre
09001bd539
Get MinGW bofloader builds working
2022-09-09 13:54:07 -04:00
Spencer McIntyre
a3e6d86026
Revert accidental change
2022-09-09 13:54:07 -04:00
Spencer McIntyre
1f62d226a0
Use multiple TLVs instead of load_and_run
2022-09-09 13:53:55 -04:00
Spencer McIntyre
f2de5624e3
Rename some things that are not commands
2022-09-08 17:48:22 -04:00
Spencer McIntyre
cb230d93e5
Refactor a few things
2022-09-08 16:07:00 -04:00
Spencer McIntyre
d7005e679e
Switch to using a submodule of TrustedSec/COFFLoader
2022-09-08 15:56:56 -04:00
Spencer McIntyre
b680804951
Don't assume the buffer is null terminated
...
Apparently values returned by RegQueryValueExW may not actually be null
terminated.
See: https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryvalueexw#return-value
2022-09-08 12:07:49 -04:00
Spencer McIntyre
d40b95c1c2
Ensure that the parsed buffer is terminated
...
This copies the input buffer to a private copy which is the easiest way
to guarantee that it has two null terminiating characters.
2022-09-07 12:07:42 -04:00
Spencer McIntyre
2e6fb9c2f3
Add docs for the new functions
2022-09-07 12:07:42 -04:00
Spencer McIntyre
18a3d8d85d
Fix REG_MULTI_SZ handling
...
This updates the registry handling for the native Windows Meterpreter to
handle REG_MULTI_SZ values as UTF-8 encoded strings in a buffer with an
additional NULL terminator. This is basically what RegSetValueExW wants
but Meterpreter will encode the UTF-8 strings into UTF-16. They are
however split with a NULL byte and no longer \0.
2022-09-07 12:07:32 -04:00
Spencer McIntyre
89aa11e177
Fix reading REG_MULTI_SZ values for Windows
2022-09-07 09:32:16 -04:00
Spencer McIntyre
d720a549a4
Use RegOpenKeyExW for checking existance
...
This has two benefits:
1. It's the same function as what's used to open keys, ensuring that the
options is consistent.
2. It allows the desired permissions to be explicitly set instead of
being inferred from the "default securitya ccess mask". See:
https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regopenkeya#return-value
2022-09-07 09:32:05 -04:00
skylerknecht
cc6b6a1236
Don't delete responses joe!
2022-09-06 23:59:44 -04:00
joe
00aea8da1a
visualstudio builds
2022-09-06 21:04:39 -04:00
joe
9412beeef4
dprintf
2022-09-05 20:14:11 -04:00
joe
b05945da8a
no need to free mem, meterpreter takes care of it
2022-09-04 20:02:20 -04:00
joe
35d3dc0737
debugtrace
2022-09-04 19:40:53 -04:00
joe
5de520f527
bofloader nocrash
2022-09-04 19:28:41 -04:00
joe
35f950b4d2
wip++ hopefully working c portion
2022-09-03 16:35:44 -04:00
Kevin Clark
327125a3a4
add bofloader folder
2022-08-20 13:56:55 -07:00
Spencer McIntyre
e4b0ce2aa8
Fix docker builds
2022-06-23 11:31:39 -04:00
Christophe De La Fuente
3d322137f9
Fix from code review
2022-06-22 13:19:35 +02:00
Christophe De La Fuente
6cb3d86ffd
Add EFSRPC Named Pipe Impersonation (EfsPotato) elevation technique
2022-06-14 20:24:19 +02:00
Grant Willcox
5d26021080
Land #571 , Update ReflectiveDLLInjection to include #12 and remove a few RWX memory sections.
2022-05-17 14:18:28 -05:00
dwelch-r7
f84aecff87
Add conditional logic to remove logging artifacts that made their way into the release build
2022-05-11 12:22:10 +01:00
Spencer McIntyre
683a986c7f
Update to include ReflectiveDllInjection#12
2022-05-04 15:01:52 -04:00
jheysel-r7
bac639d94d
Land #565 , update mimikatz
...
Updates mimikatz (the kiwi extension)
2022-05-03 12:35:29 -07:00
dwelch-r7
d17e7d3c63
fix line endings
2022-04-27 00:42:06 +01:00
dwelch-r7
181d31878b
Fix common_logging name and location
2022-04-27 00:01:04 +01:00
dwelch-r7
0896fb294a
Move and rename common/common_logging.c to logging/logging.c
2022-04-26 23:56:09 +01:00
dwelch-r7
66bbd5f078
Code review changes and small refactor
2022-04-26 23:49:04 +01:00
dwelch-r7
e29d876b2e
Remove debug artifacts from release build
2022-04-26 15:56:53 +01:00
dwelch-r7
38e6787d84
Configure logging in all extnesions
2022-04-26 15:56:53 +01:00
dwelch-r7
9dfa3ec1fc
winpmem failing to compile
2022-04-26 15:56:53 +01:00
Spencer McIntyre
e576a7c875
Various changes required for cross compilation
2022-04-21 15:52:27 -04:00
Spencer McIntyre
640b753659
Update the kiwi extension
2022-04-21 14:52:20 -04:00
dwelch-r7
c46550a00a
Remove unused extension network pug
2022-04-14 14:11:56 +01:00
dwelch-r7
32890c2f59
Also build debug version for r7_all
2022-04-01 13:30:02 +01:00
adfoster-r7
cf5ab07f22
Land #553 , Build and ship debug builds for windows meterpreter
2022-04-01 01:30:33 +01:00
dwelch-r7
395c31d03e
Build and ship debug builds for windows meterpreter
2022-03-09 13:42:39 +00:00
Spencer McIntyre
0153448ddd
Update mimikatz to 61cd1b9168
2022-03-01 14:22:58 -05:00
Spencer McIntyre
078845440b
Fail on invalid impersonation levels
2022-02-22 10:17:47 -05:00
Spencer McIntyre
86641ef90d
Return an error for invalid getsystem techniques
2022-01-24 15:12:27 -05:00
