1
mirror of https://github.com/rapid7/metasploit-payloads synced 2024-12-08 23:33:07 +01:00
Commit Graph

2293 Commits

Author SHA1 Message Date
OJ
6d2582102d
Slow progress on pipe packet pivots 2017-07-10 20:00:37 +10:00
William Webb
d25ff91ca2
axe errant DebugBreak() 2017-07-06 20:21:22 -05:00
William Webb
c144bac8d9
gracefully handle threading and correctly destroy msg only window 2017-07-06 19:57:07 -05:00
OJ
f96fe3542f
Next phase of packet pivot work 2017-07-06 15:40:32 +10:00
William Webb
519194dc6c
log pid on new active window 2017-07-05 20:34:37 -05:00
OJ
fc6c593eb7
Add the first pass of named pipe pivot code 2017-07-05 16:15:06 +10:00
OJ
9bb22ad251
Add 32 bit encrypt flag support to Java meterp 2017-07-03 17:58:07 +10:00
OJ
afdd75a25c
Update python meterpreter to support 32 bit enc flags
Both python3 and python2 tested.
2017-07-03 17:33:08 +10:00
OJ
73985d150c
Update PHP meterpreter to support 32 bit encryption flags 2017-07-03 17:15:10 +10:00
OJ
c74376fb69
Make enc flags 32 bit, fix extension bindings
This updates the packet header so that the encryption byte flag is now
32 bits. This also updates the powershell and python extensions so that
both of the bindings work correctly as a result of the TLV packet header
changes.
2017-07-03 16:51:57 +10:00
Metasploit
8631283791 Bump to 1.2.39 2017-06-29 00:46:04 -07:00
OJ
f5b29bd7c6
Land #210 : set thread error mode 2017-06-29 17:33:46 +10:00
Brent Cook
1a9bfc8c68 disable thread error reporting globally 2017-06-29 01:07:22 -04:00
Spencer McIntyre
8c9c38ba4b Add export and use a debug_traceback function 2017-06-28 19:44:49 -04:00
OJ
4204e798de
Add encryption of AES key to php meterp 2017-06-28 20:17:14 +10:00
OJ
d75ddcdb2c
Add AES support to PHP
Still doesn't take into account the given public key, but we're getting
there.
2017-06-28 20:07:42 +10:00
OJ
eeeecd7234
Fix python3 support for the session GUID header
Updates the code so that the GUID is handled as a hex-encoded value,
just like the payload UUID. This avoids what appeared to be encoding
issues when the value was packed into the header, resulting in more than
16 bytes appearing and hence screwing it all up!
2017-06-28 17:57:07 +10:00
OJ
60c751c27d
Fix py meterp to support python3 when generating raw headers
Thanks to @zeroSteiner for this.
2017-06-28 12:54:41 +10:00
OJ
9fd56beba0
Refactor pub key encryption code
Extract the publicy key encryption code out into another method and
cater for more error conditions.
2017-06-28 12:50:53 +10:00
Spencer McIntyre
1a0f47603b Add debgging around get and send packet for pymet 2017-06-27 20:15:04 -04:00
OJ
2c2583b975
Add support to java for new packet header 2017-06-26 19:28:09 +10:00
OJ
df6748130d
Update php meterpreter to support new packet header
This doesn't enable support for AES encryption PHP meterp yet, that's
coming later.
2017-06-26 16:48:01 +10:00
OJ
445db818be
Update Python meterpreter's packet header handling
This doesn't add AES encryption, just adds support for the new packet
header. AES encryption will come later.
2017-06-26 15:26:27 +10:00
Metasploit
8bf7d426b6 Bump to 1.2.38 2017-06-25 15:47:25 -07:00
Brent Cook
f95710249b
Land #209, Make keyscan active window tracking discretionary 2017-06-25 17:39:41 -05:00
OJ
a911045d5e
Merge upstrea/master + fix issues 2017-06-25 19:52:11 +10:00
OJ
12055fca25
Finalised support for RSA-encrypted AES key negotiation
Still needs to be wired into HTTP/S.
2017-06-25 10:24:40 +10:00
Brent Cook
0356a5068d add thread preamble that sets the per-thread error mode 2017-06-23 20:37:56 -05:00
Artem
fe8920640d Add Disable Windows Error Messages 2017-06-23 20:37:56 -05:00
Metasploit
af76e64a2e Bump to 1.2.37 2017-06-23 16:08:14 -07:00
Brent Cook
c7f614a799
Land #200, Fix winpmem builds, warnings, cleanup logging 2017-06-23 18:00:22 -05:00
William Webb
cad32aaa33
kill whitespace 2017-06-23 14:08:08 -05:00
William Webb
419533ce48
kill whitespace 2017-06-23 13:56:07 -05:00
William Webb
f437e6aef7
use conventional option/TLV scheme instead of dumb stuff 2017-06-23 13:51:08 -05:00
Spencer McIntyre
9538e2d03f Add an option to disable forking in pymet 2017-06-22 10:55:59 -05:00
Metasploit
df2b0d7e94 Bump to 1.2.36 2017-06-22 08:55:18 -07:00
Brent Cook
fb80f87ee3
Land #204, Update to Mimikatz 2.1.1 20170608 for changentlm function 2017-06-22 10:45:34 -05:00
Spencer McIntyre
c320233e86 Try to use find_library for OSX railgun_api 2017-06-21 08:50:57 -04:00
OJ
8ffb877610
Initial version of working AES encrypted TLV packets 2017-06-21 21:02:33 +10:00
Brent Cook
efe6f32197 fix 64-bit r7 target build 2017-06-21 03:01:56 -05:00
OJ
cb9ae6acd4
Rework the packet XOR code
Make the XOR key an array of bytes as a start to normalise the way the
XOR happens across the board. Given that we're going to be adding
encryption to the packet level and adding more stuff to the packet
header, now is the time to fix this up once and for all.
2017-06-20 19:20:41 +10:00
OJ
8858acb618
Initial attempt to AES encryption at the packet level 2017-06-20 17:50:58 +10:00
Metasploit
2d1f6dcfd3 Bump to 1.2.35 2017-06-19 13:55:39 -07:00
James Lee
6d774f59c8
Land #207, remove dead code of crypto context 2017-06-19 15:43:27 -05:00
Spencer McIntyre
d48b48df94 Implement pymet osx rg api and api_multi 2017-06-19 11:13:42 -04:00
OJ
813760a9e2
Remove support for the crypto context
Crypto context stuff appears to have only ever been supported in
Meterpreter on Windows. The only thing it allowed for is XOR, which is
redundant given that we have packet level XOR in place. Also, it would
appear that MSF didn't have support for it anyway!

With the move torwards packet-level encryption, this is unnecessary so
it needs to go bye bye.
2017-06-19 16:51:54 +10:00
OJ
9e3aef62bc
Hack to ignore metsrv.dll stage when connecting to staged listener
The last issue we had in removing the OpenSSL library from Windows
meterp is making it so that reconnects would behave. With a staged
listener, the first thing that gets sent down the wire is metsrv.dll. As
a result, when a fully staged connect comes in (whether it be from
a stageless payload, from a transport switch or from a sleeping session
waking up), Meterpreter needs to handle the case that the data coming
down the wire is no actually a TLV packet, and hence ignore it.

This "hack" abuses the properties of the XOR key for the packet,
relying on the fact that the XOR key will never contain NULl bytes and
that the first 4 bytes from a staged listener starts with the length of
the metsrv DLL, which is small enough to result in a NULL byte in the
MSB position.

If we see a NULL byte in that position, we assume it's the metsrv header
coming in, and we just ignore it and move on. If the XOR key looks
legit, we assume it's a valid TLV packet.

Dirty, but it's quick and it works!
2017-06-16 13:34:46 +10:00
Spencer McIntyre
e0c26186c1 Implement pymet osx rg memread and memwrite 2017-06-15 10:56:47 -04:00
OJ
3554aff9de
Remove SSL from all but the python extension
Re-implement MD5 and SHA1 file hashing using CSP.
2017-06-14 21:40:20 +10:00
Brent Cook
28a9f42e14 more ssl flensing 2017-06-14 04:56:47 -05:00