1
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-04-06 01:16:37 +02:00

61 Commits

Author SHA1 Message Date
OJ
c30d7ee349
Fix session GUID creation/management for pivots 2017-07-25 17:40:54 +10:00
OJ
2ede006025
First working packet pivot session! 2017-07-16 19:33:24 +10:00
OJ
f96fe3542f
Next phase of packet pivot work 2017-07-06 15:40:32 +10:00
OJ
8ffb877610
Initial version of working AES encrypted TLV packets 2017-06-21 21:02:33 +10:00
Brent Cook
0a2d768e77 delete Linux meterpreter support 2017-05-14 02:11:57 -05:00
Brent Cook
b50955a924 Revert "Refactor XOR code, dedup packet writing code"
This reverts commit 7e8b4c3c5206891de38312c15518e5139fc56d6e.
2016-11-17 06:22:53 -06:00
OJ
b96eaff14f
Remove check for UUID, force add without check 2016-10-14 13:27:45 +10:00
OJ
d06d7e1807
Include UUID in each request, update UUID on migrate 2016-10-14 10:53:21 +10:00
OJ
7e8b4c3c52
Refactor XOR code, dedup packet writing code 2016-10-10 14:40:05 +10:00
OJ
04cb09737e More work on the meterpreter bindings for python 2015-10-30 15:23:00 -05:00
OJ
fe566d5f07 Moved transport stuff from core to metsrv
Lots of transported related things were in the core library which didn't make any sense given that the only thing that needed it was metsrv. This moves the functionality out into metsrv, reformats stuff and gets rid of some dead code.

TODO: Make this work with POSIX.
2015-04-23 19:41:25 +10:00
Brent Cook
9269a14e6a Merge common WinHttp init code between send and receive functions.
So we don't have any missing initialization between send and receive, this
factors out the common bits.
2015-04-20 16:30:26 -05:00
OJ
e9b7ec97c0 Implement support for ssl cert verify toggling
Querying of the status of SSL cert verification is now possible. This commit allows for this to be enabled and disabled on the fly.
2015-04-06 14:42:38 +10:00
OJ
8b637d7248 Refactored windows transport hopping
Instead of basing everything on URLs, the transport hopping now actually supports the creation of a whole new transport on the fly. The transport instance is stored in the remote as a "next transport" pointer.

This better facilitates the notion of being able to set all of the parameters on the transport when doing the switch, and is a step closer to being able to support chains of transports.
2015-04-02 22:51:12 +10:00
OJ
23117bb73c Merge branch 'upstream/master' into transport-refactor 2015-04-02 15:24:57 +10:00
OJ
934525d2e7 Remove traces of wininet from the source
WinInet won't work any more thanks to use making modifications on the MSF that will cause it to break. We're basically all-in for WinHTTP now.
2015-04-02 12:36:17 +10:00
OJ
cfa12053bd Fix up WinHTTP proxy implementation 2015-04-01 11:43:53 +10:00
OJ
a2f74d99d6 Transport switch v0.0.1-preAlpha
Switching works, but doesn't do anything nice with session management. Still need to get things wired into posix, and probably rip out the wininet stuff as well given that I probably won't refactor it to support this.
2015-03-25 12:59:50 +10:00
OJ
91a8bce4b6 Implement first pass of transport refactoring
* Transports are now defined by a set of callbacks that are bound to the Remote.
* Transport initialisation and dispatching is seprated.
* The context of the transport should be switchable depending on new transport requirements.

More to do, but it has begun.
2015-03-23 12:35:45 +10:00
OJ
46ab7a02e8 Fix typo, bomb out on invalid cert
When the server cert checking fails, meterpreter now exits.
2015-03-17 14:39:41 +10:00
OJ
0739cbc0f3 Add support for SSL cert validation
Tweak the SSL implemention so that for https meterpreters the SSL certificate is validated against a hash that is specified in the payload. If the hash isn't specified, then certificate validation isn't attempted.
2015-03-17 13:27:33 +10:00
OJ
f44b44f2ce Implement https communications via winhttp
First pass, some instability still. Migration doesn't play nice.
2015-03-16 21:51:44 +10:00
Brent Cook
0d59fc7447 support building on newer Linux systems and Makefile cleanups
- try to share some bits between different makefiles, make modifying
   global compiler flags not such a huge pain.
 - directly specify we should be using the gold rather than bpf linker
 - make compiler output largely quiet except where we care - allow
   warnings to actually be visible
 - don't delete downloaded tarballs with --really-clean
 - add missing dependencies between libraries
   (--no-add-needed/--no-copy-dt-needed-entries causes lots of trouble)
 - update readme to show what to install to build

I made minimal changes to the loader makefile - it breaks easily.
 -Os prevents if from being able to load libc, for instance
2015-01-13 16:33:56 -06:00
OJ
d7c455edee Remove a function that is no longer used 2014-04-21 19:25:17 +10:00
OJ
02312e1972 Debugging output, crash fix
In some cases this extension would crash. This was due to the code using the
incorrect "length" variable when dumping LSA data. This commit includes addition
of some debug output, removal of other debug output, and changing of the
kiwi-specific debug definition.

Another packet function was added to aid in construction of this fix, and the
group packet function was added to one of the calls.
2014-03-28 13:40:02 +10:00
OJ
637e839de2 Merge branch 'upstream/master' into ext_server_kiwi 2014-03-20 09:17:18 +10:00
OJ
32c7126793 Fixes, documentation and tidying of kiwi code 2014-03-19 17:48:44 +10:00
OJ
83d4d2b0b7 Fix leaking memory 2014-03-19 15:01:02 +10:00
OJ
a7927a4105 Added the notion of "group packets"
A group packet is a special packet that is to be used as a group of TLVs that
will live under another packet. Using this functionality means that we can
easily nest groupings of data to arbitrary depths, which wasn't something we
were able to do before easily.

The MSF side is easily capable of handling this scenario, but this side had
always been lacking.

The clipboard dump code has been updated to show how this can be used.
2014-03-04 19:38:15 +10:00
OJ
eca73429f3 Initial integration of Mimikatz 2.0
This is a seprate extension because the old Mimikatz supports more
operating systems, while the new Mimikatz has more features for
less operating systems.
2014-01-10 16:51:51 +10:00
OJ
7702724fd2 Remove all warnings resulting in totally clean builds
Does as it says on the tin. Various tweaks made to source and to project
files to make the builds come out with ZERO warnings.

Let's keep it clean from here!
2013-11-06 19:02:50 +10:00
OJ
5986ccf235 Add the getproxy command
This allows for system proxy setting to be pulled out. Windows-only at
this point.
2013-10-30 17:25:51 +10:00
OJ
2c865a4a37 Documented base.* and core.*
Big job, this documentation lark. Also modified the prototype the
packet_is_tlv_null_terminated function, which used to take a Packet
instance as well as the TLV, but never used the packet in its
implementation.
2013-10-15 16:14:39 +10:00
OJ
87031e0d00 Work towards a clean build
* Various code fixes to keep the compiler warnings down.
* Adjustments to project files.
2013-09-03 16:49:09 +10:00
James Lee
7283131279 Initial source import from metasploit-framework 2012-11-19 16:46:07 -06:00
jlee-r7
964bae0c49 Initial commit 2012-11-19 14:40:03 -08:00
James Lee
54bfa41f1b Lay the groundwork for returning all addresses
This commit only sends the last interface in the list, but it is looping
through all of them as evidenced by the log, just need to make sure
we're not overwriting as we go.

[See ]
2012-03-05 09:10:46 -07:00
HD Moore
a9893a8118 Make sure empty replies are take into account for the session keep alive
git-svn-id: file:///home/svn/framework3/trunk@13052 4d416f70-5f16-0410-b530-b9f4589650da
2011-06-28 21:22:48 +00:00
HD Moore
8874823a91 Re-add the missing SendRequest, make migrate work
git-svn-id: file:///home/svn/framework3/trunk@13048 4d416f70-5f16-0410-b530-b9f4589650da
2011-06-28 17:25:37 +00:00
HD Moore
17de35d7fb Clean a few things up
git-svn-id: file:///home/svn/framework3/trunk@13046 4d416f70-5f16-0410-b530-b9f4589650da
2011-06-28 07:40:32 +00:00
HD Moore
0050ed8f3a Rework this for compatibility with older OSs
git-svn-id: file:///home/svn/framework3/trunk@13045 4d416f70-5f16-0410-b530-b9f4589650da
2011-06-28 07:30:48 +00:00
HD Moore
118d6b2bfb Merge in some recent meterpreter work, still a ways off before this is ready to use.
git-svn-id: file:///home/svn/framework3/trunk@13044 4d416f70-5f16-0410-b530-b9f4589650da
2011-06-28 05:57:36 +00:00
HD Moore
42aef8dd93 Check the correct counter before bailing, this would cause a segmented header to kill the session. Pointed out by an anonymous contributor (new bins once the rest of the pending merge work is finished).
git-svn-id: file:///home/svn/framework3/trunk@12918 4d416f70-5f16-0410-b530-b9f4589650da
2011-06-11 22:53:04 +00:00
Stephen Fewer
95f43bf9c2 Delete the railgun meterpreter extension and add railgun support directly into stdapi. Support now includes Windows x64. Update meterpreter packet core to handle QWORD TLV's.
git-svn-id: file:///home/svn/framework3/trunk@10317 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-14 23:21:36 +00:00
James Lee
a664572f5b meterpreter now compiles on 64-bit linux in a 32-bit chroot. still need payload handlers and some stdapi love to make it useable
git-svn-id: file:///home/svn/framework3/trunk@9468 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-10 06:10:15 +00:00
Stephen Fewer
6f25e39b27 Commit all the code for the new 'screenshot' command in the stdapi extension. Screenshot will now work on NT4 - 7 on both x86 and x64 and on newer versions of Windows we can break out of session isolation (e.g. session 0 isolation for services) to screenshot the active desktop (or logon screen) without the need to migrate meterpreter. The majority of the migration code-injection stuff has been refactored out into base_inject.c so it can be shared with the new ps_inject() functionality to inject dlls. The 'ps' command now reports what session each process belongs to (if this is too verbose we can remove it or add a -v verbose switch to the ps command). The 'execute' command can now take a -s switch in order to create a process in a users session under the users privs (assuming you have the privs to do this).
git-svn-id: file:///home/svn/framework3/trunk@8787 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-11 17:09:55 +00:00
Stephen Fewer
2bcfe8f18c Commit the meterpreter C side (and bins) for transparent zlib (zlib.c copied from the posix meterpreter source) compression of TLV's and channels. To use transparent compression with channels, create them with CHANNEL_FLAG_COMPRESS. To use transparent compression with any TLV value, bitwise or the TLV type with TLV_META_TYPE_COMPRESSED (Don't create the TLV type with TLV_META_TYPE_COMPRESSED as the compressed flag is removed on the remote end after compression). For consistency with the ruby side we could at a later stage add a boolean compress parameter to all the packet_add_tlv_* functions so you don't have to manually specify TLV_META_TYPE_COMPRESSED flag.
git-svn-id: file:///home/svn/framework3/trunk@8515 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 14:56:24 +00:00
HD Moore
3abb8ddb16 Fixes . This commit changes how token manipulation works, adds the steal_token, drop_token, and getprivs commands. Tested on NT 4.0, 2000 SP4, XP SP3, 2003 SP2, Vista, and Windows 7
git-svn-id: file:///home/svn/framework3/trunk@8055 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-02 00:35:10 +00:00
Stephen Fewer
0a5c87b678 Initial commit of the multi-threaded meterpreter.
git-svn-id: file:///home/svn/framework3/trunk@7698 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-04 17:37:21 +00:00
HD Moore
071f888b16 Major merge of Meterpreter POSIX codebase from JR, Win32 projects may need a few more fixes to work properly
git-svn-id: file:///home/svn/framework3/trunk@6949 4d416f70-5f16-0410-b530-b9f4589650da
2009-08-10 02:02:16 +00:00