1
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-04-24 10:09:49 +02:00

18 Commits

Author SHA1 Message Date
OJ
e9e5894eca
Updated powershell extension binding IDs 2020-05-08 17:17:25 +10:00
OJ
6163be1142
Updated powershell extension with appropriate command map 2020-05-01 15:41:31 +10:00
OJ
c7f7bc2fc0
Remove method strings from TLV packets
We now use ints, and hopefully this means we don't have as much obvious
stuff in the binaries!

```
$ # Before:
$ strings metsrv.x86.dll | grep core_ | wc -l
46
$ # After:
$ strings metsrv.x86.dll | grep core_ | wc -l
0
```
Big win, and it's even bigger for the likes of stdapi.

Had to fix a bunch of other stuff along the way, including a subtle
issue with the Powershell Meterp bindings.
2020-04-28 23:41:06 +10:00
OJ
3dc014e8ad
Add powershell transport scripts
This commit adds two new scripts and modifies some of the powershell transport binding functionality.

Code has been added that generates valid Metasploit URIs for use with stageless listeners. This means that it's possible to add HTTP/S transports on the fly and have a URL generated that will work with the current architecture of the process.

Two new scripts will appear in each of the powershell sessions:

* Add-WebTransport - adds http/s transports to the session.
* Add-TcpTransport - adds TCP transports to the session.

These two scripts are just abstractions on top of the built-in Meterpreter transport binding functionality, but it makes it a lot easier to interact with the feature and makes it more.. er.. Powershelly.

The functions come with documnetation, so `Get-Help Add-WebTransport -Full` will show how it's used.

From here, people can do some more fun stuff, such as adding init scripts to their stageless payloads that add support for more transports.
2018-05-28 12:45:29 +10:00
OJ
1e175da8b1
Change hash output to use LM hash if present
The previous commit hard coded the LM hash to the empty value. This commit changes this so that if the LM hash isn't present it'll manually specify the empty one, but use the existing one if it is present.
2018-05-17 09:06:35 +10:00
OJ
f44877ae29
Add ability to dcsync & hashdump via Powershell
DCSync functionality is exposed, and from this it is possible to enumerate all users in the domain and dump each user's hash one by one. This code has a few extension functions built into the runner, and also has some baked-in powershell functions that are available in every powershell runner session in the host.

I've also added a powershell version of the build command that lets us generate the source to the powershell assembly wiring from PSH as well as Python.
2018-05-07 16:36:21 +10:00
OJ
db20322182
Fix TLV type defs and config size for HTTP migrate 2017-10-04 10:42:40 +10:00
OJ
c74376fb69
Make enc flags 32 bit, fix extension bindings
This updates the packet header so that the encryption byte flag is now
32 bits. This also updates the powershell and python extensions so that
both of the bindings work correctly as a result of the TLV packet header
changes.
2017-07-03 16:51:57 +10:00
OJ
1a75953b7c Add transport support, tidy up some code 2016-03-25 09:12:53 +10:00
OJ
d286618b13 Add support for incognito 2016-03-24 15:01:50 +10:00
OJ
ecf10f7e43 Added ProcessList to Sys 2016-03-24 10:42:56 +10:00
OJ
1d85ea8513 Add sysinfo, code tidy 2016-03-24 10:13:56 +10:00
OJ
3f9681c34e Add show mount binding, tweak output to be tidier 2016-03-23 22:54:02 +10:00
OJ
4b142d35a0 Add Kiwi bindings, add debug, fix issue with missing commands in local
packets
2016-03-23 22:21:54 +10:00
OJ
64c57f203b Add the last few features to the User binding 2016-03-23 15:25:17 +10:00
OJ
b32fd52bfd Fix LocalAlloc call, start on the handling of other bindings (user) 2016-03-23 15:13:09 +10:00
OJ
41ac07dbe0 Finish the elevate bindings for powershell 2016-03-23 14:40:41 +10:00
OJ
7ba39c982a First version of "working" bindings (getsystem works)
More to do, including reading of TLV packets.
2016-03-23 13:39:25 +10:00