1
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-05-26 16:53:20 +02:00

456 Commits

Author SHA1 Message Date
Meatballs
fded7311c4 Fixup bare met_svc var name 2015-05-15 20:43:47 +01:00
Brent Cook
d9ce138eed remove hash sizeof workaround 2015-05-14 11:29:44 -05:00
Tim
caf6c0c6c8 add TLV_TYPE_FILE_HASH 2015-05-10 14:57:03 +01:00
Brent Cook
c7617615e4 Land , remove file and console output from kiwi 2015-05-04 15:10:16 -05:00
OJ
b5f5d0ae17 Remove console and file output from kiwi
This PR removes both log file and console output from kiwi. This is done so that those people who are unfortunate enough to migrate to a console app before running kiwi don't end up rendering all of the console output to a window that the user can see.
2015-05-04 09:14:37 +10:00
OJ
fe566d5f07 Moved transport stuff from core to metsrv
Lots of transported related things were in the core library which didn't make any sense given that the only thing that needed it was metsrv. This moves the functionality out into metsrv, reformats stuff and gets rid of some dead code.

TODO: Make this work with POSIX.
2015-04-23 19:41:25 +10:00
OJ
6de5738e21 Merge branch 'upstream/master' into cert-hash-switching
Conflicts:
	source/server/server_setup_win.c - line endings
2015-04-08 08:10:10 +10:00
OJ
602715aaf8 Use group packets and add curlieeees
This commit just adds the braces around single-line blocks as per our "standard". This is important, especially in the case where those single lines contain macros which could expand to multiple lines.

Also added the use of the group packet functionality to make the search result code a little easier on the eye.
2015-04-07 10:02:41 +10:00
Brent Cook
21b4064a3d normalize slashes, remove debug output 2015-04-06 07:47:27 -05:00
OJ
e9b7ec97c0 Implement support for ssl cert verify toggling
Querying of the status of SSL cert verification is now possible. This commit allows for this to be enabled and disabled on the fly.
2015-04-06 14:42:38 +10:00
Brent Cook
cc2dbb2045 use size_t for wcslen results 2015-04-05 20:45:52 -05:00
Brent Cook
b1dadbb98e make search_all_drives a separate function 2015-04-05 18:41:02 -05:00
Brent Cook
5c16ddf270 avoid infinite recursion when encountering a bad symlink
reduce stack usage per level
2015-04-05 18:41:01 -05:00
Brent Cook
e1148a0bca first working unicode search
refactor a few giant functions into smaller ones
2015-04-05 18:41:01 -05:00
Brent Cook
61b19560d7 cleanups, use utf8_to_wchar 2015-04-05 18:41:01 -05:00
Brent Cook
517dcfea05 convert wds queries to use unicode 2015-04-05 18:41:01 -05:00
Brent Cook
7e017d4771 move unicode helper functions to a common place 2015-04-05 18:36:36 -05:00
Brent Cook
69d6b48e67 normalize and tidy the code a bit 2015-04-05 18:36:36 -05:00
OJ
e2338709aa POSIX transport refactoring
Still more to do here to support transport switching, but progress being
made.
2015-03-30 22:54:52 +10:00
OJ
33d7c55429 Land : short file names, file list fixes 2015-03-19 13:03:27 +10:00
OJ
c93ba9608c Fix bad POSIX support for stageless meterpreter
* Make sure POSIX has the new extension command enumeration function.
* Add support for deinit of extensions.
* Make sure extensions are tracked like they in Windows.
* Fix up a few export definitions.
* Stop using strncpy_s in POSIX code.
2015-03-19 11:07:22 +10:00
Brent Cook
eba69cf20e add short name support to filesystem listing.
Also, fix path builder order for stat.
2015-03-18 16:05:30 -05:00
OJ
85783773d5 Land : filesystem refactor and initial unicode support 2015-03-18 18:01:05 +10:00
Brent Cook
e8318f8c5b correct various issues listing files
* bury common _snprintf that snuck in while testing the Windows version back
   into the platform-specific code.
 * remove now-unneeded separator defines
 * don't free a stack variable on windows
2015-03-18 02:11:13 -05:00
Brent Cook
8944ca5156 modify fs_getwd so it allocates the path 2015-03-17 15:28:27 -05:00
Brent Cook
95e102a90c cast size_t on read/write to proper result for the TLV 2015-03-17 15:27:48 -05:00
Brent Cook
7c8b723c15 convert windows filesystem operations to unicode 2015-03-17 14:32:20 -05:00
Brent Cook
f0eac5877a Refactor filesystem operations
Separate the stdapi handling code from the OS-dependent code. This makes
testing and maintaining the code easier.

This also happens to fix a number of bugs as a side-effect, because it is
clearer what is happening now.
2015-03-17 14:32:20 -05:00
OJ
0393927159 Add extension names, enuemrators, etc
This commit contains a bunch of code tidying (formatting, spaces, naming, etc) as well as new exports for each of the modules so that the extension can be identified. The plan is for the loader to know which modules are loaded so that when stageless meterpreter fires up MSF can query the existing extensions and load the appropriate functionality on the client side.
2015-03-09 21:28:27 +10:00
Brent Cook
a4f81a51b5 make real_dprintf available even if DEBUGTRACE is not set
By making this a static _inline, it is not necessary to guard it, since
an inline is only instantiated if it is used. This also allows adding
one-off debug message for use during debugging sessions, without turning
on DEBUGTRACE all over the place.

Convert a few of the extensions to also do this as well, making them perhaps
slightly smaller.

I am curious why Windows builds define debug this way, vs posix that
just includes it in common.c. Could I just do that instead, assuming
there's no historical reason.

Finally, correct the docs in the posix version of real_dprintf.
2015-02-25 13:03:18 -06:00
Brent Cook
38c9460ba4 enumerate all processes even if we cannot read the executable type 2015-02-12 10:54:44 -06:00
William Vu
eb3b163951 Add arch to Linux ps
Uses /proc/<PID>/exe and e_ident[EI_CLASS].
2015-02-12 08:15:58 -06:00
OJ
5e0fbedd30 Make state destruction set pointers to NULL 2015-01-31 08:23:54 +10:00
OJ
c9d9e5978c Fix issue with double-start of clipboard
If a user attempts to start the clipboard monitor when it is already started then the code path that is taken results in the current clipboard monitor state pointers being lost. The net effect of this is that the existing monitor thread will never be shut down. Not a good thing!

This code fixes that case so that the monitor doesn't create a new monitor thread and doesn't reset important pointers to NULL.

This change also results in a "success" status being returned to the caller. This means it looks like the clipboard monitor has been started even if it was already running. I think this is acceptable and is better than an obscure error.
2015-01-31 07:00:06 +10:00
Brent Cook
6299e2de5b handle zero-byte reads and writes gracefully
Otherwise, doing an empty file open, like:

  ::File.open(local_file_name, "")

or write_file("meterpreter-test", "") in test/modules/post/test/file.rb
fails

Before:
```
$ touch hello
$ ./msfconsole -q
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.56.1
lhost => 192.168.56.1
msf exploit(handler) > run

[*] Started reverse handler on 192.168.56.1:4444
[*] Starting the payload handler...
[*] Sending stage (787456 bytes) to 192.168.56.1
[*] Meterpreter session 1 opened (192.168.56.1:4444 ->
192.168.56.1:55621) at 2015-01-27 11:23:09 -0600

meterpreter > upload hello
[-] Error running command upload: Errno::ENOENT No such file or
directory @ rb_file_s_stat - hello
meterpreter > upload hello
[*] uploading  : hello -> hello
[-] core_channel_write: Operation failed: The parameter is incorrect.
```

After:
```
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.56.1
lhost => 192.168.56.1
msf exploit(handler) > run

[*] Started reverse handler on 192.168.56.1:4444
[*] Starting the payload handler...
[*] Sending stage (770048 bytes) to 192.168.56.10
[*] Meterpreter session 1 opened (192.168.56.1:4444 ->
192.168.56.10:49833) at 2015-01-27 11:26:03 -0600

meterpreter > upload hello
[*] uploading  : hello -> hello
[*] uploaded   : hello -> hello
```
2015-01-27 11:24:21 -06:00
Brent Cook
0d59fc7447 support building on newer Linux systems and Makefile cleanups
- try to share some bits between different makefiles, make modifying
   global compiler flags not such a huge pain.
 - directly specify we should be using the gold rather than bpf linker
 - make compiler output largely quiet except where we care - allow
   warnings to actually be visible
 - don't delete downloaded tarballs with --really-clean
 - add missing dependencies between libraries
   (--no-add-needed/--no-copy-dt-needed-entries causes lots of trouble)
 - update readme to show what to install to build

I made minimal changes to the loader makefile - it breaks easily.
 -Os prevents if from being able to load libc, for instance
2015-01-13 16:33:56 -06:00
Tod Beardsley
74cb136099 Land , add direct access reg methods 2015-01-07 14:56:12 -06:00
Tod Beardsley
43ce54e6af Undo the 755 mode change 2015-01-07 14:32:57 -06:00
jvazquez-r7
22975bd716 Require getsid only on windows 2015-01-01 19:04:10 -06:00
Brent Cook
0f2dcf50d0 add direct access registry methods
This adds registry access methods that do an atomic open/<action>/close on
registry keys. They improve efficiency and safety, since we're not passing
HKEY's back and forth to enumerate or read registry keys. This fits the common
use pattern in MSF better anyway.
2014-12-16 15:31:11 -06:00
Brent Cook
405d55f8c9 invert error check for POSIX filesytem functions
Fixes 
2014-12-16 15:11:27 -06:00
OJ
061439edb2 Final tweaks to adsi 2014-12-09 14:27:50 -06:00
OJ
76a492ab56 Fix silly typo 2014-12-09 14:27:50 -06:00
OJ
c7a8645709 Update adsi to use group functionality
Now includes group nesting which will require work on the MSF side to
fully support it. But this option is way better as we don't lose info
thanks to serialising to strings.
2014-12-09 14:27:50 -06:00
OJ
fe70c6a733 Updated service enumeration to use group tlv api 2014-12-09 14:27:50 -06:00
OJ
3aeda7ed2a Refactor group Tlv usage in window enumeration 2014-12-09 14:27:50 -06:00
OJ
4a88e93496 Add the getsid command
Added support for a the getsid command so that it's easy to
determine the SID of the current user. This will be useful for
a number of different use cases.
2014-11-07 10:36:36 +10:00
OJ
867df868c4 Merge branch 'upstream/master' into update-kiwi 2014-07-12 08:29:38 +10:00
OJ
15d11f0e9f Update to Mimikatz commit 8d83d5ab93396263b8c8be8401381b02868fdad6
This fixes the breakages on patched systems (I think). There's also a fix
here for an infinite loop in the MSV Code.
2014-07-10 15:07:51 +10:00
OJ
4e1201d73c Update to Mimikatz commit ba14c8b425d6650276e2357f370dcb700c72ea81
Commit 3b0b875fe80ceec098e147d9adad54a0fcbda092 was not included because it only
contained changes to mimilib.
2014-07-10 14:14:26 +10:00