1
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-05-06 16:09:38 +02:00

34 Commits

Author SHA1 Message Date
OJ
5f7c2e7207 Fix handling of UUIDs in Meterpreter
The original implementation assumed that the UUIDs were coming through a strings, but this was changed at some point to use the 16-byte UUID format straight out of MSF.

This was causing issues when UUIDs had null bytes in them because the UUID was being truncated and the result was that UUIDs that were being parsed in MSF were too small, resulting in exceptions.
2015-05-17 17:43:59 +10:00
OJ
952bcd7f32 Add transport listing 2015-05-05 08:58:21 +10:00
OJ
a046d80877 More transport features, UUID fetcher
Users can now add transports without switching to them straight away. They can then move forward and backwards using the next and prev commands in MSF. There's also the get UUID facility too.
2015-04-28 20:20:40 +10:00
OJ
fe566d5f07 Moved transport stuff from core to metsrv
Lots of transported related things were in the core library which didn't make any sense given that the only thing that needed it was metsrv. This moves the functionality out into metsrv, reformats stuff and gets rid of some dead code.

TODO: Make this work with POSIX.
2015-04-23 19:41:25 +10:00
OJ
5c1f39623e Rejigging of timeouts for session resliency 2015-04-09 17:59:06 +10:00
OJ
8b637d7248 Refactored windows transport hopping
Instead of basing everything on URLs, the transport hopping now actually supports the creation of a whole new transport on the fly. The transport instance is stored in the remote as a "next transport" pointer.

This better facilitates the notion of being able to set all of the parameters on the transport when doing the switch, and is a step closer to being able to support chains of transports.
2015-04-02 22:51:12 +10:00
OJ
934525d2e7 Remove traces of wininet from the source
WinInet won't work any more thanks to use making modifications on the MSF that will cause it to break. We're basically all-in for WinHTTP now.
2015-04-02 12:36:17 +10:00
OJ
94897b7331 Add machine ID support to the Win32 side 2015-04-01 14:29:44 +10:00
OJ
a2f74d99d6 Transport switch v0.0.1-preAlpha
Switching works, but doesn't do anything nice with session management. Still need to get things wired into posix, and probably rip out the wininet stuff as well given that I probably won't refactor it to support this.
2015-03-25 12:59:50 +10:00
OJ
91a8bce4b6 Implement first pass of transport refactoring
* Transports are now defined by a set of callbacks that are bound to the Remote.
* Transport initialisation and dispatching is seprated.
* The context of the transport should be switchable depending on new transport requirements.

More to do, but it has begun.
2015-03-23 12:35:45 +10:00
jvazquez-r7
74bac30dc8 Add support for linux migrate 2014-07-31 13:45:11 -05:00
OJ
d7c455edee Remove a function that is no longer used 2014-04-21 19:25:17 +10:00
OJ
02312e1972 Debugging output, crash fix
In some cases this extension would crash. This was due to the code using the
incorrect "length" variable when dumping LSA data. This commit includes addition
of some debug output, removal of other debug output, and changing of the
kiwi-specific debug definition.

Another packet function was added to aid in construction of this fix, and the
group packet function was added to one of the calls.
2014-03-28 13:40:02 +10:00
OJ
637e839de2 Merge branch 'upstream/master' into ext_server_kiwi 2014-03-20 09:17:18 +10:00
OJ
83d4d2b0b7 Fix leaking memory 2014-03-19 15:01:02 +10:00
OJ
a7927a4105 Added the notion of "group packets"
A group packet is a special packet that is to be used as a group of TLVs that
will live under another packet. Using this functionality means that we can
easily nest groupings of data to arbitrary depths, which wasn't something we
were able to do before easily.

The MSF side is easily capable of handling this scenario, but this side had
always been lacking.

The clipboard dump code has been updated to show how this can be used.
2014-03-04 19:38:15 +10:00
OJ
eca73429f3 Initial integration of Mimikatz 2.0
This is a seprate extension because the old Mimikatz supports more
operating systems, while the new Mimikatz has more features for
less operating systems.
2014-01-10 16:51:51 +10:00
OJ
5986ccf235 Add the getproxy command
This allows for system proxy setting to be pulled out. Windows-only at
this point.
2013-10-30 17:25:51 +10:00
OJ
2c865a4a37 Documented base.* and core.*
Big job, this documentation lark. Also modified the prototype the
packet_is_tlv_null_terminated function, which used to take a Packet
instance as well as the TLV, but never used the packet in its
implementation.
2013-10-15 16:14:39 +10:00
OJ
ebf13ffaa7 Even more docs 2013-10-04 18:03:35 +10:00
OJ
08793782d1 Add doxygen, begin documenting, kitrap0d tidy
* Added the doxygen binaries and configuration.
* Added a `make docs` which generates documentation to the `docs` folder.
* Added some documentation to various areas of the source that I was
  working with. Over time I'll be adding more and more rather than trying
  to do it all in one hit.
* Refactored the kitrap0d code a bit to try to reduce code size.
2013-09-26 14:29:46 +10:00
James Lee
7283131279 Initial source import from metasploit-framework 2012-11-19 16:46:07 -06:00
jlee-r7
964bae0c49 Initial commit 2012-11-19 14:40:03 -08:00
HD Moore
118d6b2bfb Merge in some recent meterpreter work, still a ways off before this is ready to use.
git-svn-id: file:///home/svn/framework3/trunk@13044 4d416f70-5f16-0410-b530-b9f4589650da
2011-06-28 05:57:36 +00:00
Stephen Fewer
95f43bf9c2 Delete the railgun meterpreter extension and add railgun support directly into stdapi. Support now includes Windows x64. Update meterpreter packet core to handle QWORD TLV's.
git-svn-id: file:///home/svn/framework3/trunk@10317 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-14 23:21:36 +00:00
Stephen Fewer
6f25e39b27 Commit all the code for the new 'screenshot' command in the stdapi extension. Screenshot will now work on NT4 - 7 on both x86 and x64 and on newer versions of Windows we can break out of session isolation (e.g. session 0 isolation for services) to screenshot the active desktop (or logon screen) without the need to migrate meterpreter. The majority of the migration code-injection stuff has been refactored out into base_inject.c so it can be shared with the new ps_inject() functionality to inject dlls. The 'ps' command now reports what session each process belongs to (if this is too verbose we can remove it or add a -v verbose switch to the ps command). The 'execute' command can now take a -s switch in order to create a process in a users session under the users privs (assuming you have the privs to do this).
git-svn-id: file:///home/svn/framework3/trunk@8787 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-11 17:09:55 +00:00
Stephen Fewer
2bcfe8f18c Commit the meterpreter C side (and bins) for transparent zlib (zlib.c copied from the posix meterpreter source) compression of TLV's and channels. To use transparent compression with channels, create them with CHANNEL_FLAG_COMPRESS. To use transparent compression with any TLV value, bitwise or the TLV type with TLV_META_TYPE_COMPRESSED (Don't create the TLV type with TLV_META_TYPE_COMPRESSED as the compressed flag is removed on the remote end after compression). For consistency with the ruby side we could at a later stage add a boolean compress parameter to all the packet_add_tlv_* functions so you don't have to manually specify TLV_META_TYPE_COMPRESSED flag.
git-svn-id: file:///home/svn/framework3/trunk@8515 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 14:56:24 +00:00
Stephen Fewer
85ed7baa43 Commit the new TCP server channel support on the meterpreter end as well as some fixes to TCP client channels.
git-svn-id: file:///home/svn/framework3/trunk@8383 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 17:55:41 +00:00
Stephen Fewer
43347e4dc5 Complete overhaul of process migration. Migration across x86->x86, x64->x64, wow64->x64 and x64->wow64 all supported using a number of techniques.
git-svn-id: file:///home/svn/framework3/trunk@8198 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-22 19:46:18 +00:00
HD Moore
3abb8ddb16 Fixes . This commit changes how token manipulation works, adds the steal_token, drop_token, and getprivs commands. Tested on NT 4.0, 2000 SP4, XP SP3, 2003 SP2, Vista, and Windows 7
git-svn-id: file:///home/svn/framework3/trunk@8055 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-02 00:35:10 +00:00
HD Moore
2a365951cd This patch removes some of the meterpreter compiler warnings and fixes migration over SSL
git-svn-id: file:///home/svn/framework3/trunk@6761 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-09 22:44:33 +00:00
HD Moore
fa51ea5d15 Swapping in the latest patched copy of Meterpreter. See
git-svn-id: file:///home/svn/framework3/trunk@6357 4d416f70-5f16-0410-b530-b9f4589650da
2009-03-22 18:56:28 +00:00
HD Moore
a3fa8e90cb Swapping out old Meterpreter code for Stephen Fewer's latest patched copy
git-svn-id: file:///home/svn/framework3/trunk@6356 4d416f70-5f16-0410-b530-b9f4589650da
2009-03-22 18:55:36 +00:00
Matt Miller
736528e546 import of meterp shit
git-svn-id: file:///home/svn/incoming/trunk@2516 4d416f70-5f16-0410-b530-b9f4589650da
2005-05-24 19:08:32 +00:00