OJ
f76b51e265
Use RtlGetVersion to detect version
...
This means we can actually correctly detect the version of Windows in
use past 8.1 (ie including 10 and later).
2015-09-24 15:42:37 +10:00
Brent Cook
600ed34f1e
merge and cleanup @stufus's pageantjacker extension into extapi
...
see https://github.com/rapid7/meterpreter/pull/164 for details
2015-09-20 20:18:02 -05:00
Brent Cook
73e57f258a
add initial Windows 10 matching to sysinfo output
2015-08-24 15:50:28 -05:00
Brent Cook
3a0427bcbc
cleanup record_mic handler, use the right heap for freeing
...
When reallocating the record buffer, we need to pass the correct heap pointer
or this will crash.
This also simplifies error handling and switches audio.h to use Windows EOL
characters.
2015-06-30 21:36:36 -05:00
OJ
c8de66fd31
Remove extra htonq call
2015-06-27 21:44:41 +10:00
Brent Cook
ba86e968d7
fix broken partial-batch / eof handling
2015-06-22 03:58:24 -05:00
Brent Cook
9ff7339644
move ntds parser from priv to extapi
2015-06-22 03:58:24 -05:00
Brent Cook
bfe1060b40
Merge branch 'master' into land-154-ntds
2015-06-04 13:47:44 -05:00
Brent Cook
905f25a03b
compile error
2015-06-04 13:16:05 -05:00
Brent Cook
25731fee03
free utf8 conversion strings and avoid non-null terminated values
2015-06-04 09:00:24 -05:00
Brent Cook
c47c973b83
logon names can actually be up to 104 characters
...
practical limit is 64, this gives us margin
2015-06-04 08:53:09 -05:00
Brent Cook
773008d921
whitespace tweaks
2015-06-04 08:50:24 -05:00
David Maloney
2b07377328
fix copy error
...
use strncpy not memcpy to transfer the re-encoded
name and description into our account object.
also use sizeof for precise copy size. eliminates lingering
errors
MSP-12356
2015-06-02 12:44:49 -05:00
David Maloney
84cea10260
use all unicode for ntds account struct
...
force convert account name and description
to unicode for transport over the wire
MSP-12356
2015-06-02 12:35:30 -05:00
David Maloney
37e7ab2fc9
just a little more cleanup
...
this should hpefully address the last of Juan's code review
feedback appropriately.
MSP-12356
2015-05-18 11:21:10 -05:00
David Maloney
a3b4b53029
size and signedness issue fixes
...
fixes several size and signedness issues caught
during code review
MSP-12356
2015-05-18 11:08:58 -05:00
David Maloney
7c0c78d766
more missing garbage collection
...
pek structures also were not being garbage collected properly
MSP-12356
2015-05-18 10:46:43 -05:00
David Maloney
6c15c0c0a0
better garbage collection on initial setup
...
the ntds_parse method that gets everything started
was missing garbage collection for accountColumns.
MSP-12356
2015-05-18 10:43:27 -05:00
Brent Cook
602e18591c
fixup build for posix, fix memory leak in utf conversion
2015-05-15 16:01:59 -05:00
David Maloney
e8449a1698
Merge branch 'master' into feature/MSP-12715/sysinfo-upgrade
2015-05-15 15:14:23 -05:00
David Maloney
30a1ecbbcb
add domain and loggedonusers to sysinfo
...
added the domain name and logged on user counts
to the sysinfo command
MSP-12715
2015-05-15 15:10:35 -05:00
Meatballs
fded7311c4
Fixup bare met_svc var name
2015-05-15 20:43:47 +01:00
Brent Cook
d9ce138eed
remove hash sizeof workaround
2015-05-14 11:29:44 -05:00
David Maloney
1bfd8526b6
Merge branch 'master' into feature/MSP-12356/ntds-parser
2015-05-14 10:55:55 -05:00
David Maloney
7e0c23e228
fixed missing type cast
...
needed explicit typecast for x64
MSP-12356
2015-05-13 14:54:32 -05:00
Tim
caf6c0c6c8
add TLV_TYPE_FILE_HASH
2015-05-10 14:57:03 +01:00
David Maloney
f3d0a7bdde
enable compression on our channel
...
since we will be sending lots of null bytes,
we want to make sure we make good use of compression
still doesn't solve our crash problems though
MSP-12356
2015-05-07 14:26:54 -05:00
David Maloney
f288256e19
remove all unneccsary callback stubs
...
channels seem to work fine without stubbed callbacks
removed all of these to eliminate them as a source
of this madness. evrything still works exactly as it did
before, which to say badly.
MSP-12356
2015-05-07 13:47:58 -05:00
David Maloney
7595156c90
make jet instance name unique
...
use date and time to make sure the Jet
Instance name is unique. Hasn't actually
solved our issue, but that name is supposed
to be unique anyways.
MSP-12356
2015-05-07 12:39:46 -05:00
David Maloney
2fa794f1c9
more cleanup/split up
...
split the date stuff up into their own subfunction tooo
MSP-12356
2015-05-06 14:00:15 -05:00
David Maloney
1daa927175
split off hash reading functions
...
moved the reading o the nt and lm hash records
into seperate sub functions. more cleanup/readability work
MSP-12356
2015-05-06 13:30:44 -05:00
David Maloney
bc5b6a1554
split off hash history reading
...
moved the hash history read into a seperate sub function
to make it easier to read
MSP-12356
2015-05-06 13:20:21 -05:00
David Maloney
879d062aa0
un typedef structs
...
bcook says to not typedef structs and just use them as
raw structs, so i have made that conversion here
MSP-12356
2015-05-06 11:24:06 -05:00
David Maloney
dff1a12c38
some more code cleanup
...
just some various bits and bobs here to make
the code a little cleaner and easier to read
MSP-12356
2015-05-06 10:42:03 -05:00
David Maloney
a8b4010ed0
cleanup #get_column_info a bit
...
bcook showed me how to do this the way i originally
wanted to but didn't know how. This is much cleaner to read
MSP-12356
2015-05-06 10:31:18 -05:00
David Maloney
df1181fe32
cleanup flag conversion
...
use simpler conversion of bit flags to
quasi-boolean values. just a little space saved and easier to read hopefully
MSP-12356
2015-05-06 09:54:36 -05:00
David Maloney
39d1860f7d
switch from malloc to calloc
...
calloc does our memory init for us
so all the malloc/memset usage was totally
redudnant
MSP-12356
2015-05-06 09:45:31 -05:00
David Maloney
9d1af4c696
add doxygen to new code
...
added doygen style comments to the new NTDS
functions and typedefs as requested by OJ.
MSP-12356
2015-05-05 13:32:32 -05:00
Brent Cook
c7617615e4
Land #155 , remove file and console output from kiwi
2015-05-04 15:10:16 -05:00
David Maloney
e0665a2ba5
add some additional function comments
...
add some basic function documentation in
the form of comments. not eprfect, but a start
on propper documentation
MSP-12356
2015-05-04 11:14:42 -05:00
David Maloney
dee9a5efab
some more code smell cleanup
...
bad memory cleanup issues around CAPI
and another constant for the length of a hash string
MSP-12356
2015-05-04 10:47:49 -05:00
David Maloney
8e93c26ce8
add constants for HASH Length
...
added constants for byte length of a hash
as well as athe null terminated length
MSP-12356
2015-05-04 10:41:48 -05:00
OJ
b5f5d0ae17
Remove console and file output from kiwi
...
This PR removes both log file and console output from kiwi. This is done so that those people who are unfortunate enough to migrate to a console app before running kiwi don't end up rendering all of the console output to a window that the user can see.
2015-05-04 09:14:37 +10:00
David Maloney
651e7a5135
Revert "Revert "Merge branch 'master' into feature/MSP-12356/ntds-parser""
...
This reverts commit 5a7d2ae84f830242486301cad0b26168f3ec973b.
2015-05-01 10:32:15 -05:00
David Maloney
a208343153
and again
...
another missing free
MSP-12356
2015-04-30 16:01:22 -05:00
David Maloney
c9cf6be97a
more memory cleanup
...
more missing free calls
MSP-12356
2015-04-30 15:43:58 -05:00
David Maloney
e2f4438dc4
do account reads in batches
...
a channel read on the ntds channel will now read
up to 20 accounts at a time. when we run out of accounts
we set the EOF flag to let the other side know
we are done
MSP-12356
2015-04-30 14:05:10 -05:00
David Maloney
8ff6ebab85
add channel close
...
the channel close will now initiate the jet engine
shutdown, and free the context
MSP-12356
2015-04-30 13:23:39 -05:00
David Maloney
5c1c9c317d
free the useraccount each time too
...
make sure we are doing good memory cleanup
MSP-12356
2015-04-30 13:18:55 -05:00
David Maloney
3ebf0513b0
properly cleanup memory around hash history
...
we were not freeing the buffers we created
as palceholders for decrypting hash history.
this would cause crashes when we wold start dealing
with multiple accounts in a row with a hash history.
freeing the buffers seems to fix the problem
MSP-12356
2015-04-30 13:15:17 -05:00
