mirror of
https://github.com/rapid7/metasploit-payloads
synced 2025-04-30 13:07:22 +02:00
a89d79d139
The goals of this work are: * To fix issue where backgrounding and re-interacting with channels wasn't working. * To fix issue where closing of meterpreter was not closing off background prcoesses (such as cmd.exe). The two things preventing this stuff from working were: * When interactive channels are backgrounded their handles were destroyed along with the context that wraps them up. Making them interactive again had no impact because the handle and context were invalid. If anything, this made meterpreter unstable. Sometimes the session would die when attempting to interact with the channel again. * When closing channels, there was no way of terminating the process that sat behind the scenes because no reference to the process was retained. Channels would close and handles would close, but no process termination was done. To fix these problems: * The interactive thread no longer terminates when backgrounded. Instead its put in a suspended state where it's waiting a signal from a resume handle that's associated with the channel's context. This means that the destruction of the context doesn't happen at all until the termination of the channel, which is exactly when it should happen anyway. * Process handles are stored alongside the input/output handles so that when the time comes, the process can be terminated if required. This means that when the channels are closed, the code has a reference to the associated process which can be terminated. This is only done for interactive processes, non-interactive processes do not have this problem because meterpreter doesn't have to keep track of them.
73 lines
3.1 KiB
C
73 lines
3.1 KiB
C
#ifndef _METERPRETER_SOURCE_EXTENSION_STDAPI_STDAPI_SERVER_PROCESS_PROCESS_H
|
|
#define _METERPRETER_SOURCE_EXTENSION_STDAPI_STDAPI_SERVER_PROCESS_PROCESS_H
|
|
|
|
/*
|
|
* The process channel context
|
|
*/
|
|
typedef struct _ProcessChannelContext
|
|
{
|
|
HANDLE pStdin;
|
|
HANDLE pStdout;
|
|
HANDLE pProcess;
|
|
} ProcessChannelContext;
|
|
|
|
DWORD process_channel_read(Channel *channel, Packet *request,
|
|
LPVOID context, LPVOID buffer, DWORD bufferSize, LPDWORD bytesRead);
|
|
DWORD process_channel_write(Channel *channel, Packet *request,
|
|
LPVOID context, LPVOID buffer, DWORD bufferSize, LPDWORD bytesWritten);
|
|
DWORD process_channel_close(Channel *channel, Packet *request,
|
|
LPVOID context);
|
|
DWORD process_channel_interact(Channel *channel, Packet *request,
|
|
LPVOID context, BOOLEAN interact);
|
|
|
|
/*
|
|
* Process handlers
|
|
*/
|
|
DWORD request_sys_process_attach(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_close(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_execute(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_kill(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_get_processes(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_getpid(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_get_info(Remote *remote, Packet *packet);
|
|
|
|
// Image
|
|
DWORD request_sys_process_image_load(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_image_get_proc_address(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_image_unload(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_image_get_images(Remote *remote, Packet *packet);
|
|
|
|
// Memory
|
|
DWORD request_sys_process_memory_allocate(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_memory_free(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_memory_read(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_memory_write(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_memory_query(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_memory_protect(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_memory_lock(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_memory_unlock(Remote *remote, Packet *packet);
|
|
|
|
// Thread
|
|
DWORD request_sys_process_thread_open(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_thread_create(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_thread_close(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_thread_get_threads(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_thread_suspend(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_thread_resume(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_thread_terminate(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_thread_query_regs(Remote *remote, Packet *packet);
|
|
DWORD request_sys_process_thread_set_regs(Remote *remote, Packet *packet);
|
|
|
|
/*
|
|
* Utility methods
|
|
*/
|
|
DWORD execute_code_stub_in_process(HANDLE process, PVOID buffer, ULONG length,
|
|
LPVOID parameter, DWORD parameterLength, LPDWORD result);
|
|
|
|
|
|
/*
|
|
* Wait methods
|
|
*/
|
|
DWORD request_sys_process_wait(Remote *remote, Packet *packet);
|
|
#endif
|