From e84424716395c93d0584d09cbb65cbc919b2b769 Mon Sep 17 00:00:00 2001 From: agix Date: Sun, 19 May 2013 19:01:03 +0200 Subject: [PATCH 1/7] Little change in exe-only to work with x64 arch. --- lib/msf/util/exe.rb | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index d366657a7e..4e122d084a 100755 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -364,10 +364,13 @@ require 'digest/sha1' exe end - def self.to_win32pe_only(framework, code, opts={}) + def self.to_winpe_only(framework, code, opts={}, arch="x86") # Allow the user to specify their own EXE template - set_template_default(opts, "template_x86_windows_old.exe") + + set_template_default(opts, "template_"+arch+"_windows.exe") + + puts opts pe = Rex::PeParsey::Pe.new_from_file(opts[:template], true) @@ -1968,7 +1971,11 @@ End Sub when 'exe-only' if(not arch or (arch.index(ARCH_X86))) - output = Msf::Util::EXE.to_win32pe_only(framework, code, exeopts) + output = Msf::Util::EXE.to_winpe_only(framework, code, exeopts) + end + + if(arch and (arch.index( ARCH_X86_64 ) or arch.index( ARCH_X64 ))) + output = Msf::Util::EXE.to_winpe_only(framework, code, exeopts, "x64") end when 'elf' From e48cfcae8e43e879c715696ac943ebee10e14e01 Mon Sep 17 00:00:00 2001 From: agix Date: Sun, 19 May 2013 19:21:10 +0200 Subject: [PATCH 2/7] delete a debug puts --- lib/msf/util/exe.rb | 2 -- 1 file changed, 2 deletions(-) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 4e122d084a..08412cb2ba 100755 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -370,8 +370,6 @@ require 'digest/sha1' set_template_default(opts, "template_"+arch+"_windows.exe") - puts opts - pe = Rex::PeParsey::Pe.new_from_file(opts[:template], true) exe = '' From 8ab90e657c01562e1568a936bf1f42816ad317fd Mon Sep 17 00:00:00 2001 From: sinn3r Date: Tue, 28 May 2013 14:21:29 -0500 Subject: [PATCH 3/7] Adds a check for Cold Fusion 10 --- .../scanner/http/cold_fusion_version.rb | 36 +++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/cold_fusion_version.rb b/modules/auxiliary/scanner/http/cold_fusion_version.rb index 64bb92f12a..791ebaa321 100644 --- a/modules/auxiliary/scanner/http/cold_fusion_version.rb +++ b/modules/auxiliary/scanner/http/cold_fusion_version.rb @@ -17,13 +17,40 @@ class Metasploit3 < Msf::Auxiliary super( 'Name' => 'ColdFusion Version Scanner', 'Description' => %q{ - This module attempts identify various flavors of ColdFusion as well as the underlying OS + This module attempts identify various flavors of ColdFusion such as version 9 + and 10, as well as the underlying OS. }, - 'Author' => [ 'nebulus' ], + 'Author' => + [ + 'nebulus', # Original + 'sinn3r' # Fingerprint() patch for Cold Fusion 10 + ], 'License' => MSF_LICENSE ) end + + # + # Checks loginbackground.jpg for Cold Fusion 10. This is a patch to be able to detect + # Cold Fusion 10 correctly. We haven't been able to replace fingerprint(), because we + # don't have all the MD5s for loginbackground.jpg, not to mention some versions don't + # actually have it. + # + def cf10? + res = send_request_cgi({ + 'uri' => '/CFIDE/administrator/images/loginbackground.jpg', + 'method' => 'GET' + }) + + # Not the response we want at all, then let's assume it's not cf10 + return false if not res or res.code.to_i != 200 + + jpg_md5 = Rex::Text.md5(res.body) + return true if jpg_md5 == 'a4c81b7a6289b2fc9b36848fa0cae83c' + + false + end + def fingerprint(response) if(response.headers.has_key?('Server') ) @@ -47,6 +74,8 @@ class Metasploit3 < Msf::Auxiliary out = nil + + if(response.body =~ />\s*Version:\s*(.*)<\/strong\> Date: Tue, 28 May 2013 14:31:15 -0500 Subject: [PATCH 4/7] Looks like we don't need to check MD5, let's keep it that way then. --- .../scanner/http/cold_fusion_version.rb | 27 ++----------------- 1 file changed, 2 insertions(+), 25 deletions(-) diff --git a/modules/auxiliary/scanner/http/cold_fusion_version.rb b/modules/auxiliary/scanner/http/cold_fusion_version.rb index 791ebaa321..7cc02f3454 100644 --- a/modules/auxiliary/scanner/http/cold_fusion_version.rb +++ b/modules/auxiliary/scanner/http/cold_fusion_version.rb @@ -29,28 +29,6 @@ class Metasploit3 < Msf::Auxiliary ) end - - # - # Checks loginbackground.jpg for Cold Fusion 10. This is a patch to be able to detect - # Cold Fusion 10 correctly. We haven't been able to replace fingerprint(), because we - # don't have all the MD5s for loginbackground.jpg, not to mention some versions don't - # actually have it. - # - def cf10? - res = send_request_cgi({ - 'uri' => '/CFIDE/administrator/images/loginbackground.jpg', - 'method' => 'GET' - }) - - # Not the response we want at all, then let's assume it's not cf10 - return false if not res or res.code.to_i != 200 - - jpg_md5 = Rex::Text.md5(res.body) - return true if jpg_md5 == 'a4c81b7a6289b2fc9b36848fa0cae83c' - - false - end - def fingerprint(response) if(response.headers.has_key?('Server') ) @@ -75,7 +53,6 @@ class Metasploit3 < Msf::Auxiliary out = nil - if(response.body =~ />\s*Version:\s*(.*)<\/strong\> Date: Tue, 28 May 2013 14:31:56 -0500 Subject: [PATCH 5/7] Updates the description a little bit --- modules/auxiliary/scanner/http/cold_fusion_version.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/cold_fusion_version.rb b/modules/auxiliary/scanner/http/cold_fusion_version.rb index 7cc02f3454..d609f276fd 100644 --- a/modules/auxiliary/scanner/http/cold_fusion_version.rb +++ b/modules/auxiliary/scanner/http/cold_fusion_version.rb @@ -17,8 +17,8 @@ class Metasploit3 < Msf::Auxiliary super( 'Name' => 'ColdFusion Version Scanner', 'Description' => %q{ - This module attempts identify various flavors of ColdFusion such as version 9 - and 10, as well as the underlying OS. + This module attempts identify various flavors of ColdFusion up to version 10 + as well as the underlying OS. }, 'Author' => [ From 96888455a7e5abb544f19dd99322911e6a588a53 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Tue, 28 May 2013 16:04:08 -0500 Subject: [PATCH 6/7] Add new signature for CF9 --- .../auxiliary/scanner/http/cold_fusion_version.rb | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/http/cold_fusion_version.rb b/modules/auxiliary/scanner/http/cold_fusion_version.rb index d609f276fd..05fb1c2fd7 100644 --- a/modules/auxiliary/scanner/http/cold_fusion_version.rb +++ b/modules/auxiliary/scanner/http/cold_fusion_version.rb @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Auxiliary if(response.headers['Server'] =~ /IIS/ or response.headers['Server'] =~ /\(Windows/) os = "Windows (#{response.headers['Server']})" elsif(response.headers['Server'] =~ /Apache\//) - os = "Unix (#{response.headers['Server']})" + os = "Unix (#{response.headers['Server']})" else os = response.headers['Server'] end @@ -48,11 +48,11 @@ class Metasploit3 < Msf::Auxiliary title = $1 title.gsub!(/\s/, '') end - return nil if( title == 'Not Found' or not title =~ /ColdFusionAdministrator/) + + return nil if( title == 'Not Found' or not title =~ /ColdFusionAdministrator/) out = nil - if(response.body =~ />\s*Version:\s*(.*)<\/strong\>\s+ url, - 'method' => 'GET', + 'uri' => url, + 'method' => 'GET', }) return if not res or not res.body or not res.code From 14c4dbcf8ca0ef6e2b9c9d719ad6c98908651d86 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Tue, 28 May 2013 17:05:44 -0500 Subject: [PATCH 7/7] Also remove *.ts.rb files On the heels of #1862, this gets rid of the "test suites" that bound together all the old unit tests. --- lib/msf/base.rb.ts.rb | 22 ------ lib/msf/core.rb.ts.rb | 44 ------------ lib/rex.rb.ts.rb | 70 ------------------- lib/rex/encoding/xor.rb.ts.rb | 15 ---- .../extensions/stdapi/railgun.rb.ts.rb | 18 ----- lib/rex/proto.rb.ts.rb | 9 --- lib/rex/proto/dcerpc.rb.ts.rb | 10 --- lib/rex/proto/drda.rb.ts.rb | 18 ----- lib/rex/proto/http.rb.ts.rb | 13 ---- lib/rex/proto/smb.rb.ts.rb | 9 --- modules/modules.rb.ts.rb | 26 ------- 11 files changed, 254 deletions(-) delete mode 100644 lib/msf/base.rb.ts.rb delete mode 100644 lib/msf/core.rb.ts.rb delete mode 100644 lib/rex.rb.ts.rb delete mode 100644 lib/rex/encoding/xor.rb.ts.rb delete mode 100644 lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb delete mode 100644 lib/rex/proto.rb.ts.rb delete mode 100644 lib/rex/proto/dcerpc.rb.ts.rb delete mode 100644 lib/rex/proto/drda.rb.ts.rb delete mode 100644 lib/rex/proto/http.rb.ts.rb delete mode 100644 lib/rex/proto/smb.rb.ts.rb delete mode 100644 modules/modules.rb.ts.rb diff --git a/lib/msf/base.rb.ts.rb b/lib/msf/base.rb.ts.rb deleted file mode 100644 index f3c7d92fa3..0000000000 --- a/lib/msf/base.rb.ts.rb +++ /dev/null @@ -1,22 +0,0 @@ -#!/usr/bin/env ruby -# -*- coding: binary -*- - -require 'test/unit' -require 'msf/base' -require 'msf/base/sessions/command_shell.rb.ut' - -module Msf -module Base - -class TestSuite - def self.suite - suite = Test::Unit::TestSuite.new("Msf Base") - - suite << Msf::Session::CommandShell::UnitTest.suite - - return suite; - end -end - -end -end diff --git a/lib/msf/core.rb.ts.rb b/lib/msf/core.rb.ts.rb deleted file mode 100644 index bd50d7cea6..0000000000 --- a/lib/msf/core.rb.ts.rb +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/env ruby -# -*- coding: binary -*- - -require 'test/unit' -require 'msf/core' -require 'msf/core/exceptions.rb.ut' -require 'msf/core/option_container.rb.ut' -require 'msf/core/session_manager.rb.ut' - -require 'msf/core/module/author.rb.ut' -require 'msf/core/module/platform_list.rb.ut' -require 'msf/core/module/reference.rb.ut' -require 'msf/core/module/target.rb.ut' - -require 'msf/core/handler/bind_tcp.rb.ut' -require 'msf/core/handler/reverse_tcp.rb.ut' - -require 'msf/core/exploit.rb.ut' -require 'msf/core/exploit/tcp.rb.ut' -require 'msf/core/exploit/dcerpc.rb.ut' - -class Msf::TestSuite - def self.suite - suite = Test::Unit::TestSuite.new("Msf Core") - - suite << Msf::Exceptions::UnitTest.suite - suite << Msf::OptionContainer::UnitTest.suite - suite << Msf::SessionManager::UnitTest.suite - - suite << Msf::Module::Author::UnitTest.suite - suite << Msf::Module::PlatformList::UnitTest.suite - suite << Msf::Module::Reference::UnitTest.suite - suite << Msf::Module::Target::UnitTest.suite - - suite << Msf::Handler::BindTcp::UnitTest.suite - suite << Msf::Handler::ReverseTcp::UnitTest.suite - - suite << Msf::Exploit::UnitTest.suite - suite << Msf::Exploit::Remote::Tcp::UnitTest.suite - suite << Msf::Exploit::Remote::DCERPC::UnitTest.suite - - return suite; - end -end diff --git a/lib/rex.rb.ts.rb b/lib/rex.rb.ts.rb deleted file mode 100644 index ba7cdfa448..0000000000 --- a/lib/rex.rb.ts.rb +++ /dev/null @@ -1,70 +0,0 @@ -#!/usr/bin/env ruby -I.. - -=begin - -The Metasploit Rex library is provided under the 3-clause BSD license. - -Copyright (c) 2005-2006, Rapid7 LLC -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, -are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this - list of conditions and the following disclaimer. - - * Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. - - * Neither the name of Rapid7 LLC nor the names of its contributors may be - used to endorse or promote products derived from this software without - specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR -ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -=end - -require 'test/unit' - -require 'rex/exceptions.rb.ut' -require 'rex/transformer.rb.ut' -require 'rex/text.rb.ut' -require 'rex/file.rb.ut' - -require 'rex/encoder/xdr.rb.ut' - -require 'rex/encoding/xor/generic.rb.ut' -require 'rex/encoding/xor/byte.rb.ut' -require 'rex/encoding/xor/word.rb.ut' -require 'rex/encoding/xor/dword.rb.ut' -require 'rex/encoding/xor/dword_additive.rb.ut' - -require 'rex/socket.rb.ut' -require 'rex/socket/tcp.rb.ut' -require 'rex/socket/ssl_tcp.rb.ut' -require 'rex/socket/tcp_server.rb.ut' -require 'rex/socket/udp.rb.ut' -require 'rex/socket/parameters.rb.ut' -require 'rex/socket/comm/local.rb.ut' -require 'rex/socket/switch_board.rb.ut' -require 'rex/socket/subnet_walker.rb.ut' - -require 'rex/proto.rb.ts' - -require 'rex/parser/arguments.rb.ut' - -require 'rex/ui/text/color.rb.ut' -require 'rex/ui/text/table.rb.ut' - -require 'rex/exploitation/egghunter.rb.ut' -require 'rex/exploitation/seh.rb.ut' diff --git a/lib/rex/encoding/xor.rb.ts.rb b/lib/rex/encoding/xor.rb.ts.rb deleted file mode 100644 index 211fd64983..0000000000 --- a/lib/rex/encoding/xor.rb.ts.rb +++ /dev/null @@ -1,15 +0,0 @@ -#!/usr/bin/env ruby -# -*- coding: binary -*- - -$:.unshift(File.join(File.dirname(__FILE__), '..', '..')) - -# -# Xor Encoding Test Suite -# - -require 'test/unit' -require 'rex/encoding/xor/generic.rb.ut' -require 'rex/encoding/xor/byte.rb.ut' -require 'rex/encoding/xor/word.rb.ut' -require 'rex/encoding/xor/dword.rb.ut' -require 'rex/encoding/xor/dword_additive.rb.ut' diff --git a/lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb b/lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb deleted file mode 100644 index c999567062..0000000000 --- a/lib/rex/post/meterpreter/extensions/stdapi/railgun.rb.ts.rb +++ /dev/null @@ -1,18 +0,0 @@ -# -*- coding: binary -*- -$:.unshift(File.join(File.dirname(__FILE__))) -$:.unshift(File.join(File.dirname(__FILE__), '..', '..','..','..','..','..', 'lib')) - -require 'test/unit' -require 'rex' - -require 'railgun/api_constants.rb.ut' -require 'railgun/type/pointer_util.rb.ut' -require 'railgun/platform_util.rb.ut' -require 'railgun/buffer_item.rb.ut' -require 'railgun/dll_function.rb.ut' -require 'railgun/dll_helper.rb.ut' -require 'railgun/win_const_manager.rb.ut' -require 'railgun/dll.rb.ut.rb' -require 'railgun/dll_wrapper.rb.ut.rb' -require 'railgun/railgun.rb.ut.rb' -require 'railgun/win_const_manager.rb.ut.rb' diff --git a/lib/rex/proto.rb.ts.rb b/lib/rex/proto.rb.ts.rb deleted file mode 100644 index 3e85f03bdf..0000000000 --- a/lib/rex/proto.rb.ts.rb +++ /dev/null @@ -1,9 +0,0 @@ -#!/usr/bin/env ruby -# -*- coding: binary -*- - -$:.unshift(File.join(File.dirname(__FILE__), '..')) - -require 'test/unit' -require 'rex/proto/smb.rb.ts' -require 'rex/proto/dcerpc.rb.ts' -require 'rex/proto/http.rb.ts' diff --git a/lib/rex/proto/dcerpc.rb.ts.rb b/lib/rex/proto/dcerpc.rb.ts.rb deleted file mode 100644 index 47e38f9af3..0000000000 --- a/lib/rex/proto/dcerpc.rb.ts.rb +++ /dev/null @@ -1,10 +0,0 @@ -#!/usr/bin/env ruby -# -*- coding: binary -*- - -require 'rex/test' -require 'rex/proto/dcerpc/uuid.rb.ut' -require 'rex/proto/dcerpc/response.rb.ut' -require 'rex/proto/dcerpc/packet.rb.ut' -# require 'rex/proto/dcerpc/ndr.rb.ut' -require 'rex/proto/dcerpc/handle.rb.ut' -require 'rex/proto/dcerpc/client.rb.ut' diff --git a/lib/rex/proto/drda.rb.ts.rb b/lib/rex/proto/drda.rb.ts.rb deleted file mode 100644 index 1e4bcbe7c2..0000000000 --- a/lib/rex/proto/drda.rb.ts.rb +++ /dev/null @@ -1,18 +0,0 @@ -#!/usr/bin/env ruby -# -*- coding: binary -*- - -require 'rex/test' - -module Rex - class Test - $_REX_TEST_DRDA_HOST = "192.168.145.138" - $_REX_TEST_DRDA_USER = "db2inst1" - $_REX_TEST_DRDA_PASS = "db2pw" - end -end - -require 'rex/proto/drda/constants.rb.ut.rb' -require 'rex/proto/drda/packet.rb.ut.rb' -require 'rex/proto/drda/utils.rb.ut.rb' - - diff --git a/lib/rex/proto/http.rb.ts.rb b/lib/rex/proto/http.rb.ts.rb deleted file mode 100644 index 8e241fb401..0000000000 --- a/lib/rex/proto/http.rb.ts.rb +++ /dev/null @@ -1,13 +0,0 @@ -#!/usr/bin/env ruby -# -*- coding: binary -*- - -require 'test/unit' - -require 'rex/proto/http/client.rb.ut' -require 'rex/proto/http/server.rb.ut' -require 'rex/proto/http/packet.rb.ut' -require 'rex/proto/http/header.rb.ut' -require 'rex/proto/http/request.rb.ut' -require 'rex/proto/http/response.rb.ut' -require 'rex/proto/http/handler/erb.rb.ut' -require 'rex/proto/http/handler/proc.rb.ut' diff --git a/lib/rex/proto/smb.rb.ts.rb b/lib/rex/proto/smb.rb.ts.rb deleted file mode 100644 index 26abbcde90..0000000000 --- a/lib/rex/proto/smb.rb.ts.rb +++ /dev/null @@ -1,9 +0,0 @@ -#!/usr/bin/env ruby -# -*- coding: binary -*- - -require 'rex/test' -require 'rex/proto/smb/client.rb.ut.rb' -require 'rex/proto/smb/constants.rb.ut.rb' -require 'rex/proto/smb/crypt.rb.ut.rb' -require 'rex/proto/smb/simpleclient.rb.ut.rb' -require 'rex/proto/smb/utils.rb.ut.rb' diff --git a/modules/modules.rb.ts.rb b/modules/modules.rb.ts.rb deleted file mode 100644 index 027c4cd466..0000000000 --- a/modules/modules.rb.ts.rb +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/bin/env ruby -I../lib - -$:.unshift(File.join(File.dirname(__FILE__), '..', 'lib')) - -require 'test/unit' - -require 'encoders/generic/none.rb.ut' -require 'encoders/x86/call4_dword_xor.rb.ut' -require 'encoders/x86/countdown.rb.ut' -require 'encoders/x86/fnstenv_mov.rb.ut' -require 'encoders/x86/jmp_call_additive.rb.ut' - -class Rex::TestSuite - def self.suite - suite = Test::Unit::TestSuite.new("Rex") - - # General - suite << Msf::Encoders::Generic::None::UnitTest.suite - suite << Msf::Encoders::X86::Call4Dword::UnitTest.suite - suite << Msf::Encoders::X86::Countdown::UnitTest.suite - suite << Msf::Encoders::X86::FnstenvMov::UnitTest.suite - suite << Msf::Encoders::X86::JmpCallAdditive::UnitTest.suite - - return suite; - end -end