From add294d99988d1b4d85ad3a6a104389c40537043 Mon Sep 17 00:00:00 2001 From: sinn3r Date: Tue, 9 Jul 2013 12:50:19 -0500 Subject: [PATCH 1/5] Fix potential nil in last_filename Replacing #2060. It is possible to get a nil in last_filename if the sub! function doesn't find any 0x00s to replace, so instead it's best to use sub(), which should at least return the original filename. To make sure we don't hit any other unknown conditions that may result in nil last_filename, it's also convert with to_s to make sure it's always a string. --- lib/rex/proto/smb/client.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/rex/proto/smb/client.rb b/lib/rex/proto/smb/client.rb index 807713956e..27a99240ae 100644 --- a/lib/rex/proto/smb/client.rb +++ b/lib/rex/proto/smb/client.rb @@ -1881,7 +1881,7 @@ NTLM_UTILS = Rex::Proto::NTLM::Utils 'C'+ # Short File Name Length 'C' # Reserved ) - name = resp_data[didx + 70 + 24, info[15]].sub!(/\x00+$/, '') + name = resp_data[didx + 70 + 24, info[15]].sub(/\x00+$/, '') files[name] = { 'type' => ((info[14] & 0x10)==0x10) ? 'D' : 'F', @@ -1916,7 +1916,7 @@ NTLM_UTILS = Rex::Proto::NTLM::Utils 260, # Level of interest resume_key, # Resume key from previous (Last name offset) 6, # Close search if end of search - ].pack('vvvVv') + last_filename + "\x00" # Last filename returned from find_first or find_next + ].pack('vvvVv') + last_filename.to_s + "\x00" # Last filename returned from find_first or find_next resp = trans2(CONST::TRANS2_FIND_NEXT2, parm, '') return resp # Returns the FIND_NEXT2 response packet for parsing by the find_first function end From fca732d893ba16d973f6b1bd59befcdca4e855fe Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Wed, 10 Jul 2013 15:56:36 -0500 Subject: [PATCH 2/5] We're an Inc, not an LLC. --- COPYING | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/COPYING b/COPYING index fc75268b1a..abacaa53dd 100644 --- a/COPYING +++ b/COPYING @@ -11,7 +11,7 @@ are permitted provided that the following conditions are met: this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the name of Rapid7 LLC nor the names of its contributors + * Neither the name of Rapid7, Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. @@ -30,7 +30,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The Metasploit Framework is provided under the 3-clause BSD license above. -The copyright on this package is held by Rapid7 LLC. +The copyright on this package is held by Rapid7, Inc. This license does not apply to several components within the Metasploit Framework source tree. For more details see the LICENSE file. From 20c5e089882081dcf8ea2c6d0ed12dcdda7f9945 Mon Sep 17 00:00:00 2001 From: g0tmi1k Date: Thu, 11 Jul 2013 11:39:54 +0100 Subject: [PATCH 3/5] msfvenom - Added advance options --- msfvenom | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/msfvenom b/msfvenom index 622445c7ad..0e6af71597 100755 --- a/msfvenom +++ b/msfvenom @@ -97,6 +97,10 @@ def parse_args opts[:list_options] = true end + opt.on('-d', '--advance', 'List the payload\'s advance options') do + opts[:list_advance] = true + end + opt.on_tail('-h', '--help', 'Show this message') do $stderr.puts opt exit(1) @@ -338,6 +342,11 @@ if opts[:list_options] exit end +if opts[:list_advance] + puts Msf::Serializer::ReadableText.dump_advanced_options(payload) + exit +end + if payload_raw.nil? or payload_raw.empty? begin payload_raw = payload.generate_simple( From 6f7152a3dacd9dda70f294a8987e4bc917768340 Mon Sep 17 00:00:00 2001 From: g0tmi1k Date: Thu, 11 Jul 2013 12:27:57 +0100 Subject: [PATCH 4/5] msfcli - fixed impcomplete argument parsing --- msfcli | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/msfcli b/msfcli index 51fad70034..a0593ff0b5 100755 --- a/msfcli +++ b/msfcli @@ -141,8 +141,12 @@ exploit.init_ui( mode = ARGV.pop || 'h' # Import options -exploit.datastore.import_options_from_s(ARGV.join('_|_'), '_|_') - +begin + exploit.datastore.import_options_from_s(ARGV.join('_|_'), '_|_') +rescue => e + print "[!] Error: #{e}\n\n" + exit +end # Initialize associated modules payload = nil @@ -152,21 +156,21 @@ nop = nil if (exploit.datastore['PAYLOAD']) payload = $framework.payloads.create(exploit.datastore['PAYLOAD']) if (payload != nil) - payload.datastore.import_options_from_s(ARGV.join('_|_'), '_|_') + payload.datastore.import_options_from_s(ARGV.join('_|_'), '_|_') end end if (exploit.datastore['ENCODER']) encoder = $framework.encoders.create(exploit.datastore['ENCODER']) if (encoder != nil) - encoder.datastore.import_options_from_s(ARGV.join('_|_'), '_|_') + encoder.datastore.import_options_from_s(ARGV.join('_|_'), '_|_') end end if (exploit.datastore['NOP']) nop = $framework.nops.create(exploit.datastore['NOP']) if (nop != nil) - nop.datastore.import_options_from_s(ARGV.join('_|_'), '_|_') + nop.datastore.import_options_from_s(ARGV.join('_|_'), '_|_') end end @@ -178,7 +182,6 @@ case mode.downcase $stdout.puts("\n" + Msf::Serializer::ReadableText.dump_module(payload, Indent)) if payload $stdout.puts("\n" + Msf::Serializer::ReadableText.dump_module(encoder, Indent)) if encoder $stdout.puts("\n" + Msf::Serializer::ReadableText.dump_module(nop, Indent)) if nop - when "o" $stdout.puts("\n" + Msf::Serializer::ReadableText.dump_options(exploit, Indent)) $stdout.puts("\n" + Msf::Serializer::ReadableText.dump_options(payload, Indent)) if payload From 62413df04f72c99e41b2b93b35efd970852cb9bb Mon Sep 17 00:00:00 2001 From: sinn3r Date: Thu, 11 Jul 2013 11:36:21 -0500 Subject: [PATCH 5/5] Only catch Rex::ArgumentParseError Avoid catching all exceptions, that way we don't actually shut up other possible errors that are actually bugs. --- msfcli | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/msfcli b/msfcli index a0593ff0b5..ce541bcf41 100755 --- a/msfcli +++ b/msfcli @@ -143,8 +143,8 @@ mode = ARGV.pop || 'h' # Import options begin exploit.datastore.import_options_from_s(ARGV.join('_|_'), '_|_') -rescue => e - print "[!] Error: #{e}\n\n" +rescue Rex::ArgumentParseError => e + puts "[!] Error: #{e.message}\n\n" exit end