git-svn-id: file:///home/svn/framework3/trunk@13557 4d416f70-5f16-0410-b530-b9f4589650da
unstable
HD Moore 2011-08-13 16:51:49 +00:00
parent 55d60a1af2
commit 8b72de1af6
3 changed files with 24 additions and 21 deletions

View File

@ -20,16 +20,16 @@ class Metasploit3 < Msf::Auxiliary
def initialize
super(
'Name' => 'PXE exploit server',
'Name' => 'PXE Boot Exploit Server',
'Version' => '$Revision$',
'Description' => %q{
This module provides a PXE server, running a DHCP and TFTP server.
The default configuration loads a linux kernel and initrd into memory that
reads the hard drive; placing a payload to install metsvc, disable the
firewall, and add a new user metasploit on any Windows partition seen,
and add a uid 0 user with username and password metasploit to any linux
partition seen. The windows user will have the password p@SSw0rd!123456
(in case of complexity requirements) and will be added to the administrators
This module provides a PXE server, running a DHCP and TFTP server.
The default configuration loads a linux kernel and initrd into memory that
reads the hard drive; placing a payload to install metsvc, disable the
firewall, and add a new user metasploit on any Windows partition seen,
and add a uid 0 user with username and password metasploit to any linux
partition seen. The windows user will have the password p@SSw0rd!123456
(in case of complexity requirements) and will be added to the administrators
group.
},
'Author' => [ 'scriptjunkie' ],
@ -78,3 +78,4 @@ class Metasploit3 < Msf::Auxiliary
end
end

View File

@ -21,10 +21,10 @@ class Metasploit3 < Msf::Auxiliary
def initialize(info = {})
super(update_info(info,
'Name' => 'Email PII Tester',
'Name' => 'vsploit Email PII',
'Description' => %q{
This auxiliary reads from a file and sends data which
should be flagged via an internal or external smtp server.
should be flagged via an internal or external SMTP server.
},
'License' => MSF_LICENSE,
'Author' => ['willis'],
@ -52,4 +52,5 @@ class Metasploit3 < Msf::Auxiliary
resp = send_message(msg.to_s)
end
end
end

View File

@ -10,17 +10,17 @@
# http://msu-nftc.org
class Metasploit3 < Msf::Post
def initialize(info={})
super( update_info( info,
'Name' => 'Local NBD server for remote disks',
'Description' => %q{Maps remote disks and logical volumes to a local Network Block
'Name' => 'Local NBD Server for Remote Disks',
'Description' => %q{Maps remote disks and logical volumes to a local Network Block
Device server. Allows for forensic tools to be executed on the remote disk directly.},
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'Platform' => ['windows'],
'SessionTypes' => ['meterpreter'],
'Author' => ['Wesley McGrew <wesley@mcgrewsecurity.com>']
'Author' => ['Wesley McGrew <wesley[at]mcgrewsecurity.com>']
))
register_options(
[
@ -53,17 +53,17 @@ class Metasploit3 < Msf::Post
end
geometry = ioctl['lpOutBuffer']
disk_size = geometry[24,31].unpack('Q')[0]
socket = Rex::Socket::TcpServer.create({'LocalHost'=>ip_addr,'LocalPort'=>port})
print_status("Listening on #{ip_addr}:#{port}")
print_status("Serving #{devname} (#{disk_size} bytes)")
rsock = socket.accept()
print_status("Accepted a connection")
# Negotiation
rsock.put('NBDMAGIC')
rsock.put("\x00\x00\x42\x02\x81\x86\x12\x53")
rsock.put([disk_size].pack("Q").reverse)
rsock.put("\x00\x00\x00\x03") # Read-only
rsock.put("\x00"*124)
@ -72,16 +72,16 @@ class Metasploit3 < Msf::Post
while true
request = rsock.read(28)
magic, request, nbd_handle, offset_n, length = request.unpack("NNa8a8N")
if magic != 0x25609513
print_status("Wrong magic number")
print_error("Wrong magic number")
break
end
if request == 2
break
end
if request == 1
print_status("Attempted write on a read-only nbd")
print_error("Attempted write on a read-only nbd")
break
end
if request == 0
@ -101,3 +101,4 @@ class Metasploit3 < Msf::Post
client.railgun.kernel32.CloseHandle(handle)
end
end