Commit Graph

1447 Commits (17040e9894e5a5cd49946718599896115cec909d)

Author SHA1 Message Date
OJ e3de01219a Pushed on with more pivot code 2017-09-07 01:33:54 -05:00
OJ abc80655b7 Progress in named pipe pivots, more to come 2017-09-07 01:33:54 -05:00
OJ 816e78b6f6 First pass of named pipe code for pivots 2017-09-07 01:33:53 -05:00
Brent Cook f7071818b1 more updates 2017-08-28 14:10:51 -05:00
Brent Cook a0e04760b5 rewrite timestomp command dispatcher to deal with file args properly 2017-08-28 08:25:42 -05:00
Brent Cook 429824b5c9 guid is hex values 2017-08-21 03:44:02 -05:00
Brent Cook 8700a36858 make session_guid default with the correct length 2017-08-21 03:24:37 -05:00
OJ fa292dce96
Fix issue with truncated values when unpacking packets 2017-08-16 11:01:54 +10:00
OJ d7e8b32312
Merge branch 'upstream/master' into transport-agnostic-packet-encryption 2017-08-08 17:30:51 +10:00
Pearce Barry cfd377fbd4 Support padding on the CAN bus.
Also use a hash for passing options around instead of individual params.
2017-08-06 18:05:59 -05:00
Brent Cook 24d323d4ed remove more instances of positive? 2017-08-02 12:47:34 -05:00
Brent Cook cdfb6782a8
Land #8639, Add mic audio streaming to Linux/OSX native meterpreter 2017-07-24 07:01:00 -07:00
Pearce Barry 6a686a277b
Land #8742, HWBRIDGE RFTRANSCEIVER ADD LOWBALL SUPPORT 2017-07-21 11:46:21 -05:00
Pearce Barry 3043218a7f
Indention and missing comma fixup. 2017-07-21 11:43:49 -05:00
Corey Harding 22e8f1cb48 HWBRIDGE RFTRANSCEIVER ADD LOWBALL SUPPORT 2017-07-20 05:09:00 -04:00
Brent Cook f5e76092d6 Merge branch 'master' into land-8439- 2017-07-18 08:25:18 -05:00
James Lee 5c17f363be
Default opts to an empty hash instead of nil
Fixes #8709
2017-07-13 15:40:08 -05:00
bwatters-r7 99bb091488
Land #8690, Fix #8636, [] for NilClass in session.fs.file.download_file 2017-07-12 13:43:12 -05:00
William Webb aa0fca9dd1
Land #8631, Add railgun support to Python Meterpreter for the OSX
platform
2017-07-11 16:05:16 -05:00
wchen-r7 d5d9e88851 Fix #8636, [] for NilClass in session.fs.file.download_file
This fixes a [] for NilClass bug in the download_file API.
The opts argument is not checked for nil before the code looks for
the block_size key.

Fix #8636
2017-07-07 19:00:33 -05:00
Pearce Barry baead02efc
Addressing PR feedback.
Removing the audio_stream_pool.rb class file for now, we can recreate for MS-2749 if we really need one.
2017-07-04 09:28:38 -05:00
Pearce Barry ef1145c6b7
Use common code to delete non-applicable cmds. 2017-07-03 09:11:04 -05:00
OJ 4f054d25fc
Fix packet spec problems 2017-07-03 18:12:38 +10:00
OJ 999d90687e
Make encryption flags 32 bit
This changes the encryption flags on the meterpreter session so that
it's 32 bits (and hence changes the packet header). This also supports
the idea that sessions may use encryption that isn't AES256, so the
flags field will ultimately indicate that. A type flag has been added so
that MSF knows the type that should be done on the wire.

At some point soon we'll add something that makes sure that the packet
encryption type always matches the encryption type expected in MSF, this
will hopefully avoid the risk of having packets injected into the stream
by external entities.
2017-07-03 16:52:58 +10:00
Pearce Barry e21ae88b55
Update wave file header with actual length.
Fixes MS-2759.
2017-06-30 22:48:42 -05:00
James Lee ada954aab9
Land #8624, fix mis-ordered kiwi output 2017-06-30 14:23:24 -05:00
Pearce Barry d2098137a9
Grab last bit of audio from target when done.
Also remove module that needs work (we can create later).
2017-06-30 10:56:49 -05:00
Pearce Barry 48e7e8397e Make listen focus on prerecorded items. 2017-06-29 16:52:17 -05:00
Pearce Barry e8468a5c99 Cleanup. 2017-06-29 16:52:17 -05:00
Pearce Barry 5c5044a80f Stream audio data via channel (MS-2725). 2017-06-29 16:52:16 -05:00
dmohanty-r7 dd7726b894 Change to Audio Mic 2017-06-29 16:52:16 -05:00
dmohanty-r7 1bfa9366e6 Bring back to working 2017-06-29 16:52:15 -05:00
dmohanty-r7 bd9c15713d Bring polling back in 2017-06-29 16:52:15 -05:00
dmohanty-r7 3d51301b98 Seperation of concerns 2017-06-29 16:52:15 -05:00
dmohanty-r7 c7b71a2b32 Seperate concerns of console/mic 2017-06-29 16:52:14 -05:00
dmohanty-r7 9ca74d69f1 add sleep 2017-06-29 16:52:14 -05:00
dmohanty-r7 d2cccae2a1 Use webrtc browser 2017-06-29 16:52:13 -05:00
dmohanty-r7 56b3b0e00d Add more parameterization 2017-06-29 16:52:13 -05:00
dmohanty-r7 d9e1d21c56 Spacing 2017-06-29 16:52:13 -05:00
dmohanty-r7 d62f0cfd98 Add the mic stop command 2017-06-29 16:52:12 -05:00
dmohanty-r7 40ce03b85f Parameterize playback configurations 2017-06-29 16:52:12 -05:00
dmohanty-r7 6f8f85df61 Open player for listening to audio 2017-06-29 16:52:12 -05:00
dmohanty-r7 60e009de8f Use large datasize 2017-06-29 16:52:11 -05:00
dmohanty-r7 16a13723d0 Remove debug 2017-06-29 16:52:11 -05:00
dmohanty-r7 fa4ebadf0f Make mic audio device stream work with mettle 2017-06-29 16:52:10 -05:00
dmohanty-r7 0a0e6c8576 Use audio stream pool 2017-06-29 16:52:10 -05:00
dmohanty-r7 197d377424 Fix commands to mic 2017-06-29 16:52:10 -05:00
Dev Mohanty ebf967db3e Add audio-channel 2017-06-29 16:52:09 -05:00
Spencer McIntyre 52211ab6ae Continue refactoring removal of "DLL" references 2017-06-27 18:00:01 -04:00
Spencer McIntyre 0da9f4d64a Refactor railgun "DLL" references to library 2017-06-27 17:34:06 -04:00
Brent Cook e08bd84038 Merge branch 'upstream-master' into land-8603- 2017-06-27 04:03:31 -05:00
OJ 8e1e505730
Fix output of MSV creds dumping in Kiwi
The data being pulled out of the MSV credential dump was not being
rendered propertly because it was assumed that all accounts would
provide the same set of hashes/details for each entry found. However,
this was not the case. Some have NTLM & SHA1, others have LM & NTLM,
some have DPAPI when others don't.

This code generates tables based on the values found, and renders those
values in the appropriate columns, and if the values don't exist for
a given account, the column is left blank.

Fixes #8620
2017-06-27 15:43:40 +10:00
OJ 49e34d70c3
Remove uses of multi-char args for meterpreter commands 2017-06-27 13:06:10 +10:00
Spencer McIntyre ea83cb0bb6 Make the railgun def class names platform specific 2017-06-26 19:53:19 -04:00
OJ 25e323fc4b
Support AES renegotiation after session migration 2017-06-26 20:50:12 +10:00
OJ 9f2be21eb7
Ignore missing method error when doing aes negotiation
This means that meterpreter instances that don't support will continue
to work.
2017-06-26 15:22:56 +10:00
OJ bdcea7bd22
Fix http AES packet dispatching 2017-06-25 19:51:25 +10:00
OJ 494d389aa2
Merge upstream/master into packet encryption 2017-06-25 19:06:31 +10:00
OJ 67b1a19aa1
Finalised MSF-side of AES key negotiation over RSA 2017-06-25 10:24:00 +10:00
William Webb bf85386acf
add help switch 2017-06-24 17:45:53 -05:00
James Lee 6a8d54a93c
Land #8545, `ps` table output fixes 2017-06-24 14:43:51 -05:00
Brent Cook 1762fe56c9
Land #8589, Fix 64-bit support for the winpmem extension 2017-06-23 19:27:31 -05:00
William Webb 9eeb3dc143
use typical command option and TLV scheme instead of dumb stuff for keyscan_start 2017-06-23 13:11:12 -05:00
OJ a3607c6802
Update to Mimikatz 2.1.1 20170608 to include changntlm 2017-06-23 13:40:01 +10:00
James Lee 283f36f79a
Compare headers w/process keys instead of themselves
Also clarifies a bunch of old bad variable names
2017-06-22 21:43:11 -05:00
Brent Cook 2617ae7609
Land #8513, check extapi commands for dependencies 2017-06-22 20:21:26 -05:00
Brent Cook fda2e8c73d
Land #8523, Add support for session GUIDs 2017-06-22 20:10:10 -05:00
Brent Cook 0eaffde4b3 fix rex arguments parser to handle adjacent flags, update accordingly 2017-06-22 09:54:03 -05:00
Brent Cook eb4c4c911b
Land #8587, Add android wakelock command to turn the screen on 2017-06-21 14:48:20 -05:00
Spencer McIntyre 717f9aad12 Add more OSX Railgun defs and better CDECL support 2017-06-21 08:59:42 -04:00
OJ a9e03c1efd
Initial working version of AES encryption of TLVs 2017-06-21 21:01:59 +10:00
Brent Cook d81d0ea4ba print a friendlier status msg 2017-06-21 03:09:42 -05:00
Brent Cook b9904572f9 update winpmem dump handler for 64-bit support 2017-06-21 03:02:50 -05:00
OJ 2129959d2d
Begin rework of packet handling
This moves some of the packet-specific stuff to the packet class itself
2017-06-20 19:18:37 +10:00
Spencer McIntyre f7c133cdf7 Add OSX support to railgun 2017-06-19 11:11:55 -04:00
OJ cec87a3e4f
Start of support for AES packet encryption 2017-06-19 22:27:51 +10:00
OJ a48f0fcec6
Remove references to Meterpreter CRYPTO TLVs
This feature wasn't supported, and so the TLVs are no longer needed.
2017-06-19 16:53:33 +10:00
RageLtMan 32fbad7fca Style changes for cmd_ps cleanup 2017-06-14 01:28:21 -04:00
RageLtMan 762427b447 Clean up cmd_ps table output for Mettle
Mettle can run in all sorts of environments where some colums of a
process table will be nil. The existing implementation compacts
rows going into the table while providing filtering for the colum
contents only by checking the output of the first row in the proc
table.

Check column filters against all rows to ensure proper table init.
Check columns going into table for match against header.
Do not compact nil values in the table rows - some things, like
kthreads/workers dont have a path while other PIDs will.
2017-06-12 01:20:59 -04:00
OJ c4288fb35a
Update branch to include chances from upstream/master 2017-06-09 17:18:57 +10:00
OJ 6131e4bd82
Fix download lambda function to take correct param count
This is an emergency fix as a result of something being broken in
master. This is also being pushed straight to master because github is
down and the PR process isn't possible. This commit was reviewed by
@wvu-r7 prior to being pushed.
2017-06-07 09:37:24 +10:00
OJ 37b9cd07a2
Add support for the session GUID in the UI
The Session GUID will identify active sessions, and is the beginning of
work that will allow for tracking of sessions that have come back alive
after failing or switching transports.
2017-06-06 17:15:57 +10:00
Tim 871c30c0b3 refactor stdapi and lanattacks to use filter_commands 2017-06-06 14:05:07 +08:00
Tim e9c9c852ab check_commands -> filter_commands 2017-06-06 13:56:38 +08:00
Tim 7625d36c1c fix #8199, check extapi for dependencies 2017-06-05 14:56:59 +08:00
OJ cc0ff8f3db
Enable adaptive download with variable block sizes
The aim of this commit is to allow users of Meterpreter in high-latency
environments have better control over the behaviour of the download
function. This code contains two new options that manage the block size
of the downloads and the ability to set "adaptive" which means that the
block size will adjust on the fly of things continue to fail.
2017-06-02 17:16:58 +10:00
Brent Cook 11b3fd9067
Land #8468, Update system info after running getsystem 2017-05-26 23:37:00 -05:00
TheNaterz 53cbbbacd8 getsystem update session info 2017-05-26 17:28:11 -06:00
Tim a9e6df6f15 fix shell command on osx meterpreter 2017-05-26 15:55:14 +08:00
OJ 86aad6b7c3
Fix proxy_type references to handle nil case 2017-05-22 21:47:37 +10:00
Pearce Barry a6f416e8df
Land #8290, Hwbridge Automotive Fix and Extension Enhancements 2017-05-19 13:46:54 -05:00
Pearce Barry d0b13544dd
Agreed-upon feedback updates. 2017-05-17 10:57:39 -05:00
Brent Cook 123462bdca
Land #8293, add initial multi-platform railgun support 2017-05-11 22:32:23 -05:00
William Vu e026a8c663
Fix typo (s/Remote/Reverse/) in portfwd -L
Found by ThePortWhisperer on IRC.
2017-04-29 00:10:13 -05:00
Spencer McIntyre 3347af24ba Add some basic libc definitions for railgun 2017-04-25 15:12:39 -04:00
Spencer McIntyre 9c60c3ee46 Support platform specific railgun constants 2017-04-25 14:36:15 -04:00
Brent Cook 6f763a616d
Land #8225, Expose the shared wifi profile dumping feature in Mimikatz 2017-04-25 11:23:34 -05:00
Craig Smith aeed81de29 Code cleanup from Rubocop output
Signed-off-by: Craig Smith <agent.craig@gmail.com>
2017-04-24 20:42:03 -07:00
Craig Smith c2296dcd1b Addes 'isotpsend' command to interactive commands to send ISO-TP related queries
Signed-off-by: Craig Smith <agent.craig@gmail.com>
2017-04-24 20:42:03 -07:00
Craig Smith 36026ba8b4 Fixed active buses not being recorded. The 'connect' command now works for other extensions as well as modules. Added TesterPresent background packet transmissions to hold debugging sessions open.
Signed-off-by: Craig Smith <agent.craig@gmail.com>
2017-04-24 20:42:03 -07:00