Commit Graph

1447 Commits (17040e9894e5a5cd49946718599896115cec909d)

Author SHA1 Message Date
Rich Whitcroft 24a4211bb9 fix upload when dest not specified 2017-02-14 22:08:49 -05:00
Brent Cook b741c8b2f7 fix typo in failure path, pointed out by rw- 2017-02-13 21:16:48 -06:00
Brent Cook 74e029f3b1
Land #7932, Fix CVE-2017-5229 2017-02-07 19:22:36 -06:00
Brent Cook 522c6dce8e
Land #7931, Fix CVE-2017-5231 and respect user's dest 2017-02-07 19:22:17 -06:00
Brent Cook 68a5d300fe minor style issues 2017-02-07 18:35:35 -06:00
Brent Cook b370dd0654 Fix CVE-2017-5229 - extapi Clipboard.parse_dump() Directory Traversal 2017-02-07 18:24:06 -06:00
Justin Steven 56cf6b129d
Fix CVE-2017-5228 2017-02-07 23:44:23 +10:00
Justin Steven cb74d3b05b
Fix CVE-2017-5231 and respect user's dest 2017-02-07 23:41:59 +10:00
Artem 9db2cdb33a Fix close session
Fix close session if remote file is permission deined
2017-02-05 02:00:05 +03:00
Pearce Barry 23c2787d57
Land #7795, Hardware Bridge API.
Initial bridge API that supports the HW rest protocol.
2017-02-02 08:47:59 -06:00
Pearce Barry 16de745437
Minor code cleanups/corrections. 2017-02-01 16:12:45 -06:00
Craig Smith 2ff4e6f57e Fixed defaults for elm327 realy.
Array2Hex in the automotive extension how supports passing an array or integers or string hexes
Added some extra error handling for UDS calls to non-supported pids
2017-01-25 11:30:29 -08:00
OJ a3cf400566
Re-set the TLV names for migration stuff 2017-01-24 07:36:56 +10:00
Jeffrey Martin 2c8cd80a2b
revert change to TLV_TYPE_MIGRATE_LEN in #7856 2017-01-23 09:23:32 -06:00
Jeffrey Martin 677d070179 make tlv enum of migrate length consistent 2017-01-23 09:19:53 -06:00
Craig Smith 198d6e00ff Fixed bug in array2hex that did not convert hex values to integers before formatting 2017-01-22 17:50:33 -08:00
Brent Cook f61314d2d6
Land #7856, Fix incorrect translations in TLV inspection code 2017-01-22 11:08:05 -06:00
Brent Cook f69b4a330e handle Ruby 2.4 Fixnum/Bignum -> Integer deprecations 2017-01-22 10:20:03 -06:00
Brent Cook 441222c2b5 Merge remote-tracking branch 'upstream/master' into land-7787- 2017-01-22 09:44:11 -06:00
William Vu e0094897a1 Add CSV and vCard support to dump_contacts 2017-01-20 19:18:50 -06:00
OJ 7e50ce09c0
Fix TLV inspect issue 2017-01-21 09:17:20 +10:00
Brent Cook 5b2e76b981
Land #7794, Fix #7793, incorrect command name in android meterpreter extension 2017-01-11 12:38:36 -06:00
Craig Smith 5f07bca775 Hardware Bridge API. Initial bridge API that supports the HW rest protocol specified here:
http://opengarages.org/hwbridge  Supports an automotive extension with UDS calls for mdoule
development.
2017-01-06 19:51:41 -08:00
Ubuntu 6dee63d727 Incorrect command name 2017-01-06 23:58:18 +00:00
Tim eec5e88e1c
android_wakelock 2017-01-05 19:17:28 +07:00
Brent Cook 5a4abeb110 make Rex UDPSocket.send work just like the real thing 2017-01-02 09:38:26 -06:00
Brent Cook d5bc6a089f recvfrom_nonblock need flag = 0, not nil 2017-01-02 08:55:12 -06:00
Brent Cook bb684bb3b1 tcp channel fixes 2016-12-30 14:59:10 -06:00
OJ 99da91e278
Adjust golden ticket creation to force params when SYSTEM 2016-12-23 20:29:00 +10:00
OJ 894ed4957f
Add help where appropriate 2016-12-23 10:51:33 +10:00
OJ 93a280dfc1
Merge upstream/master ready for PR 2016-12-23 10:20:53 +10:00
OJ 34e3a17fda
Remove unused Kiwi TLVs 2016-12-23 09:57:57 +10:00
William Webb 5702bd6745
Land #7674, Move migration stub generation code into msf 2016-12-22 17:53:00 -06:00
OJ 4c150a10c2
Update to use new base64 flags for kiwi 2016-12-23 09:40:11 +10:00
OJ c97e6ae1e8
Handle stupid merge from OJ's upstream 2016-12-23 09:00:27 +10:00
OJ e6e2388256
SSP creds and golden tickets 2016-12-23 08:34:16 +10:00
OJ 0bca485858
Continue work on enabling kiwi functionality 2016-12-20 18:25:48 +10:00
OJ ee4caba646
Remove `terminal` and tweak `sessions`
Hopefully everyone is now happy!
2016-12-20 07:50:07 +10:00
OJ 74040c4ee6
Rename the `sess` command to `terminal`
Lots of people have been frustrated by the `sess` command as it mucks
with the autocomplete for `sessions`. This is a fair concern, especially
given that `sess` was intended to be a non-annoying shortcut.

This commit changes the `sess` command so that it is instead called
`terminal`. I couldn't think of a better option that didn't already
clash with another name or meaning. At least `terminal` is something
that doesn't clash, doesn't muck with any existin autocomplete rules,
and is in some way another name for the existing sessions.

Feedback appreciated!
2016-12-19 17:05:04 +10:00
OJ 609c8da772
Re-add wifi support, start work on kerberos stuff 2016-12-10 11:20:16 +10:00
Artem 9a7c0eb7b6 Fix cloe file 2016-12-08 21:28:39 +03:00
OJ d0696a09ad
Move migration stub generation into MSF
This code adds support for transport-specific migration stubs to be
generated in MSF rather than having them hard-coded in Meterpreter.
2016-12-08 16:01:13 +10:00
OJ 50b0c9ef5e
Add tspkg support and fix parsing a little 2016-12-07 15:06:08 +10:00
OJ 7d316cb3e6
Begin work on parsing mimikatz output and handling more cmds 2016-12-07 15:06:08 +10:00
OJ 8f4621f424
Initial work to support the new kiwi extension 2016-12-07 15:05:02 +10:00
Brent Cook b4a2a6ed60 Merge remote-tracking branch 'upstream/master' into land-7625- 2016-12-06 06:23:32 -06:00
Tim 8f3fab4b1b
fix sleep and transport on android 2016-11-30 21:59:01 +08:00
Tim 468bf4696f
stdapi_fs_file_copy 2016-11-29 13:56:27 +08:00
Brent Cook 16b5f40dae Revert "Rework XOR code to make more sense"
This reverts commit 699a8e91d2.
2016-11-20 19:09:45 -06:00
Brent Cook f313389be4 Merge remote-tracking branch 'upstream/master' into land-7507-uuid-arch 2016-11-20 19:08:56 -06:00
Brent Cook 5490fda0ae Merge remote-tracking branch 'upstream/master' into land-7261 2016-11-14 16:49:28 -06:00
Brent Cook 98a54cd458 Merge branch 'upstream-master' into land-7456-android-hide-app 2016-11-14 02:43:04 -06:00
OJ 7773d90da4
Update railgun to use arch to check for 64 bit 2016-10-29 14:26:06 +10:00
OJ 57eabda5dc
Merge upstream/master 2016-10-29 13:54:31 +10:00
OJ 8b97183924
Update UUID to match detected platform, fail exploit on invalid session 2016-10-29 13:45:28 +10:00
OJ bf7e7ae4be
Fix silly mistake with resetting arch in sysinfo 2016-10-29 08:32:32 +10:00
OJ d201c5bccc
Force x86_64 to change over to x64 in sysinfo, tidy arch checks 2016-10-29 06:49:35 +10:00
OJ 1d617ae389
Implement first pass of architecture/platform refactor 2016-10-28 07:16:05 +10:00
nixawk 66a1b57c17 delete lib/rex/post/gen.pl 2016-10-24 08:53:45 -05:00
OJ 786600bd09
Remove the unused binary_suffix var 2016-10-18 16:15:00 +10:00
Tim 67d07a715c
add android_hide_app_icon 2016-10-17 19:02:48 +08:00
Tim 5fad8d8efa
prefix android commands with android_ 2016-10-15 23:57:20 +08:00
OJ 022830634b
Rejig platform to use windows instead of win32/win64 2016-10-14 10:10:04 +10:00
Brent Cook 0d5a23b865 Merge branch 'master' into land-7423-localtime 2016-10-10 23:54:38 -05:00
OJ 699a8e91d2
Rework XOR code to make more sense 2016-10-10 13:38:08 +10:00
OJ e139a1ee8f
Land #7383: Rebase/Fix + SSL stager support for python 2016-10-10 13:06:09 +10:00
William Vu a89607bbdb Prefer keyword argument 2016-10-04 23:14:14 -05:00
Brent Cook b7ea465855 refresh sysinfo when explicitly requested on a session 2016-10-04 22:06:06 -05:00
OJ a4efa77878
Support driver list, adjust capcom exploit
This commit adds MSF-side support for listing currently loaded drivers
on the machine that Meterpreter is running on. It doesn't add a UI-level
command at this point, as I didn't see the need for it. It is, however,
possible to enumerate drivers on the target using the client API.

Also, the capcom exploit is updated so that it no longer checks for the
existence of the capcom.sys file in a fixed location on disk. Instead,
it enumerates the currently loaded drivers using the new driver listing
function, and if found it checks to make sure the MD5 of the target file
is the same as the one that is expected. The has is used instead of file
version information because the capcom driver doesn't have any version
information in it.
2016-10-04 11:27:20 +10:00
OJ 3469104f7a
Add localtime command support 2016-10-03 15:18:37 +10:00
William Vu 039357a714
Land #7387, checksum command for Meterpreter 2016-10-02 21:35:34 -05:00
Spencer McIntyre 8e09b172f6 Add a meterpreter checksum command 2016-10-01 14:29:35 -04:00
Brent Cook 6241e48b34
Land #7350, add 'sess' command for direct session switching support 2016-09-29 23:18:53 -05:00
Brent Cook 49ed02a203 fix packet parsing when there is partial data 2016-09-29 17:21:59 -05:00
OJ af4b1cf48f
Add the `sess` command to MSF and Meterp shells
This new command is a simpler shortcut that allows for moving around sessions much faster from within the console.

* From inside MSF, `sess <id>` is shorthand for `sessions -i <id>`
* From inside Meterp, `sess <id>` is shorthand for `background; sessions -i <id>`

In the latter case, if the session being switched to is the same id, then no swiching happens.
2016-09-22 16:09:59 +10:00
Brent Cook 52d0840a79
Land #7276, fix clipboard tlv usage 2016-09-22 00:47:18 -05:00
Brent Cook 022ab74f30
See #7089, add some stray fixups 2016-09-15 18:50:00 -05:00
Brent Cook 6686e91ffe
fixup some leftover debug and whitespace issues 2016-09-15 18:39:08 -05:00
Brent Cook 50fc3b10f8
Land #7086, Add 'continue' and 'tries' wget-like options to meterpreter 'download' 2016-09-15 17:48:21 -05:00
David Maloney 43942e6029 refactor pem parser to use the rex-socket gem version
use rex-socket's pem aprser instead of the old one we used
to have in rex::parser

MS-1715
2016-09-07 11:38:27 -05:00
OJ ab6ffcc725
Add tspkg support and fix parsing a little 2016-09-07 02:04:54 +10:00
OJ dd977c0c28
Begin work on parsing mimikatz output and handling more cmds 2016-09-07 01:41:35 +10:00
Tim f75b5569e5
fix android clipboard tlv usage 2016-09-05 17:24:32 +01:00
Danil Bazin bfabb3877c @void-in suggestions styles 2016-08-31 14:00:35 +02:00
Danil Bazin 39407dda95 Winpmem meterpreter extension 2016-08-31 11:46:15 +02:00
caye efdf7c4c00
Clipboard now sets 'recursive' download option in new way. Improved download_file compatibility 2016-08-27 01:44:04 +00:00
caye 3545c5f8db
Rebase after #7125. Changed tries to -l. Added 'opts' for all download options 2016-08-27 00:55:16 +00:00
David Maloney 95b82219a3
Land #7233, ssh over L# pivot
this lands egypt's fix for using Net::SSH over L# pivots
2016-08-23 14:12:54 -05:00
James Lee bcf0062d47
Make SocketInterface things be Rex::Sockets 2016-08-22 14:17:00 -05:00
William Vu 3d4d7aae14 Add ps -c to show child processes of current shell 2016-08-18 19:23:21 -05:00
David Maloney eb73a6914d
replace old rex::ui::text::table refs
everywhere we called the class we have now rewritten it
to use the new namespace

MS-1875
2016-08-10 13:30:09 -05:00
OJ f9a7d34089
Initial work to support the new kiwi extension 2016-08-02 19:12:24 +10:00
William Vu 4c12c2f6c5 Improve Meterpreter ps -A experience
This allows us to use "x64" instead of "x86_64" in ps -A.
2016-07-31 17:19:57 -07:00
Brent Cook 3987c2c0d8 cache sysinfo (we use it a lot, it will not change) 2016-07-27 08:49:19 -05:00
Brent Cook 9cb4880747 allow process architecture to be a string (allow more than x86) 2016-07-27 08:49:19 -05:00
William Vu bebff786b7 Add timestamping to downloaded files 2016-07-25 17:18:27 -05:00
David Maloney 01d0d1702b
Merge branch 'master' into feature/MS-1688/net-ssh-cleanup 2016-07-14 09:48:28 -05:00
caye ed8fec255e
Fixed dir download. Retry when no network even at the download start 2016-07-12 23:05:50 +00:00
caye a6e92034bf
Added glob to dir_files.entries search - thanks @OJ 2016-07-11 06:22:28 +00:00
caye 3c2f0e814e
'Continue' and 'tries' wget-like options for meterpreter 'download' 2016-07-10 16:24:36 +00:00
Adam Cammack 2f3f655352 Add gem for mettle
This adds the gem for the mettle binaries, which contains reflective
payloads for a variety of Linux architectures (and more OSs in the
future)
2016-07-05 11:24:54 -05:00
David Maloney 6072697126
continued 2016-06-22 14:54:00 -05:00
OJ 60f81a69ea Remove the pfservice close call on shutdown 2016-05-03 12:03:37 +10:00
OJ d136844d3b Add error handling around double-bind of ports 2016-05-03 10:42:41 +10:00
OJ c15a2e8787
Merge branch 'upstream/master' into reverse-port-forward
Signed-off-by: OJ <oj@buffered.io>
2016-04-26 09:48:40 +10:00
Brent Cook 12a47b7fab prefer && 2016-04-24 11:56:32 -04:00
Brent Cook 194a84c793 Modify stdapi so it also uses exist? over exists? for ruby parity
Also add an alias for backward compatibility.
2016-04-23 17:31:22 -04:00
William Vu 7f8491149f Fix minor whitespace issues 2016-04-22 17:18:10 -05:00
OJ 540409e735 Add `resolve` to the meterpreter command line
I'm aware that this already exists as a post module, but there's nothing more annoying than having to bail out of Meterpreter, use the right module, set up the host list, etc all to just fire off a one-liner.

So this commit adds the command directly to Meterpreter's command line so that you don't have to do all that. This doesn't support specifying a file with the hosts in it (the post module does that). This is intended for quick resolution of particular hosts quickly.
2016-04-22 13:21:19 +10:00
Brent Cook 57ab974737 File.exists? must die 2016-04-21 00:47:07 -04:00
OJ b95267997d Fix LURI support for stageless, transport add/change and code tidies 2016-04-18 08:24:41 -05:00
OJ 5c2e5398ad Fix issue with flushing rev port forwards 2016-04-11 10:41:12 +10:00
OJ 866cb5a23b Fix usage of lport/rport while tracking rev forwards 2016-04-06 16:36:41 +10:00
OJ 6d504316ae Add MSF-side support for reverse port forwards
This includes changes to the portfwd command so that the output is
nicer, things are easier to use, and users have the ability to create
reverse port forwards.
2016-04-06 15:38:39 +10:00
Brent Cook 3d995546d9 check for true before empty string 2016-04-01 21:30:11 -05:00
OJ 2a9f813bcd Don't interpreter blank string as error 2016-04-01 09:53:25 +10:00
OJ 9f299f4f0c
Merge branch 'upstream/master' into powershell-meterpreter-bindings 2016-04-01 09:32:32 +10:00
James Lee 9d86a49c51
Land #6692, udp socket abstraction 2016-03-25 13:05:10 -05:00
Brent Cook 242ea8d9cd Merge branch 'master' into land-6691- 2016-03-24 22:19:57 -05:00
OJ ce8a6f57a0 Added powershell_import support 2016-03-25 12:17:03 +10:00
James Lee dfa518b492
Whitespace 2016-03-24 15:21:03 -05:00
James Lee 0073a8f40e
Wrap comments at 78, style 2016-03-24 15:20:43 -05:00
James Lee 6388578ee6
Style fixes 2016-03-23 16:15:46 -05:00
James Lee 98355c397c
Clean up some variable names 2016-03-23 15:07:00 -05:00
James Lee 685d8fc588
Use 2.x symbol literal syntax 2016-03-23 15:06:35 -05:00
James Lee effee42e2f
Raise a better exception for WSAEADDRINUSE 2016-03-23 13:15:38 -05:00
RageLtMan c871ceea0a Implement consistent socket abstraction
In current nomenclature, Rex Sockets are objects created by calls
to Rex::Socket::<Transport>.create and Rex::Socket.create_...
When the LocalHost or Comm parameters are set to remotely routed
addresses (currently via Meterpreter sessions), Rex will create a
Channel which will abstract communications with the remote end of
the session. These channel based abstractions are called pivots,
and present in three separate flavors:
1 - TcpClientChannel, a fully abstracted, selectable Socket.
2 - TcpServerChannel, a virtual Channel which distributes client
channels.
3 - UdpChannel, a virtual Channel which provides common methods for
UDP socket operations, but is not a full (selectable) abstraction.

Unfortunately this differentiation results in inconsistent returns
from the aforementioned socket creation calls, as the call chain
creates parameters and supplies them to the create method on the
comm object referenced in the params. The comm object may be a
channel, and produce a virtual representation of a socket with
functional methods analogous to Sockets, but without a kernel FD.

This commit begins the work of ensuring that all calls for socket
creation return selectable Rex::Socket objects with semantics
familiar to Ruby developers who have not read into the details of
Rex::Socket and Rex::Post.

-----

Summary of changes:

Convert Rex::IO::StreamAbstraction to SocketAbstraction and use
the new mixin in StreamAbstraction and DatagramAbstraction. This
approach allows for common methods to reuse the abstraction data
flow, while initializing separate types of socket obects and an
optional monitor as needed.

In the Rex::Post::Meterpreter namespace, extract common methods
from Stream to a SocketAbstraction mixin, include that mixin in
Stream, and add Datagram with the dio_write handler override
exported from the current implementation of UdpChannel, also using
the mixin. This relies on the Rex::IO work above to implement the
proper type of socket abstraction to the Channel descendants.

In Rex::Post::Meterpreter::Extensions::Stdapi::Net, convert the
UdpChannel to inherit from the Rex::Post::Meterpreter::Datagram
class, implementing only the send method at this tier. Convert
create_udp_channel to return the local socket side of the datagram
abstraction presented analogous to the TcpClientChannel approach
used before.

-----

Notes and intricacies:

In order to implement recvfrom on the UDP abstraction, a shim layer
has been put in place to forward the sockaddr information from the
remote peer to the local UDP socketpair in the abstraction. This
information takes up buffer space in the UDP socket, and in order
to maintain compatibility with consumers, the dio_write_handler
pushes the data buffer, and in a separate send call, he sockaddr
information from the remote socket. On the abstraction side, the
recvfrom_nonblock call of the real UDPSocket has been overriden
via the mixed in module to call the real method twice, once for
the data buffer, and once for the packed sockaddr data. The Rex
level consumer for recvfrom calls the underlying nonblock method
and expects this exact set of returns (as opposed to what standard
library UDPSocket.recvfrom returns, which is a data buffer and an
Array of sockaddr data).

-----

Testing:
  Local and lab testing only so far.
  Test RC script to be added in GH comments.

-----

Issues:
  Currently, sendto on a remote socket does not appear to honor
LocalPort which causes DNS responses (#6611) to come from the
wrong port to remote clients being serviced over a pivot socket.
2016-03-21 03:32:52 -04:00
OJ 80e0bbeb68 Add the interactive shell prompt with sessions 2016-03-21 15:44:20 +10:00
Brent Cook df2d0f7826 Indicate that output options take parameters 2016-03-17 11:13:34 -05:00
Brent Cook 257c8f4058 handle a sqlite table being empty 2016-03-15 18:26:38 -05:00
OJ d8c850aaf0 Add support for the execution of single powershell commands 2016-03-14 17:13:12 +10:00
OJ f8f61e8d83 Basic shell of the MSF Powershell extension functionality 2016-03-14 12:55:58 +10:00
Tim dfd51a7032 Merge branch 'master' into android_sqlite_read 2016-03-10 01:46:30 +00:00
Tim 5e83b2de51
remove extra new line 2016-03-07 23:17:45 +00:00
Tim f6c06bedfe
fix e.g output 2016-03-07 23:15:05 +00:00
William Vu 3e0f8d67c9 Use #strip to more correctly simulate #blank?
See f900d9cf26.
2016-03-07 13:14:37 -06:00
Brent Cook 289f43bb80
Land #4848, remove some reliance on rails libraries from rex 2016-03-07 07:38:30 -06:00
Brent Cook a1190f4344
Land #6598, add post module for setting wallpaper 2016-03-06 15:00:10 -06:00
Brent Cook dcba20ff60 only cleanup processes once too 2016-03-04 12:08:19 -06:00
Tim 2cfc9073a0 fixup sqlite_query 2016-03-04 11:56:37 +00:00
Tim b7fe500788 sqlite_read -> sqlite_query 2016-03-04 11:56:23 +00:00
Brent Cook c250740a81 Fixup finalizers to not double-close Meterpreter objects
We add finalizers to an assortment of Meterpreter-managed objects in order to
clean things up in the event that a post module crashes and does not clean
things up. However, this also means that even a properly-written post module
can lead to an object getting double-closed on the Meterpreter session when the
garbage collector kicks in. This can lead to quite non-deterministic behavior
and crashes.

This change modifies the instance close methods to unregister the finalizer on
close, ensuring we cannot do a double-close automatically if one is requested
explicitly first. As an additional measure, we check an instance variable to
see if we called close directly twice as well. This is not sufficient in
itself, since we do not have a reference to 'self' in the finalizer proc to
check the close state.

This also removes a couple of references to 'self' in the finalizer proc
itself, which may cure some memory leaks as well due to circular references.
2016-03-02 21:43:51 -06:00
Tim afc6f6ff74 fix options 2016-02-29 15:21:33 +00:00
Tim bd6fdbb545 android sqlite_read command 2016-02-29 15:05:57 +00:00
Brent Cook 5899b8afc8 make help show up when things are not specified correctly 2016-02-26 06:09:05 -06:00
HD Moore 9010dac7bc Wrap up the current WIP, still not functional 2016-02-26 05:36:40 +00:00
HD Moore 5bf308e720 WIP checkin 2016-02-26 05:36:40 +00:00
Tim cef1b77e26 fixes for android set_audio_mode 2016-02-20 12:01:10 +00:00
Artem c5469be59e Add Android ringer change mode command 2016-02-15 15:07:48 -06:00
Brent Cook 2fddf333ed add TLV entry 2016-02-15 15:04:15 -06:00
Artem 59bf850bb0 Update android.rb
Add request for Ringer Mode Changer
2016-02-15 14:59:15 -06:00
Brent Cook db19a7d9b3 Merge branch 'upstream-master' 2016-02-10 23:15:21 -06:00
OJ 44eb2d6a80
Merge branch 'upstream/master' into default-xor 2016-02-11 14:30:18 +10:00
Tim d544bf9311 android set wallpaper 2016-02-01 01:16:17 +00:00
Tim 4d6791d432 fix returning of error 2016-01-31 15:13:21 +00:00
OJ 3acb5d270b Add `dir` as an alias for `ls` 2016-01-27 12:21:15 +10:00
OJ 0134161c1b Fix another typo 2016-01-25 22:15:13 +10:00
OJ 6c2391ed0d Fix typo in random xor key generator 2016-01-19 15:37:10 +10:00
OJ 18fe9bd96f
Merge branch 'upstream/master' into default-xor 2016-01-13 10:05:59 +10:00
Tim c76389629a receive startActivity result 2016-01-12 07:49:37 +00:00
Tim f48e4363f5 activity_start 2016-01-12 07:22:55 +00:00
Brent Cook eec6a6f905
Land #6304, simplify Meterpreter livelness checks 2015-12-24 15:42:17 -06:00
Brent Cook 9c410e02e3 Merge branch 'master' into land-6111-android 2015-12-24 10:13:25 -06:00
Brent Cook 3f4c6eb370
Land #5383, allow tunneling reverse_tcp meterpreter sessions without 'route add' 2015-12-22 15:42:42 -06:00
OJ c747ffc05a Implement support for TLV packet XORing, and RECV removal 2015-12-08 16:37:10 +10:00
Jon Hart 06836d9b8a
Better handling of invalid process name/IDs 2015-12-04 14:25:57 -08:00
Jon Hart 3ecac615a2
Support migrating to processes by process name
Fixes #6313
2015-12-04 13:33:01 -08:00
James Lee 762fdbed40
Simplify meterpreter liveness check 2015-12-03 09:16:18 -06:00
James Lee 6fa2269764
PacketResponseWaiter - improve yardoc coverage 2015-12-03 09:16:17 -06:00
HD Moore b9e176cd77 Fix up cell result parsing 2015-11-21 11:15:00 -06:00
Jon Cave c03ff13377 Don't wait if the response has already been set
Fixes a race condition which could leave the waiter sitting indefinitely
if notify() is called before wait().
2015-11-21 14:21:42 +00:00
Jon Cave 12b24fecee Return true/false if a waiter was/wasn't notified
The method is used as follows:

  if notify_response_waiter(response)
    # Proceed as if a waiter was notified
  end

Previously the return value would be `nil` whenever the loop broke early
due to a waiter being found. This meant that the dispatcher thread often
believed that a packet was not being handled. As a result the
backlog == incomplete sleep kicked in unnecessarily.
2015-11-21 14:20:51 +00:00
Jon Cave 6509696eb1 Switch back to Mutex/CV for response waiters
Makes use of the wait() method's timeout parameter instead of using the
Timeout class.
2015-11-21 14:20:51 +00:00
Jon Cave 640a302b78 Switch to a Queue for the dispatcher's packet queue
The select() based sleep can be replaced by a blocking pop(). The thread
will be suspended until data is pushed onto the queue.
2015-11-21 14:20:51 +00:00
HD Moore 99a74fd4d2 Merge branch 'master' into feature/interval-collect-geo 2015-11-20 14:06:22 -06:00
wchen-r7 038d367d58 Fix #6247, Update Meterpreter Usage on "Interact"
The "interact" command does not actually exist. Instead, users
should do "channel -i" to interact with a channel.

Fix #6247
2015-11-16 17:58:39 -06:00
HD Moore 07b34e8906 Missing types and parsing, more work left to go 2015-11-03 00:23:29 -06:00
James Lee 2e837b26e8
Use a Queue instead of Array 2015-11-02 16:02:45 -06:00
Brent Cook 7f19d95ad8
Land #6146, add show_mount command (initially for windows meterpreter sessions) 2015-10-30 17:37:30 -05:00
Brent Cook cb403b8a36
Land #6077, initial python meterpreter module support 2015-10-30 17:29:05 -05:00
OJ c5643e52ff Add support for the show_mount command (windows) 2015-10-29 07:28:33 +10:00
HD Moore 4bc2437e0b Temporary hack to test 2015-10-22 20:00:47 -05:00
jvazquez-r7 d5a010c230
Add support for registry_key_exist? 2015-10-22 16:07:38 -05:00
HD Moore ba14d6e77f Add support for the TBD interval geo collection on Android 2015-10-20 15:39:51 -05:00
Brent Cook 4b271425c9 s/datstore/datastore/g 2015-10-20 13:05:49 -05:00
OJ 9adb2ee267 Fix silly typo 2015-10-12 14:58:30 +10:00
OJ dbfee51ad3 Add support for folder importing 2015-10-12 11:52:55 +10:00
James Lee 0132f9ce67
Extend accepted clients with Rex Socket stuff 2015-10-09 08:53:02 -05:00
OJ 6849adad58 Adjusted to include import 2015-10-07 23:36:24 +10:00
OJ 8861d61ad4 Add stderr/stdout capture and var extraction 2015-10-01 08:17:17 +10:00
OJ fb0d766958 First pass of the python extension for windows meterpreter
This includes the basic construct for the python extension, and allows
for single-shot commands to be run.
2015-09-29 20:48:29 +10:00
Brent Cook f3451eef75
Land #5380, pageantjacker, an SSH agent proxy 2015-09-26 10:52:44 -04:00
Brent Cook d9a76bbe0a
Land #5911, add adsi enumerate to a file via -o 2015-09-23 21:40:01 -05:00
Stuart 853d822992 Merge pull request #1 from bcook-r7/land-5380-pageantjacker
update pageantjacker to run as part of extapi
2015-09-23 09:45:53 +01:00
Stuart Morgan cdd39f52b1 Merge branch 'master' of https://github.com/rapid7/metasploit-framework into pageant_extension 2015-09-21 14:34:56 +02:00
Stuart Morgan e8e4f66aaa Merge branch 'master' of ssh://github.com/stufus/metasploit-framework into pageant_extension 2015-09-21 14:34:38 +02:00
Brent Cook 61e7e1d094 update pageantjacker to run as part of extapi 2015-09-20 20:25:00 -05:00
HD Moore 24dd454127
Land #5912, adds timeout option to migrate 2015-09-02 13:08:22 -05:00
HD Moore 54f79e72bb Initialize writable_dir in the main block 2015-09-02 13:08:07 -05:00
OJ cefb7c83f3 Fix call to migrate 2015-09-02 15:37:34 +10:00
OJ 0d2df33900 Fix two typos, add help detail 2015-09-02 09:35:51 +10:00
Joshua Smith 21ab4531d2
Land #5910, move help fxn for ps 2015-09-01 14:23:25 -05:00
Brent Cook b8458d6ec7
Land #5705, allow removing transports by index 2015-09-01 14:08:48 -05:00
Brent Cook b273893947 use URI.parse over a custom regex 2015-09-01 14:07:05 -05:00
OJ 299ceb7087 Add timeout option for migration
This commit changes the migrate function so that an optional timeout parameter can be given. This means that people in high-latency scenarios can extend the timeout when migration in order to increase the chances that things will work.
2015-09-01 22:53:30 +10:00
OJ 696bc95838 Merge branch 'upstream/master' into adsi-file-output 2015-09-01 17:25:13 +10:00
OJ ef73f56201 Add -o parameter to adsi query functions
This allows for the output of the query to be written to a file.
2015-09-01 17:03:41 +10:00
OJ abfeb204b3 Move help functionality for ps command 2015-09-01 16:45:35 +10:00
HD Moore ff6fbfa738
Land #5895, rework of ADSI modules 2015-08-31 14:10:41 -07:00
Brent Cook 30830ad9e5
Land #5262, fix webcam_chat and tidy adjacent code 2015-08-31 14:21:24 -05:00
Brent Cook fe69fc84de expand the path environment variables before executing 2015-08-31 13:38:08 -05:00
Stuart Morgan 3a5ce02e8e Changed the other print\n lines to print_line() for consistency 2015-08-28 14:05:44 +01:00
Stuart Morgan 266a6e7dc4 Changed to print_line() at the request of hdm 2015-08-28 11:35:51 +01:00
Stuart Morgan 5cdf1aeef4 Added examples to the usage-help and run through msftidy 2015-08-26 19:33:09 +01:00
Stuart Morgan 4bac21b7b9 Added command to list the domain controllers
Also added more information relating to the computers from LDAP
2015-08-26 15:33:54 +01:00
Stuart Morgan 59cf75c5a8 Updated description to make it more obvious & added specific DC enumeration 2015-08-26 15:03:28 +01:00
Stuart Morgan 7cee4d0ad1 Added the following commands:
adsi_group_enum - Lists all groups on the specified domain
 adsi_nested_group_user_enum - Lists all users on the specified domain who are members of a given group DN (taking into account recursive/nested groups)
2015-08-26 14:14:15 +01:00
Brent Cook 6c89d0997c
Land #5855, android offline collection support 2015-08-25 17:44:51 -05:00
Mo Sadek 1181600a69
Land #5575, interactive channel logging 2015-08-25 16:23:51 -05:00
Brent Cook 54dcd312f6 more style issues resolved 2015-08-24 18:07:31 -05:00
Brent Cook 90a46fbcd0 update style issues 2015-08-24 17:58:24 -05:00
Brent Cook 573f2b51a5 fix some crashes running webcam commands on webcamless machines 2015-08-24 16:51:43 -05:00
Brent Cook dfd00ad50b prefer catching RuntimeError 2015-08-24 16:42:33 -05:00
Brent Cook 6977a12dd8 whitespace fixups 2015-08-24 16:39:17 -05:00
Brent Cook f96236d61f remove redundant to_s and RuntimeError 2015-08-24 16:21:34 -05:00
Brent Cook 4e8cc47299 remove superfluous SYSTEMDRIVE path 2015-08-24 16:19:16 -05:00
OJ 5b173319f2 Fix up level rendering 2015-08-19 00:22:26 +10:00
OJ 884760f11d Update the output format for the Wifi collection 2015-08-18 17:27:48 +10:00
OJ 241593117b First pass of the android interval collection 2015-08-18 00:53:25 +10:00
Brent Cook 5dd015150c
Land #5748, refactor google geolocate, add wlan_geolocate and send_sms to android meterpreter 2015-08-16 10:58:17 -05:00
Brent Cook 422bba87d3 style fixes, moved google_geolocate to google/geolocate 2015-08-15 19:49:32 -05:00
Brent Cook f4031d87fc light ruby style cleanups 2015-08-14 17:26:05 -05:00
Stuart Morgan 3aa1f93196 Fixed string->uint 2015-08-14 17:45:47 +01:00
Stuart Morgan 02a58d459b Merge remote-tracking branch 'upstream/master' into pageant_extension 2015-08-14 17:05:38 +01:00
Brent Cook 226516ef20 restore PPID to the meterpreter process list table
This restores pre-66bd881ac5a6de636c2eea7528946bc2d3abd52c behavior, but merges
the current search and output fixups currently in the tree.
2015-07-25 18:10:10 -05:00
Jack64 981d98443f fix local mods
Fixed some local modifications that were unintentionally pushed.
2015-07-23 17:04:12 +01:00
Jack64 31dcae6828 bug fixes 2015-07-23 16:58:55 +01:00
Brent Cook 264bc0f921
Land #5726, support multiple glob patterns with search 2015-07-22 17:58:33 -05:00
William Vu a52bf4526d Use uniq on the globs array
This avoids search repetition.
2015-07-22 14:25:49 -05:00
OJ 121fe1adda
Land #5654 : Python Meterpreter Transport 2015-07-22 10:39:06 +10:00
Jack64 0771d5ec39 minor fixes 2015-07-20 01:22:45 +01:00
Jack64 97f4ec72f9 minor fixes 2015-07-20 01:20:36 +01:00
Jack64 ad86a72918 send_sms + wlan_geolocate 2015-07-20 01:16:58 +01:00
William Vu 6685fc479b Add multi-glob filesystem search to Meterpreter 2015-07-14 20:23:23 +00:00
rwhitcroft 0a581be9f9 put -u back for removing transports 2015-07-13 12:10:32 -04:00
OJ 4fc258ec0c Remove duplicate entries, allow for output to file
This commit does a few tidies of code, as well as adds the ability to
write all the kiwi output to disk as well as to the console. We can't
yet add this stuff to the credential DB because it's tied to machine,
where the creds that come out of kiwi are often tied to domains.

This also removes duplicate creds from the output list, and gets rid of
the auth id stuff from the output too (not sure why it was useful
before).
2015-07-13 14:17:31 +10:00
rwhitcroft eaa0d0a44e first msg was better 2015-07-11 22:50:38 -04:00
rwhitcroft 508c9f55df specify transports by index 2015-07-11 22:22:50 -04:00
Joshua Smith 5be94c12b6
Land #5602, adds irb -e to core 2015-07-02 16:21:20 -05:00
Joshua Smith 434cffa258 clean up so idiomatic ruby details 2015-07-02 16:16:57 -05:00