51ff09a9b6
Only try on NX
2018-07-28 19:00:33 -05:00
0a6a91a1c6
Initial add of pybash option
2018-07-26 14:44:34 -05:00
3f8906596d
Fix issue 10372, match mutiple slashes better
2018-07-26 05:35:04 -04:00
63ed4b2173
Add uictl tabs
2018-07-26 05:33:40 -04:00
2dbbd0c649
Add multiple commands' tabs and help
2018-07-26 05:32:57 -04:00
4060492bfc
Add multiple commands' tabs and help
2018-07-26 05:27:47 -04:00
3852265d9f
Add multiple commands' tabs and help
2018-07-26 05:26:30 -04:00
6c1a28d2d6
Add multiple commands' tabs and help
2018-07-26 05:25:38 -04:00
6a0534de14
Update splitkey method to match better on windows
2018-07-26 05:23:27 -04:00
746b63f76a
Add method to glob the given filename.
2018-07-26 05:21:12 -04:00
ef264e78f0
Refactor grep command to use optparse
...
This is an experiment to see what it would take to convert *all* option
assignment, parsing, and validation to use Ruby's builtin optparse. Our
current situation in the command dispatchers is a mishmash of bespoke
and Rex code, both with odd behaviors. Modules use a more formalized
system, but it is also a bit janky and unlike most other tools a
pentester might use.
The first step is to refactor the console commands to use Ruby's builtin
option parsing to reduce code and increase homogeneity among the various
functions. Next we plan to explore what it would take to invoke modules
from within Metasploit this way (this would be Metasploit 5+ only).
Refactoring `grep` seems to have been a success. There is now less code;
the code that declares and handles the options are now in the same
place; long options are now supported; adjacent, argument-less short
opts now work as expected; patterns can now begin with a `-`; and option
arguments are now validated. Additionally, optparse's argument
coercion/validation code can be extended for custom types/validations to
support more specialized commands.
2018-07-19 12:11:09 -05:00
d5ed70417b
bind_named_pipe payload for ruby_smb
2018-07-17 17:46:10 -06:00
29f05339a9
Clean up code
2018-07-17 14:33:10 -05:00
00a748a92c
Add tab_complete_directory
2018-07-17 06:29:12 -04:00
71e25f1494
show error if server.pid == pid
...
This PR adds changes to catch error when `server.pid` and `pid` are the same
2018-07-14 16:32:38 +05:30
ef55803936
[+] Update resource meta command help info
...
Signed-off-by: WangYihang <wangyihanger@gmail.com>
2018-07-11 13:07:15 +08:00
85bfca95fd
[+] Fixed meterpreter resource bug
2018-07-09 11:27:30 +08:00
ef78d70a00
Land #9356 . Remove ring buffers from command dispatcher.
2018-07-06 13:12:13 -05:00
0b9bc8c24a
Land #10241 , don't call print_error from rex context, use elog instead
2018-07-05 17:28:10 -05:00
7dc87e1a9e
Increase read depth for smb pipes
2018-07-03 16:06:42 -05:00
af43b6ca17
don't call print_error from rex context, use elog instead
2018-07-02 15:19:19 -05:00
85dc81a58b
Land #10185 , add SMBv1/2 support in psexec
2018-06-29 17:49:27 -05:00
3b228b0abd
avoid stack overflow on too many empty pipe reads in a row
2018-06-29 17:48:39 -05:00
a8c6835c64
Handle STATUS_PIPE_EMPTY error
2018-06-28 12:15:43 -05:00
2792d5fb27
call delete implementation from ruby_smb
2018-06-28 12:15:43 -05:00
c06f13b33e
remove superfluous sleeps, simplify logic
2018-06-28 12:15:42 -05:00
4b767efd6c
remove evasion logic from dcerpc read path
2018-06-28 12:15:42 -05:00
dbb0748c1c
Land #9998 , customizable golden ticket duration
2018-06-27 15:51:56 -05:00
2fd0d797ac
psexec smb2 support
2018-06-25 15:06:23 -05:00
bd77273dc0
Land #10155 , Improve #sec_to_s in Rex::ExtTime
2018-06-21 16:45:22 -05:00
e584732a11
Land #10151 , add robustness when stdapi is unavailable
2018-06-20 23:54:55 -05:00
df9ddebde6
Land #10124 , Add tab completion of values in `set` command
2018-06-14 16:16:24 -05:00
87b92316b5
Land #10162 , tab completion for audio output
2018-06-14 14:56:23 +08:00
c3c6bc19da
Land #10059 , CVE-2018-1111 exploit
2018-06-12 15:02:06 -05:00
fbf4b9fe87
Rework play command to support tab completion
2018-06-12 08:30:54 +00:00
2bdc8803cb
add zero seconds handling
2018-06-08 22:21:26 -04:00
679a225462
improve #sec_to_s method implementation
...
Using the following implementation yields roughly ~1.5x speedup in my tests.
2018-06-08 22:09:03 -04:00
514f991768
Fix bug when use command load and migrate
2018-06-08 04:06:38 -04:00
e9659adc6a
Fix audio_path display
2018-06-04 14:46:31 +08:00
4adea66318
Fix quote usage
2018-06-04 14:46:30 +08:00
4b2601bad3
Fix indentation and quote usage
2018-06-04 14:46:30 +08:00
f31676074a
Print usage if audio_path is nil
2018-06-04 14:46:30 +08:00
ff1d579c6a
Cleanup module
2018-06-04 14:46:30 +08:00
a5949f574e
Implement AudioOutput API
2018-06-04 14:46:30 +08:00
cfb3c4d3ad
Ignore case when use tab to complete
2018-06-01 07:37:23 -04:00
829e1c306a
Land #10102 , SOCKS5 updates for BIND, parsing specs, refactoring
2018-05-30 16:15:53 -05:00
da2666581b
Alter the socks5 bind request handling
2018-05-26 19:51:14 -04:00
c85cc9ad9e
Refactor SOCKS5 TcpRelay and add packet tests
2018-05-26 13:46:00 -04:00
a21cc9c5bc
Refactor core dispatch methods and error handling
2018-05-25 20:14:03 -04:00
49341fc87d
Add credential authentication support to socks5
2018-05-25 20:14:03 -04:00
9b5ae34896
Drop udp associate support and cleanup logging
2018-05-25 20:14:03 -04:00
1de5a464e7
Fix reply status codes and domainname addresses
2018-05-25 20:14:03 -04:00
6859856101
Refactor the socks5 code into multiple files
2018-05-25 20:14:03 -04:00
7f9fe971cb
Add initial udp associate support
2018-05-25 20:14:03 -04:00
04bec0bdf0
Progress on the socks5 proxy module
2018-05-25 20:14:02 -04:00
6fa0831bcb
Start the socks5 backend
2018-05-25 20:14:02 -04:00
6f1e75e097
Remove loopback restriction
...
It's occasionally useful, and we already warn when setting it.
2018-05-24 15:44:32 -05:00
da3df23f03
Fix Socket#getifaddrs with ::
...
Rex::Socket#getifaddrs doesn't exist.
2018-05-24 14:53:41 -05:00
86a5b951aa
Land #9990 , add SOCKS5 proxy support
2018-05-23 17:31:09 -05:00
8a72e7181a
Added username/password-based authentication
2018-05-22 20:42:23 -05:00
72efe66403
Refactored for better logging, IPv6 support, and prep for auth
2018-05-22 18:57:00 -05:00
cf8d0bd172
Remove unnecessary class declaration
2018-05-22 12:25:04 -04:00
f2549a1a83
Make domain name conditional
2018-05-19 09:53:06 -04:00
164f3ef48d
Add CVE-2018-1111 exploit
2018-05-18 12:47:08 -04:00
ac2f7b96f5
Added IPv6 support
2018-05-15 12:07:54 -05:00
3ce05e54c6
Added DNS resolution support
2018-05-14 10:55:53 -05:00
08b81a418f
Customization of Golden Ticket Duration
...
- Post exploitation module updated
- Kiwi extention updated
Using mimikatz /startoffset and /endin params
Duration in hours, default already 10 years
2018-05-09 17:44:55 +02:00
02849bcfd0
Land #9986 , initial ruby_smb simple client integration
2018-05-07 14:02:22 -05:00
d3e6e93d6a
the fastest code is that which does not exist
2018-05-07 10:13:38 -05:00
3e7e1e59df
style updates, expand constants
2018-05-07 00:24:38 -05:00
a9094d6b97
style updates
2018-05-07 00:24:38 -05:00
534d05ff44
simpleclient versions option
2018-05-07 00:24:38 -05:00
ff202a5f5b
Simpleclient/SMB2 support
2018-05-07 00:24:38 -05:00
d54992674f
Response code, Write fix
2018-05-07 00:24:38 -05:00
f2cf4fd1dc
remove case for open smb file packet field
2018-05-07 00:24:38 -05:00
960c733f16
Remove references to TreeId and FileID
2018-05-06 11:35:54 -05:00
5f7b050173
Get psexec and enumshares to stable state
2018-05-06 11:27:11 -05:00
e25a718861
Simplify
2018-05-06 11:27:11 -05:00
e9b78095be
Psexec works
2018-05-06 11:27:11 -05:00
a9019585fe
Replace simpleclient's client with ruby_smb client
2018-05-06 11:27:11 -05:00
2cd0d3d90a
Rudamentary SOCKS5 functionality, CONNECT, IPv4, non-DNS only
2018-05-04 14:44:03 -05:00
fcc38b75bf
style updates
2018-04-30 18:40:07 -05:00
1214f4d6c9
more optimizations
2018-04-30 18:25:25 -05:00
89ab409a1a
remove unnecessary object allocation and regex
...
The regex can be removed with the default split method. The val object
can be removed by adding to the secs object directly on the result of
the case statement.
2018-04-27 23:10:28 -04:00
2487314821
Land #9869 , Add support for shellcode encryption for msfvenom
2018-04-25 15:51:05 -05:00
2610757f27
Include the StreamServer interface for pivoting
2018-04-20 15:10:53 -04:00
3611a1dfe4
Update rex-text version
2018-04-18 10:40:11 -05:00
ff9c55207e
Move crypto methods to Rex::Crypto namespace
2018-04-17 20:12:26 -05:00
68ad91763a
Merge branch 'rapid7/master' into MS-3062_workspaces
2018-04-16 15:33:59 -05:00
b9d71b7147
Renamed 'mask' to 'glob'
2018-04-11 14:50:27 -05:00
21467d7938
Update stdapi/fs help output to match searching/masking parameters
2018-04-11 14:19:33 -05:00
e51f41fa34
Merge remote-tracking branch 'msf_jbarnett/fix_services_bugs' into MS-3062_workspaces
2018-04-10 13:35:33 -05:00
7a95024062
remove more ring operations
2018-04-06 13:49:16 -05:00
2ee7b1ec5c
Fix native 'readline' (msfconsole -L) support for Ruby 2.5 onward
2018-04-03 08:00:08 -05:00
bd3c00dfd0
Land #9726 , add simple Rex::Tar wrapper for consistency with other archive types
2018-04-02 23:35:22 -05:00
428233b82d
Land #7949 , Format binary registry data nicely on display
2018-04-02 23:11:25 -05:00
ecbbf1d940
Pass workspace when using db_nmap
2018-03-30 15:27:32 -05:00
f5025cb84e
Add Rex::Tar
...
This just inherits from Gem::Package::Tar{Reader,Writer} at the moment.
We may want to build out higher-level methods than what the inherited
code already provides. Or don't inherit at all.
2018-03-27 14:57:57 -05:00
1610db482a
minor style nits
2018-03-25 07:34:45 -05:00
7c5c5513eb
Merge remote-tracking branch 'upstream/master' into land-9586-
2018-03-25 07:29:55 -05:00
f662049b27
clarify screenshot on android scenario
2018-03-25 07:29:39 -05:00
7e0c255591
Formatted reg binary type to hex when displaying query results.
2018-03-23 15:56:12 -04:00
f09c5eafc7
Appease hound
2018-02-27 04:12:58 -06:00
46299dff00
The DRDOS mixin operates on strings, so make the bindata'd NTP classes cooperate
2018-02-27 04:12:57 -06:00
99965c142b
remove duplicate check
2018-02-20 04:42:49 -06:00
bb3a11dd20
use ctrl-d to cancel input instead
2018-02-20 04:40:00 -06:00
5083150002
fix #9112 , improve error message on failure
2018-02-20 18:06:03 +08:00
f5f7b4d25a
handle sessions still open
2018-02-20 03:31:20 -06:00
e995ccfc33
make this a little easier to read
2018-02-20 03:27:55 -06:00
e26fb49c99
if we have no more input from the console, quit
2018-02-20 03:27:38 -06:00
3d8451e616
Land #8997 , add local 'ls' support to Meterpreter sessions
2018-02-19 23:21:59 -06:00
4e9d900a17
Land #9507 , Expand paths for meterpreter's cp, mv, and rm commands
2018-02-19 21:26:03 -06:00
b3f26ea55f
bind_named_pipe fixes
2018-02-18 10:31:57 -07:00
bd2af0143a
properly handle when there is no stat callback specified on upload
2018-02-16 16:14:09 -06:00
289277c613
Land #9516 , Support Bash-Style Continuation Lines
2018-02-16 10:53:58 -06:00
38b03fdfff
Merge branch 'upstream-master' into land-9539-
2018-02-15 16:22:13 -06:00
7e03bf838b
Fix src_size view
2018-02-15 17:44:41 +05:00
a0c473f29e
Upload memory usage optimization
...
Optimize xor_bytes memory usage, use small buffer for upload,
add verbosity
2018-02-15 17:05:22 +05:00
8ae8a0d94b
added bind_named_pipe payload
2018-02-11 18:56:50 -07:00
214c137b4a
Don't use parenthesis around pgets
2018-02-07 15:53:11 -05:00
0ad7d10e05
Use a continuation flag to disable tab completion
2018-02-06 14:44:55 -05:00
6d7579d907
Support breaking commands into multiple lines
2018-02-06 14:29:11 -05:00
8b56bbc541
Update mkdir as well for path expansion
2018-02-05 16:16:53 -05:00
c70bcb5869
Use a constant for the regex and update rmdir too
2018-02-05 16:06:16 -05:00
f441306036
Expand paths for meterpreter's cp, mv, and rm cmds
2018-02-05 15:22:05 -05:00
d5ae2bb55b
Fix pivot handler to not consume all packets
...
Packet handlers should only return true if they consume a packet.
Otherwise, they should return false so something else can consume it.
This fixes port forwards by allowing the socket handler to see packets
that were otherwise being discarded in the pivot handler.
2018-02-02 18:01:05 -06:00
c8ff2adf06
added support for smb client
2018-01-27 20:49:17 -07:00
03d1523d43
Land #6611 , add native DNS to Rex, MSF mixin, sample modules
2018-01-22 23:54:32 -06:00
9a35c324c0
Land #9352 , Pull out HTTP-specific code from PacketDispatcher
2018-01-22 16:52:24 -06:00
ba75d19d34
Fix failing spec.
2018-01-19 15:52:25 -06:00
2a6b3671bf
Add connection addr+port info to http response object.
...
Update owa_login to use this instead of doing lookups on its own.
2018-01-19 13:37:33 -06:00
2916c5ae45
Rescue Rex::Proto::SunRPC::RPCTimeout
...
Coincidentally, this also fixes the rescue in the library, since
rescuing Timeout instead of Timeout::Error does nothing.
2018-01-12 19:34:59 -06:00
c65c03722c
Migrate native DNS services to Dnsruby data format
...
Dnsruby provides advanced options like DNSSEC in its data format
and is a current and well supported library.
The infrastructure services - resolver, server, etc, were designed
for a standalone configuration, and carry entirely too much weight
and redundancy to implement for this context. Instead of porting
over their native resolver, update the Net::DNS subclassed Rex
Resolver to use Dnsruby data formats and method calls.
Update the Msf namespace infrastructure mixins and native server
module with new method calls and workarounds for some instance
variables having only readers without writers. Implement the Rex
ServerManager to start and stop the DNS service adding relevant
alias methods to the Rex::Proto::DNS::Server class.
Rex services are designed to be modular and lightweight, as well
as implement the sockets, threads, and other low-level interfaces.
Dnsruby's operations classes implement their own threading and
socket semantics, and do not fit with the modular mixin workflow
used throughout Framework. So while the updated resolver can be
seen as adding rubber to the tire fire, converting to dnsruby's
native classes for resolvers, servers, and caches, would be more
like adding oxy acetylene and heavy metals.
Testing:
Internal tests for resolution of different record types locally
and over pivot sessions.
2018-01-12 05:00:00 -05:00
51e5fb450f
Detect and return on bad VNC negotiations
2018-01-05 10:12:13 -06:00
f1a1e1a357
Implement specific dispatch extensions for tunnels
...
All meterpreter Clients are created equal, and as such they all
include the PacketDispatcher mixin and call its init methods when
a passive dispatcher is needed. However, since tunneling protocols
have different requirements for implementation, the methods which
provide protocol-specific functionality need to be mixed into the
Client before it attempts to initialize the dispatcher.
Provide a dispatch_ext option in the has passed to the client on
init from the session handler which is an Array containing mixin
references which are sent to :extend calls in the :init_meterpreter
method just prior to calling :initialize_passive_dispatcher.
Each handler implementation can thus push chains of mixins to the
client in order to provide middleware specific to the tunnel. Down
the road, this should permit stacking C2 encapsulations or tunnel
protocols/permutators to create unique session transports on the
fly.
2017-12-29 00:56:06 -05:00
d420bf1a6a
Pull out HTTP-specific code from PacketDispatcher
...
PacketDispatcher has some hardcoded assumptions about utilizing
HTTP services as the async resource. With C2 and DNS tunnels in
the pipeline, these elements need to be separated from the core
functions of async packet dispatch and moved into their own module.
This creates a new namespace for Meterpreter::HttpPacketDispatcher,
meant to be mixed in after PacketDispatcher. The module implements
only three of the original module's methods - init, shutdown, and
the :on_passive_request callback; with the first two using :super,
with the expectation of having a PacketDispatcher mixin or API
compatible namespace already in the mix.
2017-12-28 23:37:01 -05:00
c2bb144d0f
Land #9302 , Implement ARD auth and add remote CVE-2017-13872 (iamroot) module
2017-12-28 14:11:26 -06:00
962bc71d10
Merge branch 'feature/mqtt' into feature/mqtt-login
2017-12-20 18:58:36 -08:00
cf21d13b2e
Resolve conflict
2017-12-20 18:58:16 -08:00
1975713a92
Land #9333 , get_cookies_parsed using CGI::Cookie
2017-12-20 20:08:33 -06:00
d0b3abc14b
Better handling of MQTT endpoints which don't require authentication
...
Arguably this is working around LoginScanner's inability to provide
blank usernames AND passwords
2017-12-20 18:02:52 -08:00
2e62d77e36
Add new method for fetching parsed cookies from an HTTP response
...
This fixed #9332 .
2017-12-20 16:19:44 -08:00
3b78302868
Land #9327 , restore transport enum used in TLVs
2017-12-20 16:11:04 -06:00
741d08f604
Style cleanup
2017-12-20 13:33:47 -08:00
f15309bc48
Add basic framework for interacting with MQTT
2017-12-20 12:28:02 -08:00
9719ede3f0
restore transport enum used in TLVs
2017-12-20 13:12:24 -06:00
32c486023c
Land #9308 , Ensure tab completion in HWBridge sessions works
2017-12-20 11:29:11 -06:00
bfa0cad8a5
Fix clipboard typo
2017-12-20 20:49:36 +05:45
90b97d6581
Merge branch 'upstream-master' into land-9151-
2017-12-15 14:15:14 -06:00
084dc4470d
Ensure tab completion in HWBridge sessions works as expected.
2017-12-15 12:19:26 -06:00
Josh Hale
Green-m
Adam Cammack
UserExistsError
William Vu
Auxilus
WangYihang
asoto-r7
Brent Cook
Jacob Robles
Tim W
Eliott Teissonniere
Kent 'picat' Gruber
Eliott Teissonniere
Spencer McIntyre
Matthew Kienow
Kevin Kirsche
Hypnoze57
dmohanty-r7
Jeffrey Martin
Wei Chen
James Barnett
b0yd
Jon Hart
a1exdandy
UserExistsError
zerosum0x0
Pearce Barry
RageLtMan
jgor
Puru