f17b28930d
Update executex64.asm
2017-06-04 13:18:50 +03:00
bdf121e1c0
x86 kernels will safely ret instead of BSOD
2017-05-17 23:48:14 -06:00
4f3a98d434
add arch detection to shellcode
2017-05-17 23:36:17 -06:00
a5c391dae2
multi-arch ring0->ring3 shellcode .asm file (work in progress)
2017-05-17 23:29:05 -06:00
4eaf1ace81
Bugfix loading address of library path into rcx
...
The old code breaks if the payload is executed from a memory area where the 4 most significant bytes are non-zero.
2015-11-02 16:56:07 +01:00
9444c8c410
Fix #5988 , windows x64 stagers
...
* Also, use mov esi, esi to save an extra byte
* Also, modify the block_recv.asm code, just to have it up to date
2015-09-28 15:52:50 -05:00
dab4333867
updated asm in block
2015-03-18 16:07:46 -04:00
b604599c8e
Fix comments
2015-03-11 21:32:35 -05:00
479a9cc1a9
Fix missing stack variables & remove old comment
2015-03-11 21:23:27 -05:00
7e3b4017f0
Rename and resynced with master, ready for refactoring
2015-03-11 14:36:27 -05:00
991e72a4fa
HTTP stager based on WinHttp
2015-03-10 13:40:16 -05:00
5297ebc1a1
Merge branch 'master' into land-1396-http_proxy_pstore
...
Bring things back to the future
2015-02-20 08:50:17 -06:00
9791acd0bf
Add stager ipknock shellcode (PR 2)
2014-12-27 22:03:45 +01:00
e34c37042a
Readd block_hidden_bind_tcp.asm
...
Because stager_hidden_bind_tcp.asm includes it.
2014-12-22 11:13:07 -06:00
c0fa8c0e3f
Add stager for hidden bind shell payload
2014-12-22 17:21:11 +01:00
e8728943ec
Shave off two more bytes for HTTP(s) stagers
2014-12-13 11:49:30 -06:00
69c938f65a
More shellcode golf
2014-12-13 11:49:15 -06:00
25ed68af6e
Land #3017 , Windows x86 Shell Hidden Bind
...
A bind shellcode that responds as 'closed' unless the client matches the
AHOST ip.
2014-06-08 13:49:49 +01:00
bb4e9e2d4d
correct error in block service_change_description
2014-05-13 16:04:39 +02:00
6332957bd2
Try to add SERVICE_DESCRIPTION options to psexec, but it doesn't seem to work...
2014-05-13 16:04:39 +02:00
bdbb70ab71
up block_service_stopped.asm
2014-05-13 16:04:39 +02:00
e269c1e4f1
Improve service_block with service_stopped block to cleanly terminate service
2014-05-13 16:04:38 +02:00
c43e3cf581
Improve block_create_remote_process to point on shellcode everytime
2014-05-13 16:04:38 +02:00
25d48b7300
Add create_remote_process block, now used in exe_service generation
2014-05-13 16:04:38 +02:00
0bdf7904ff
Change author of single_service_stuff.asm
2014-05-13 16:04:38 +02:00
513f3de0f8
new service exe creation refreshed
2014-05-13 16:04:36 +02:00
520d1e69c4
Rapid7 Comma Inc
...
After some more discussion with Rapid7's legal fellow.
2014-03-13 09:46:20 -05:00
9d4ceaa3a0
Let's try to be consistent about Rapid7 Inc.
...
According to
http://www.sec.gov/Archives/edgar/data/1560327/000156032712000001/0001560327-12-000001.txt
Rapid7 is actually "Rapid7 Inc" not "Rapid7, LLC" any more.
This does not address the few copyright/license statements around
"Metasploit LLC," whatever that is.
2014-03-12 11:20:17 -05:00
1fda6b86a1
Changed cmp eax by inc eax. Saved one byte
2014-03-10 12:13:10 +01:00
99cd36c036
Fix description of Input
2014-03-06 03:16:55 +01:00
689523a26f
Clean Code based on jlee-r7's comments
...
- Put allocations in loop
- Decomment exitfunc
- Aligned comments
- Some more code cleaning
2014-03-06 02:44:24 +01:00
83929facc4
Fix bug on Windows XP
...
Correct the addresses of functions in pstorec.dll.
Successfully tested on Server 2003 and XP.
2014-03-06 02:35:44 +01:00
4aca648faf
Correct file information
2014-03-06 02:35:36 +01:00
ba31e304b5
Clean the code
...
Remove debugging functions from block_get_pstore_proxy_auth.asm.
Reduce allocation size to 1kB.
2014-03-06 02:35:25 +01:00
b6b46abe9f
Add new stager stager_reverse_http_proxy_pstore
...
This stager looks for proxy credentials in windows protected storage. If it finds proxy credentials, it will use them to connect back. If it does not find credentials, it will do the same as stager_reverse_http.
Works on:
- Windows Server 2003
- Windows XP
- Internet Explorer versions 4 to 6
2014-03-06 02:35:12 +01:00
b4a22aa25d
hidden bind shell payload
2014-02-20 16:19:40 +01:00
c70680cf1c
Fix infinite-retry bug
...
Derp, block_api clobbers ecx
2014-02-04 11:59:16 -06:00
9c3664bd45
Unify reverse_http and reverse_https
...
This will make copy-pasta less painful in the future. There's still the
problem of reverse_https_proxy being very similar, but the logic in how
it gets generated in the module is more than i want to tackle right now
2014-02-04 09:09:12 -06:00
6d53570c22
Fix abysmal mixed indentedness.
2014-02-03 11:39:03 -06:00
c29c6be212
Shave 3 bytes off of block_api
2014-02-03 11:34:41 -06:00
bfc0ac4dd4
Golf a few bytes off of reverse_http(s)
2014-02-03 11:33:55 -06:00
38691445af
Fixed memory alignment for x64 reverse_http stager
2013-09-16 16:51:37 -04:00
e28dd42992
add http authentification and socks
2013-07-15 15:36:58 +01:00
e8983a21c5
New meterpreter payload reverse_https_proxy
2013-07-12 16:45:16 -04:00
9c771435f2
Touchup on author credit
2013-05-30 16:13:40 -05:00
b92ae7779e
change author name
2013-05-19 16:16:25 +02:00
6db1fea6b9
create x64_reverse_https stagers
2013-05-13 01:41:56 +02:00
e3eef76372
Land #1223
...
This adds rc4-encrypting stagers for Windows.
[Closes #1223 ]
2013-04-10 12:14:52 -05:00
b3c78f74d2
Whitespace
2013-04-10 09:28:45 -05:00
754b32e9db
shameless plug for posterity in stager asm
2013-02-28 17:30:27 -05:00
RaMMicHaeL
zerosum0x0
Matthias Ganz
jvazquez-r7
rwhitcroft
HD Moore
Borja Merino
Brent Cook
William Vu
Peregrino Gris
Michael Schierl
Meatballs
Florian Gaultier
Tod Beardsley
root
somename11111
James Lee
Ryan Wincey
Alexandre Maloteaux
corelanc0d3r
agix
RageLtMan