Commit Graph

275 Commits (2b11577ae1b619f23f0bfe5bfafa2a46a0c9bb95)

Author SHA1 Message Date
Joshua Drake 15c7a25d68 add omlet stub asm source
git-svn-id: file:///home/svn/framework3/trunk@10110 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-23 17:43:53 +00:00
HD Moore cc3554601f Tools for testing DLL hijack flaws
git-svn-id: file:///home/svn/framework3/trunk@10100 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-23 05:43:47 +00:00
James Lee b35cea94cd add source code for cve-2010-0840
git-svn-id: file:///home/svn/framework3/trunk@10095 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-21 07:27:26 +00:00
Matt Weeks 57b48314a6 Add logging support to console sessions.
git-svn-id: file:///home/svn/framework3/trunk@10084 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-20 19:07:15 +00:00
James Lee 232af015cb add source code for javapayload, thanks mihi. see #406
git-svn-id: file:///home/svn/framework3/trunk@10075 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-20 07:09:51 +00:00
Matt Weeks 937606ab1f Ability to close consoles and discover old consoles.
git-svn-id: file:///home/svn/framework3/trunk@10068 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-19 23:22:22 +00:00
Matt Weeks 6c38930db6 Do not poll for output on hidden windows. Improves performance with many windows open.
git-svn-id: file:///home/svn/framework3/trunk@10066 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-19 23:02:31 +00:00
Stephen Fewer 73f7b20935 Add meterpreter server side support for cleaning up loaded extensions upon server termination by calling the loaded extensions DeinisServerExtension() functions.
git-svn-id: file:///home/svn/framework3/trunk@10053 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-19 11:34:23 +00:00
Stephen Fewer fd0b96ee9d Add a list_shift() function to the common linked list code.
git-svn-id: file:///home/svn/framework3/trunk@10052 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-19 11:25:11 +00:00
Matt Weeks f3648b15cc Add console support to gui. Includes tab completion.
git-svn-id: file:///home/svn/framework3/trunk@10033 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-18 00:30:41 +00:00
Matt Weeks ffb4b611c6 Confirm rpc exit for menu close operations too.
git-svn-id: file:///home/svn/framework3/trunk@9947 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-03 02:42:41 +00:00
Matt Weeks 7f87cb9e55 Fix for date error on job.info call.
git-svn-id: file:///home/svn/framework3/trunk@9916 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-23 21:54:18 +00:00
Matt Weeks 9b0e9fca55 Support stopping rpcd on exit, based on user confirmation. Fixes #2287
git-svn-id: file:///home/svn/framework3/trunk@9915 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-23 21:28:39 +00:00
James Lee 50914a1e68 add a makefile so i don't forget how to compile this stuff
git-svn-id: file:///home/svn/framework3/trunk@9901 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-21 07:27:15 +00:00
Matt Weeks ed74422a62 Fix for Linux error on get system icon call. Fixes bug #2283
git-svn-id: file:///home/svn/framework3/trunk@9894 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-20 23:57:02 +00:00
Matt Weeks e065891a65 Fix for width of version label.
git-svn-id: file:///home/svn/framework3/trunk@9877 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-20 03:06:17 +00:00
Matt Weeks e7f748118b Display number of modules and show console window on double-click
git-svn-id: file:///home/svn/framework3/trunk@9876 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-20 03:04:18 +00:00
James Lee 119f9328fc remove debug prints. =/
git-svn-id: file:///home/svn/framework3/trunk@9875 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-20 00:57:03 +00:00
James Lee 08d705c1db add java meterpreter and update java_calendar_deserialize to be able to use it, see #406
git-svn-id: file:///home/svn/framework3/trunk@9874 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-20 00:53:24 +00:00
Matt Weeks 9029bdf722 Sort modules (exploits, auxiliary, payloads) alphabetically in menu.
git-svn-id: file:///home/svn/framework3/trunk@9846 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-16 21:44:55 +00:00
Matt Weeks 85d07af548 Multiple-session script execution fixed.
Build config updated for netbeans 6.9 and current tree.



git-svn-id: file:///home/svn/framework3/trunk@9830 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-14 19:27:23 +00:00
Stephen Fewer c78b87a356 Add support for the ring0 stager_sysenter_hook payload to run its ring3 payload in a new thread in order to preserve/resume the original hijacked ring3 thread.
git-svn-id: file:///home/svn/framework3/trunk@9819 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-14 13:43:17 +00:00
Matt Weeks dcb3ab6441 Initial commit of Java Metasploit GUI source. Netbeans project files included.
git-svn-id: file:///home/svn/framework3/trunk@9815 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-13 22:43:43 +00:00
HD Moore 30d3440b5d New bins, implements the server side of multi-call railgun
git-svn-id: file:///home/svn/framework3/trunk@9806 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-13 19:19:21 +00:00
Stephen Fewer a47ced6ac4 Partial solution for #1448. Fall back to CreateProcessWithTokenW when CreateProcessAsUser fails with ERROR_PRIVILEGE_NOT_HELD. While only available on 2003 and above this works on my server 2008 test case which was failing before.
git-svn-id: file:///home/svn/framework3/trunk@9781 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-11 18:36:57 +00:00
Stephen Fewer 7a57ca57a6 Bug fix for a misplaced & in call to DestroyEnvironmentBlock() during process_execute(), was causing a hang on Vista and an Access Violation on server 2008.
git-svn-id: file:///home/svn/framework3/trunk@9779 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-11 16:37:50 +00:00
HD Moore d3a6418e53 Revert changes to elevate, still not getting around restrictions on primary token creation, needs a deeper look
git-svn-id: file:///home/svn/framework3/trunk@9759 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-09 21:59:31 +00:00
HD Moore d5932fc2fd Switch the namedpipe code to convert the thread token to a primary token first
git-svn-id: file:///home/svn/framework3/trunk@9756 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-09 21:40:44 +00:00
HD Moore ec9156827e Switch the elevator methods to DuplicateHandleEx to get a primary token
git-svn-id: file:///home/svn/framework3/trunk@9755 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-09 21:23:05 +00:00
HD Moore 29f9f6671e This *should* fix all cases where execute -t would fail to use an impersonated token
git-svn-id: file:///home/svn/framework3/trunk@9754 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-09 19:32:51 +00:00
HD Moore 972e7bc282 Clean up some of the token impersonation code around process execution
git-svn-id: file:///home/svn/framework3/trunk@9751 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-09 18:54:20 +00:00
HD Moore ccfea56ed5 Minor tweak to build without the include path for common
git-svn-id: file:///home/svn/framework3/trunk@9715 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-07 16:46:58 +00:00
HD Moore 5d9a6622de Merge railgun, tweak configurations
git-svn-id: file:///home/svn/framework3/trunk@9709 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-07 16:29:03 +00:00
James Lee fb43495ada meterpreter now compiles on 64-bit linux in a 32-bit chroot. still need payload handlers and some stdapi love to make it useable
git-svn-id: file:///home/svn/framework3/trunk@9468 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-10 06:10:15 +00:00
Joshua Drake 6d1e7bdaa5 big commit - lots of cmdstager changes
created 4 cmd stagers (instead of just one): CmdStagerVBS, CmdStagerDebugAsm, CmdStagerDebugWrite, CmdStagerTFTP
created a TFTPServer mixin
created Msf::Exploit::EXE mixin to generate executables
updated all uses of CmdStager to use CmdStagerVBS for the time being
add exploit for cve-2001-0333 using CmdStagerTFTP
updated tftp server to wait for transfers to finish (up to 30 seconds) before shutting down
write debug.exe stager stub in 16-bit assembly (used in CmdStagerDebugAsm)


git-svn-id: file:///home/svn/framework3/trunk@9375 4d416f70-5f16-0410-b530-b9f4589650da
2010-05-26 22:39:56 +00:00
Ramon de C Valle 380ed580fb Update unixasm external source.
git-svn-id: file:///home/svn/framework3/trunk@9348 4d416f70-5f16-0410-b530-b9f4589650da
2010-05-23 20:01:11 +00:00
HD Moore 36836423d9 Add a warning, cosmetic comment to asm
git-svn-id: file:///home/svn/framework3/trunk@9037 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-07 20:51:05 +00:00
HD Moore c6ebd735df Updated comments
git-svn-id: file:///home/svn/framework3/trunk@9003 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 15:08:17 +00:00
HD Moore 11c10518b3 Bug fixes for better windows OS compatibility
git-svn-id: file:///home/svn/framework3/trunk@9002 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 14:57:51 +00:00
HD Moore cd2760f2c2 Bug fixes and size improvements for the reverse_https stager
git-svn-id: file:///home/svn/framework3/trunk@9001 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 13:53:35 +00:00
HD Moore e968c3894e More size tweaks
git-svn-id: file:///home/svn/framework3/trunk@8999 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 08:03:28 +00:00
HD Moore c8defe9716 Size tweaks to bring the ssl stager + encoder + target_id to exactly 400 bytes
git-svn-id: file:///home/svn/framework3/trunk@8998 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 07:48:53 +00:00
HD Moore c6c956ab46 Small patch to enable a new stager
git-svn-id: file:///home/svn/framework3/trunk@8984 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 05:21:15 +00:00
HD Moore 5d0fb434b7 Adds a reverse_tcp_dns stager
git-svn-id: file:///home/svn/framework3/trunk@8983 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 03:38:57 +00:00
Stephen Fewer 9a4293c445 In with the modified VNC payload which now supports an in memory breakout of session isolation for systems like Vista/2008/7 when the payload is run from a service in session 0 isolation.
git-svn-id: file:///home/svn/framework3/trunk@8890 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 00:00:05 +00:00
Stephen Fewer c09ca4eba5 Commit all the code for the new 'screenshot' command in the stdapi extension. Screenshot will now work on NT4 - 7 on both x86 and x64 and on newer versions of Windows we can break out of session isolation (e.g. session 0 isolation for services) to screenshot the active desktop (or logon screen) without the need to migrate meterpreter. The majority of the migration code-injection stuff has been refactored out into base_inject.c so it can be shared with the new ps_inject() functionality to inject dlls. The 'ps' command now reports what session each process belongs to (if this is too verbose we can remove it or add a -v verbose switch to the ps command). The 'execute' command can now take a -s switch in order to create a process in a users session under the users privs (assuming you have the privs to do this).
git-svn-id: file:///home/svn/framework3/trunk@8787 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-11 17:09:55 +00:00
Stephen Fewer c55e9af9ae Commit the updated APC injection stubs. fixes a nasty issue in some edge cases whereby when using APC injection for a process in another session then the current host process the injected APC can cause an access violation in kernel32 during a call the kernel32!CreateThread caused by the APC's host thread not having an initialized Activation Context inside its TEB. We now test for this and create a dummy ActivationContext entry to appease the kernel. This will both improve DLL injection reliability as well as meterpreter migration reliability.
git-svn-id: file:///home/svn/framework3/trunk@8786 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-11 17:00:19 +00:00
Stephen Fewer 08d1850bcc Commit the new VNC x86/x64 DLL source code...
git-svn-id: file:///home/svn/framework3/trunk@8745 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-08 14:49:45 +00:00
Stephen Fewer d0f2b589b6 Delete the old VNC source code.
git-svn-id: file:///home/svn/framework3/trunk@8744 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-08 14:39:20 +00:00
Stephen Fewer 195d1ab4b8 Commit snojobs jpeg patch for espia with an x64 build and some minor changes on the ruby side (The 'screenshot' command is now 'screengrab' to avoid a future conflict with changes happening in stdapi).
git-svn-id: file:///home/svn/framework3/trunk@8726 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-05 15:50:24 +00:00