Commit Graph

4414 Commits (4b54517b9522c4c340ce0ad2ae1c3856f1a1b95e)

Author SHA1 Message Date
Trevor Rosen dda87667c9
Land #4688, fix for pcap magic number on 2.x 2015-02-02 11:00:13 -06:00
William Vu 7f0af0211d
Land #4682, exploit/http/server.rb breakup 2015-02-01 01:44:43 -06:00
Christian Catalan 7d1090baca Convert #find(:all) to #where or #all 2015-02-01 00:31:58 -06:00
Brandon Turner ad374c2e4f
Use ASCII-8BIT for comparing pcap magic number
In Ruby 2, source files are read as UTF-8 by default.  When comparing
PCAP headers, we should use ASCII-8BIT or else the comparison will not
work.  This should be backwards compatible with Ruby 1.9.

MSP-12092
2015-01-31 23:57:49 -06:00
Christian Catalan 8740fd9015 Convert #find_all_by_X to #where 2015-01-31 21:07:50 -06:00
William Vu fdf88b9563
Land #4639, incorrect use of #class fixes
case uses === internally. :)
2015-01-30 16:57:59 -06:00
Brent Cook 253d8e60dd
Land #4388, Meatballs1's golden ticket post module 2015-01-30 16:26:04 -06:00
James Lee 1fbed1dcfc
Autoload instead of require 2015-01-30 15:42:16 -06:00
James Lee 062529ce3b
Move HttpServer::HTML into its own file 2015-01-30 15:24:15 -06:00
James Lee 3572ce9a37
Break PHPInclude into its own file 2015-01-30 15:16:54 -06:00
William Vu 3954c0e3aa
Land #4654, test module fixes 2015-01-30 15:00:54 -06:00
Meatballs 39004d265b Increase default buffer sizes to reduce railgun calls 2015-01-30 11:20:03 +00:00
Meatballs 6b97618fb2 Improve resolve_sid API calls 2015-01-30 11:20:03 +00:00
Meatballs 044e3bd608 Golden Ticketz Post module 2015-01-30 11:20:02 +00:00
sinn3r 457598eb02 print_error about unknown request.uri 2015-01-27 20:21:18 -06:00
sinn3r acf02647fb Add a check for Custom404 2015-01-27 20:18:10 -06:00
sinn3r 66703bfe5a Allow custom 404 as an option for BrowserExploitServer
When something fails, the target is given a hardcoded 404 message
generated by the framework. But the user (attacker) now can configure
this. When the Custom404 option is set, the mixin will actually
redirect (302) to that URL.

There are several scenarios that can trigger a 404 by BES (custom or
default):

* When the browser doesn't allow javascript
* When the browser directly visits the exploit URL, which is forbidden.
  If this actually happens, it probably means the attacker gave the
  wrong URL.
* The attacker doesn't allow the browser auto-recovery to retry the
  URL.
* If some browser requirements aren't met.
* The browser attempts to go to access a resource not set up by the
  mixin.
2015-01-27 18:53:02 -06:00
Brent Cook f2edf21b9d fix MSF::Post::File::rename_file with meterpreter
Modify rename_file to fit the pattern of the other file methods.
Otherwise, calling this yields a backtrace in the logs and it fails.

Steps to verify:
rc script:
```
loadpath test/modules
use exploit/multi/handler
set lhost 172.28.128.1
set lport 8081
set payload windows/meterpreter/reverse_http
run -j
sleep 5
resource test/scripts/test-sessions.rc

Before:
```
[-] FAILED: should move files
[-] Exception: TypeError : true is not a symbol

log file:
[01/27/2015 13:17:23] [d(0)] core: Call stack:
/home/bcook/projects/metasploit-framework/lib/msf/core/post/file.rb:357:in
`rename_file'
/home/bcook/projects/metasploit-framework/test/modules/post/test/file.rb:115:in
`block in test_file'
/home/bcook/projects/metasploit-framework/test/lib/module_test.rb:26:in
`call'
/home/bcook/projects/metasploit-framework/test/lib/module_test.rb:26:in
`it'
...
```

After, passing sessions instead:
```
post/test/file
SESSION => 1
Setup: changing working directory to %TEMP%
[*] Running against session 1
[*] Session type is meterpreter and platform is x86/win32
[+] should test for file existence
[+] should test for directory existence
[+] should create text files
[+] should read the text we just wrote
[+] should append text files
[+] should delete text files
[+] should move files
[+] should write binary data
[+] should read the binary data we just wrote
[+] should delete binary files
[+] should append binary data
[*] Passed: 11; Failed: 0
```
2015-01-27 13:19:33 -06:00
sinn3r ee922d141c Fix #4646 - get_module_resource should check nil before using get_resource
Fix #4646. The get_module_resource needs to check nil first before
using the get_resource method (from HttpServer)
2015-01-27 00:21:43 -06:00
Jon Hart cb2bef878b
Land #4504, @disenchant's get/getg improvement 2015-01-26 12:49:34 -08:00
Christian Mehlmauer bb07ec8666
fix incorrect usage of .class 2015-01-26 15:46:58 +01:00
sinn3r c62beacd31 Revert #4473 - Log backtraces by default 2015-01-24 02:44:29 -06:00
Brent Cook 52ca6b54b1 remove entire 'default' attribute acccessor override method
This reverts us to the state before
725a17c70b, making OptRegexp simply
inherit from OptBase again.
2015-01-23 14:18:05 -06:00
sinn3r f3a2d6663f Fix #4616 and Fix #3798 - Correctly use OptRegexp
This patch fixes a problem with OptRegexp. The OptRegexp class is
always forcing the value to be converted to a string first, which
causes the EXCLUDE option in browser_autopwn to kick in and match
every found autopwn module, so it ignores all of them and you load
nothing (#4616).

It is important to understand that nil actually represents an option
not being set, which is a completely different behavior than having
an empty value (technically "" is still a value, and if there's a
value, it means the option is set). We need to watcher for these
scenarios.

I am restoring the #default method to avoid forcing a to_s, which should
fix the browser autopwn loading problem. And then I changed scraper.rb's
default value for datastore option PATTERN to a string, because still
fixes #3798. The way I see it, #3798 is actually a module-specific issue.

Fix #4616
Fix #3798
2015-01-23 02:38:26 -06:00
William Vu 0612e1906a
Land #4614, {32,64}-bit Registry access 2015-01-22 13:25:51 -06:00
William Vu 1dafedf23b
Clarify no encoder/badchars specified 2015-01-21 00:26:42 -06:00
William Vu 4cc027c4c1
Move "found" message to a saner location
Thanks to Peleus for the idea.
2015-01-20 23:58:12 -06:00
Brent Cook 5954e2300f updates based on feedback
Add documentation to the view constants.
Use include? rather than regexes
2015-01-20 16:57:49 -06:00
Brent Cook a42cc2ef1f add support for specifying 32 or 64-bit registry access
This adds an extra parameter to most of the post/windows/registry
methods called 'view' that specifies if a registry key should be
accessed as a native process, 32-bit or 64-bit.

Support is added to both the Meterpreter and command-line backends. For
the command backend, a lot of boilerplate is removed from each method in
favor of a few shared commands. There is an error hash that never gets
used, so I removed it as well.

This passes the post/test/registry module with meterpreter, but fails
the command line backend. However, it fails in the same way without
these changes (tested on Windows 8), so I suspect that the command line
session was already not working well, at least with newer versions of
Windows. I might look into figuring out how to fix that, but it looks
pretty fragile to me, parsing for english phrases in the output.
2015-01-20 15:26:59 -06:00
William Vu cffa55b12e
Improve proxy chain description 2015-01-18 22:32:22 -06:00
Brent Cook a2a1a90678
Land #4316, Meatballs1 streamlines payload execution for exploits/windows/local/wmi
also fixes a typo bug in WMIC
2015-01-16 11:16:22 -06:00
James Lee 273ba54a21
Fix server/capture/smb to use create_credential 2015-01-15 22:39:11 -06:00
William Vu f0de45c371
Fix typo and add Subject support 2015-01-14 02:17:29 -06:00
David Maloney 6dad66c04c
add Date header support to SMTP deliver
the SMTP mixin now supports the Date header.
The user can supply a a value for the Date Header
or else it will automatically use the current local
DateTime. This will help alleviate certain issues
caused by servers setting this field for the cliebnt incorrectly

MSP-9390
2015-01-12 11:18:07 -06:00
Brent Cook fb5170e8b3
Land #2766, Meatballs1's refactoring of ExtAPI services
- Many code duplications are eliminated from modules in favor of shared
   implementations in the framework.
 - Paths are properly quoted in shell operations and duplicate operations are
   squashed.
 - Various subtle bugs in error handling are fixed.
 - Error handling is simpler.
 - Windows services API is revised and modules are updated to use it.
 - various API docs added
 - railgun API constants are organized and readable now.
2015-01-08 16:54:01 -06:00
Jon Hart ed74271c26
Land #4548, @dmaloney-r7's fix to allow loginscanners to work w/o a DB 2015-01-08 14:50:08 -08:00
Jon Hart 98cee8249d
Move non-active DB messages to warning and clarify/simplify 2015-01-08 14:40:47 -08:00
Brent Cook 05279ef02a consistently use double-quoted paths
allow for variable expansion if needed
2015-01-08 16:10:28 -06:00
David Maloney fd7e65d459
derp just check db active
the other way of doing this was stupid, jsut check if
the db is active
2015-01-08 11:58:56 -06:00
Meatballs 8f720ef766
Use get_env in runas 2015-01-08 11:07:40 +00:00
OJ 844460dd87
Update bypass UAC to work on 8.1 and 2012
This commit contains a bunch of work that comes from Meatballs1 and
Lesage, and updates the bypassuac_inject module so that it works on
Windows 8.x and Windows 2012. Almost zero of the code in this module
can be attributed to me. Most of it comes from Ben's work.

I did do some code tidying, adjustment of style, etc. but other than
that it's all down to other people.
2015-01-08 15:39:19 +10:00
Samuel Huckins f0261a418c
Lands #4535, report_auth_info shoring up 2015-01-07 16:32:14 -06:00
David Maloney 001b6d913e
allows loginscanners to work without db
created stub methods around the credential
creation methods modules would use from
Metasploit::Credential, they try to call the real ones
but rescue a NoMethodError that arises if framework is setup
without the db. it just prints a message to the console
telling the user the cred data will not be saved

MSP-10969
2015-01-07 16:09:04 -06:00
James Lee da2e088118
Land #4536, Ruby 2.2 compat fixes
Note that ActiveRecord 3.2.21 still has a similar warning that will
probably cause bugs, preventing full support for 2.2 until that's fixed.
2015-01-07 15:33:23 -06:00
Meatballs e3e9a64064
Land #4543, Update john.conf with korelogic rules 2015-01-07 21:30:44 +00:00
Meatballs 0b0ac1455a
Merge remote-tracking branch 'upstream/master' into extapi_service_post
Conflicts:
	test/modules/post/test/services.rb
2015-01-07 20:53:34 +00:00
David Maloney 4ad7021336
give user option to turn on KoreLogic rules
the cracker modules in framework now have a datastore option
to allow the user to select the KoreLogicRules
2015-01-07 12:32:26 -06:00
David Maloney 702511dbc5
respect DB_ALL_USERS & DB_ALL_PASS
fix last few things in authbrute
and make the CredentialCollections understand the
additional seperate components

MSP-11986
2015-01-07 11:41:41 -06:00
David Maloney 7ff2ba0725
first pass on fixing DB_ALL authbrute stuff
DB_ALL_CREDS worked but DB_ALL_USER and DB_ALL_PASS
did not. working on fixing that.
This commit also does some nice DRY work in the auth_brute mixin

MSP-11986
2015-01-07 11:30:39 -06:00
dmooray 478505c17a ruby 2.2 compatibility
https://bugs.ruby-lang.org/issues/10314
2015-01-07 11:41:34 +02:00
sinn3r 609c490b3c I missed nobfu 2015-01-06 12:49:39 -06:00
sinn3r 2ed05869b8 Make Msf::Exploit::PDF follow the Ruby method naming convention
Just changing method names.

It will actually also fix #4520
2015-01-06 12:42:06 -06:00
William Vu 0bece137c1
Land #4494, Object.class.to_s fix 2015-01-06 02:27:35 -06:00
Meatballs dd5c638ab0
Merge remote-tracking branch 'upstream/master' into extapi_service_post 2015-01-05 22:18:44 +00:00
David Maloney fc91244252
insert deprecation error message
report_auth_info will now issue an error message
stating that the method is deprecated along with the module name
that called it

MSP-11919
2015-01-05 14:02:16 -06:00
David Maloney db8f260557
add some YARD docs to report_auth_info
add yard docs for the modified report_auth_info

MSP-11919
2015-01-05 13:58:25 -06:00
David Maloney 71d600e829
make report_auth_info create new creds and logins
report_auth_info coerces old data into the new credential
types as best as it is able

MSP-11919
2015-01-05 13:41:30 -06:00
sinn3r d45cdd61aa Resolve #4507 - respond_to? + send = evil
Since Ruby 2.1, the respond_to? method is more strict because it does
not check protected methods. So when you use send(), clearly you're
ignoring this type of access control. The patch is meant to preserve
this behavior to avoid potential breakage.

Resolve #4507
2015-01-02 13:29:17 -06:00
Sven Vetsch b121e2c3fd adds a get and getg method besides the already existing set/setg and unset/unsetg 2015-01-02 12:40:24 +01:00
Spencer McIntyre 6d966dbbcf
Land #4203, @jvazquez-r7's cleanup for java_rmi_server 2014-12-31 11:25:19 -05:00
Christian Mehlmauer 4f11dc009a
fixes #4490, class.to_s should not be used for checks 2014-12-31 10:46:24 +01:00
Christian Mehlmauer 3a73b40a1e
more error handling 2014-12-29 00:39:00 +01:00
jvazquez-r7 04772c8946 Ensure stop_service closes Rex::Proto::Http::Server 2014-12-26 13:50:03 -06:00
Brent Cook 725a17c70b override default attr for OptRegexp
Rather than literally returning the default Regex object, override the accessor
to return the string representation. This allows the RPC backend to properly
serialize the options hash values, since msgpack does not know how to serialize
a Regexp object. Fixes #3798.

To verify the fix, run the steps for issue #3798 and ensure that the module
options are returned instead of a backtrace. Also, ensure that the module
continues to work as expected:

```
$ ./msfconsole -q
msf > use auxiliary/scanner/http/scraper
msf auxiliary(scraper) > info

       Name: HTTP Page Scraper
     Module: auxiliary/scanner/http/scraper
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  et <et@metasploit.com>

Basic options:
  Name     Current Setting               Required  Description
  ----     ---------------               --------  -----------
  PATH     /                             yes       The test path to the page to analize
  PATTERN  (?i-mx:<title>(.*)<\/title>)  yes       The regex to use (default regex is a sample to grab page title)
  Proxies                                no        Use a proxy chain
  RHOSTS                                 yes       The target address range or CIDR identifier
  RPORT    80                            yes       The target port
  THREADS  1                             yes       The number of concurrent threads
  VHOST                                  no        HTTP server virtual host

override default attr for OptRegexp
Description:
  Scrap defined data from a specific web page based on a regular
  expresion

msf auxiliary(scraper) > set RHOSTS lwn.net
RHOSTS => lwn.net
msf auxiliary(scraper) > set RHOSTS 72.51.34.34
RHOSTS => 72.51.34.34
msf auxiliary(scraper) > set VHOST lwn.net
VHOST => lwn.net
msf auxiliary(scraper) > run

[*] [72.51.34.34] / [Welcome to LWN.net [LWN.net]]
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```
2014-12-24 09:57:14 -06:00
Joe Vennix e974d272f0
Remove stray line comment that ruined things when minified. 2014-12-23 00:22:50 -06:00
Tod Beardsley d3050de862
Remove references to Redmine in code
See #4400. This should be all of them, except for, of course, the module
that targets Redmine itself.

Note that this also updates the README.md with more current information
as well.
2014-12-19 17:27:08 -06:00
Spencer McIntyre 698ca2639b Do not delete files that do not exist in rm_f 2014-12-17 09:18:06 -05:00
HD Moore 9de4137aa7 Patch UA/Proxy settings during migration, lands #3632 2014-12-16 22:21:48 -06:00
Sean Verity 370f6003e3 Refactors metsrv patching in reverse_hop_htt.rb 2014-12-17 11:57:17 -05:00
Sean Verity 1930eb1bf8 Refactors metsrv patching in reverse_http.rb 2014-12-17 10:04:43 -05:00
sinn3r c2bc79c53c Resolves #4275 - Configurable variable name as an option
Resolves #4275
2014-12-15 23:59:34 -06:00
Brent Cook c24fdb81b5
Land #4389, Meatballs1's fix for enum_ad_* post module regressions
Fixes #4387 by adjusting for the new return type from ADSI queries.
2014-12-15 10:45:12 -06:00
HD Moore e2617c7095
Return the workspace id in responses, lands #4142 2014-12-13 18:04:58 -06:00
HD Moore 6ea5ed1a82
Shrinks windows payloads, lands #4391 2014-12-13 17:41:50 -06:00
HD Moore f67a32ef9c
Add missing commits from #3770, lands #4393 2014-12-13 17:36:26 -06:00
Meatballs 5d18de2ebf
Fix legacy railgun LDAP implementation 2014-12-13 18:26:26 +00:00
HD Moore 92490ab5e8 Singles updated from the source 2014-12-13 12:22:07 -06:00
HD Moore 4681416a0f Update block_api with @schierlm's changes 2014-12-13 12:06:38 -06:00
HD Moore f676b72767
Add Kademlia scanner, lands #4210 2014-12-12 16:40:58 -06:00
Tod Beardsley 9545b6e4d6
Land #4343, os_flavor reduction 2014-12-12 14:49:15 -06:00
Tod Beardsley 177cade6a5 Merge branch 'land-4274-ssl' into temp 2014-12-12 13:25:54 -06:00
James Lee 0c1d02c940
Fix event handlers on ruby 2
Fixes #4219
2014-12-11 20:08:45 -06:00
Tod Beardsley 0eea9a02a1
Land #3144, psexec refactoring 2014-12-10 17:30:39 -06:00
sinn3r 9202c4f2a1 No mercy for os_flavor 2014-12-10 11:46:21 -06:00
Spencer McIntyre d74a8f6c41 Include the datastore options for the encoder too 2014-12-09 16:32:41 -05:00
sinn3r a584a5982f Clarify about how BES uses os_flavor
We don't. We don't use os_flavor anymore because it is no longer
implemented. We get the information from os_name instead.
2014-12-09 12:21:59 -06:00
Jon Hart da92e4705c
Land #4319, @wchen-r7's fix for #4307 2014-12-05 12:08:39 -08:00
sinn3r abf199f924 Remove junk code 2014-12-05 11:01:34 -06:00
sinn3r cfc1acfcae Fix #4307 - Check action for nil
Auxiiary modules already do this, but looks like we forgot to do the
same for post modules.

I also changed the error to allow "reason" in order to be more
informative about what the user should do.

Fix #4307
2014-12-04 17:07:59 -06:00
Jon Hart 743e9fca9d
Correctly set default SECRET 2014-12-04 14:06:22 -08:00
Jon Hart 1e423f415e
Add missing opt , 2014-12-04 14:05:17 -08:00
Jon Hart 7f425fc3ab
Configurable fix for #4305
Rename UDP_SECRET to just SECRET, as it is used for more than just UDP

Rename and properly document GATEWAY option

Introduce an option to configure what UDP port will be probed
2014-12-04 13:17:34 -08:00
Meatballs 186d8bd359
Fix starts_with? 2014-12-04 20:16:56 +00:00
Jon Hart f22d7191cd Test fix for #4305 2014-12-04 10:59:57 -08:00
Jon Hart d8b1401545
Test fix for #4306 2014-12-03 19:54:31 -08:00
James Lee 8f2e444aca
Land #4281, ::Queue workarounds for 2.1.x
Conflicts:
	lib/msf/core/handler/reverse_tcp.rb
2014-12-03 15:48:20 -06:00
sinn3r f6f0050f56 Fix #3886 - Backtrace for #check when session is invalid
If the user supplies an invalid session (as in not on the session
list), it will cause a backtrace, because the setup method from
Msf::PostMixin isn't actually called.

We have thought about implementing this in a new OptSession instead.
But you can't use or even pass framework to option_container.rb, so
this is NOT possible.

The original PR was #3956.
2014-12-02 17:22:46 -06:00
Fernando Arias fb439258b9
Land #4298, arbitrary Ruby extension for replicant
MSP-11673

* Adds Msf::Module#register_extensions
* Extensions are arbitrary Ruby modules
* Allows overriding of psuedo callbacks
2014-12-02 14:59:37 -06:00
Trevor Rosen 2a033861dc
Just use constants directly
MSP-11673
2014-12-02 13:12:53 -06:00
Trevor Rosen 784e138b14
Extend replicants via arbitrary Ruby code
MSP-11673

* Implements a #register_extensions method on Msf::Module
* Any registered Ruby modules will extend the cloned module returned by #replicant
2014-12-02 12:18:30 -06:00