Commit Graph

1137 Commits (60210f57e97119ed7faad1ba6a08720d64601747)

Author SHA1 Message Date
Brent Cook 0a3acf57d1 update payload sizes 2016-11-20 19:47:17 -06:00
Brent Cook f313389be4 Merge remote-tracking branch 'upstream/master' into land-7507-uuid-arch 2016-11-20 19:08:56 -06:00
OJ 7895ba810d
Update payload cached size for the powershell payload 2016-11-03 02:50:13 +10:00
Adam Cammack a79f860cb7
Add UUIDs to mettle stages 2016-11-01 16:58:21 -05:00
OJ e4b4264d79
Fix psh template to avoid 100% cpu spike on CTRL+C
Fixes #7293
2016-11-02 05:19:52 +10:00
OJ 57eabda5dc
Merge upstream/master 2016-10-29 13:54:31 +10:00
OJ 1d617ae389
Implement first pass of architecture/platform refactor 2016-10-28 07:16:05 +10:00
Brent Cook 1a1841d441 rebuilt metasploit-payloads without debug info 2016-10-26 05:43:36 -05:00
Brent Cook 4c248ebe9e Merge branch 'master' into land-7430- 2016-10-14 09:48:33 -05:00
Brent Cook 157740ba06 update payload sizes 2016-10-11 07:01:17 -05:00
Tim 3d9cb7375c
store Android payload information in byte array 2016-10-11 14:41:32 +08:00
OJ e139a1ee8f
Land #7383: Rebase/Fix + SSL stager support for python 2016-10-10 13:06:09 +10:00
Tonimir Kisasondi 691a250d78 add reverse_tcp handler to fix bug in latest update
The payload was missing require 'msf/core/handler/reverse_tcp', latest update pulled with msfupdate broke the startup of the framework, where you got this kind of an error:

!master ~/4tools/metasploit-framework> msfconsole 
/home/tony/4tools/metasploit-framework/modules/payloads/singles/android/meterpreter_reverse_tcp.rb:28:in `initialize': uninitialized constant Msf::Handler::ReverseTcp (NameError)
	from /home/tony/4tools/metasploit-framework/lib/msf/core/payload_set.rb:198:in `new'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/payload_set.rb:198:in `add_module'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/loading.rb:71:in `on_module_load'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/base.rb:182:in `load_module'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/base.rb:237:in `block in load_modules'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/directory.rb:55:in `block (2 levels) in each_module_reference_name'
	from /var/lib/gems/2.3.0/gems/rex-core-0.1.2/lib/rex/file.rb:127:in `block in find'
	from /var/lib/gems/2.3.0/gems/rex-core-0.1.2/lib/rex/file.rb:126:in `catch'
	from /var/lib/gems/2.3.0/gems/rex-core-0.1.2/lib/rex/file.rb:126:in `find'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/directory.rb:46:in `block in each_module_reference_name'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/directory.rb:34:in `foreach'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/directory.rb:34:in `each_module_reference_name'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/modules/loader/base.rb:236:in `load_modules'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/loading.rb:117:in `block in load_modules'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/loading.rb:115:in `each'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/loading.rb:115:in `load_modules'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/module_paths.rb:41:in `block in add_module_path'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/module_paths.rb:40:in `each'
	from /home/tony/4tools/metasploit-framework/lib/msf/core/module_manager/module_paths.rb:40:in `add_module_path'
	from /home/tony/4tools/metasploit-framework/lib/msf/base/simple/framework/module_paths.rb:50:in `block in init_module_paths'
	from /home/tony/4tools/metasploit-framework/lib/msf/base/simple/framework/module_paths.rb:49:in `each'
	from /home/tony/4tools/metasploit-framework/lib/msf/base/simple/framework/module_paths.rb:49:in `init_module_paths'
	from /home/tony/4tools/metasploit-framework/lib/msf/ui/console/driver.rb:204:in `initialize'
	from /home/tony/4tools/metasploit-framework/lib/metasploit/framework/command/console.rb:62:in `new'
	from /home/tony/4tools/metasploit-framework/lib/metasploit/framework/command/console.rb:62:in `driver'
	from /home/tony/4tools/metasploit-framework/lib/metasploit/framework/command/console.rb:48:in `start'
	from /home/tony/4tools/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in `start'
	from /home/tony/4tools/metasploit-framework/msfconsole:48:in `<main>'
2016-10-04 10:40:04 +02:00
Brent Cook fabb296b15 update cache and add payload test 2016-09-29 21:19:55 -05:00
Brent Cook 301e38b08f use correct base class for modules 2016-09-29 17:21:59 -05:00
RageLtMan a7470991d9 Bring Python reverse_tcp_ssl payload upstream
Adds TLS/SSL transport encryption for reverse tcp payloads in
python
2016-09-29 17:21:59 -05:00
Tim b4a1adaf0f refactor into android.rb 2016-09-28 18:23:34 +08:00
Tim dc43f59dcf dalvik -> android 2016-09-28 14:50:52 +08:00
Tim 53823a4807 oops msftidy 2016-09-26 23:50:38 +08:00
Tim 34e02fe097 stageless http 2016-09-22 16:26:26 +01:00
Tim 1b911e7117 placate msftidy 2016-09-22 16:26:26 +01:00
Tim 32c2311b86 android meterpreter_reverse_tcp 2016-09-22 16:26:26 +01:00
bigendian smalls 05278c868e
Updated JCL cmd payloads to use PR7007 format
PR7007 centralized JCL job card for any JCL cmd payload.  This PR simply
uses that new format for existing JCL cmd payloads.  No functionality
for these payloads was changed, added or deleted.
2016-08-31 14:39:01 -05:00
Brent Cook 288b39e37f update to mettle 0.0.6 2016-07-27 08:59:21 -05:00
Brent Cook ee90e5e96d
update payload sizes 2016-07-13 01:06:05 -05:00
William Webb 8f73167b15
Land #7060, Fix up the 64-bit BSD reverse shell 2016-07-12 14:37:51 -05:00
Brent Cook 21bede1166 unify stager style 2016-07-05 11:24:54 -05:00
Brent Cook 049b322ae4 add x86 and x64 stagers for mettle 2016-07-05 11:24:54 -05:00
Adam Cammack 8490a3b775 Remove hard-float requirement for MIPS O32 2016-07-05 11:24:54 -05:00
Adam Cammack 0390ed4d6e Add MIPS O32 Linux support (big and little endian) 2016-07-05 11:24:54 -05:00
Adam Cammack 8de508c4e0 Add mettle module for ARM 2016-07-05 11:24:54 -05:00
wchen-r7 6290cb681f Change class name Metasploit4 to MetasploitModule 2016-07-05 11:12:49 -05:00
Hans Jerry Illikainen 78335f8e20 Update the cache size in bsd/x64/shell_reverse_tcp 2016-07-04 00:35:52 +02:00
Hans Jerry Illikainen f246aa0b58 dup2() to STDERR_FILENO in bsd/x64/shell_reverse_tcp 2016-07-04 00:00:33 +02:00
Hans Jerry Illikainen 54092177a2 Remove superfluous xor in bsd/x64/shell_reverse_tcp 2016-07-03 23:53:11 +02:00
earthquake c0093381d7 Big endian ARM Linux bind shellcode for ipv4 2016-06-10 00:06:53 +02:00
earthquake a58a3d4330 one line aligned to the others, space replaced to tab 2016-06-09 20:53:12 +02:00
earthquake 5f4153308c one line aligned to the others, space replaced to tabx 2016-06-09 20:52:20 +02:00
Brendan Watters af86d63498 Updated Cache size 2016-05-24 09:07:05 -05:00
Brendan Watters f0b945e4c4 Updated cache size 2016-05-24 09:06:46 -05:00
Brendan Watters d328258db4 Updated Cache size 2016-05-24 09:06:28 -05:00
Brent Cook 2694907b79 update cached payload size 2016-05-23 14:30:43 -05:00
RageLtMan cf62218139 Update payload sizes 2016-05-23 14:27:11 -05:00
RageLtMan efc64eaa5f Implement reverse_tcp_rc4_dns payload in metasm
Using the ruby methods for generating assembly blocks defined or
separated in prior commits, create a new payload from the existing
assembly blocks which performs a DNS lookup of the LHOST prior to
establishing a corresponding socket and downloading, and
decrypting the RC4 encrypted payload.

For anyone looking to learn how to build these payloads, these
three commits should provide a healthy primer. Small changes to
the payload structure can yield entropy enough to avoid signature
based detection by in-line or out-of-band static defenses. This
payload was completed in the time between this commit and the last.

Testing:
  Win2k8r2

ToDo:
  Update payload sizes when this branch is "complete"
  Ensure UUIDs and adjacent black magic all work properly
2016-05-23 14:27:11 -05:00
RageLtMan 0e69040a6a Implement reverse_tcp_dns as metasm payload
Using the separation of block_recv and reverse_tcp, implement
reverse_tcp_dns using original shellcode as template with dynamic
injection of parameters. Concatenate the whole thing in the
generation call chain, and compile the resulting shellcode for
delivery.

Metasploit module pruned to bare minimum, with the LHOST OptString
moved into the library component.

Testing:
  Win2k8r2

ToDo:
  Update payload sizes when this branch is "complete"
  Ensure UUIDs and adjacent black magic all work properly

Misc:
  Clean up rc4.rb to use the rc4_keys method when generating a
stage. Makes the implementation far more readable and reduces
redundant code.
2016-05-23 14:27:11 -05:00
RageLtMan df2346d9e0 Implement RC4 metasm payloads for tcp bind and rev
Convert reverse_tcp_rc4 and bind_tcp_rc4 from static shellcode
substitution payloads to metasm compiled assembly approach.

Splits up metasm methods for bind_tcp and reverse_tcp into socket
creation and block_recv to allow for reuse of the socket methods
with the RC4 payloads, while substituting the block_recv methods
for those carrying the appropriate decryptor stubs.

Creates a new rc4 module carrying the bulk of the decryptor and
adjacent convenince methods for standard payload generation.

Testing:
 Tested against Win2k8r2, Win7x64, and WinXPx86

ToDo:
 Ensure all the methods around payload sizing, UUIDs, and other
new functionality, the semantics of which i do not yet fully
understand, are appropriate and do not introduce breakage.
2016-05-23 14:27:11 -05:00
root a71e853c2a Fixed cache size for python/shell_reverse_tcp_ssl 2016-05-20 02:32:37 +00:00
root 87398d5195 Fixed python reverse shell ssl send for EOF occurred in violation of protocol error 2016-05-20 01:49:04 +00:00
Brent Cook 8ce0365c7f
See rapid7/metasploit-payloads#98, update cached payload sizes 2016-05-13 23:05:34 -05:00
William Vu 74e5772bbf Replace mknod with mkfifo for portability
Works on BSD and OS X now. This has been bugging me for a while.
2016-05-04 02:32:37 -05:00