Commit Graph

458 Commits (73b362cade30715a2046b97f80ffe98e49679f41)

Author SHA1 Message Date
scriptjunkie bc42ac5761 Fix #7117 by fixing stack offset 2016-07-21 20:48:08 -05:00
William Vu 6e7f07f0f3 Fix off-by-one error in #6954
Props to @egypt for noticing. My bad. :-)
2016-07-05 11:12:12 -05:00
Brendan e29d5b9efe
Land #6954, Fix the available size of payload for exploit/.../payload_inject 2016-07-05 07:38:27 -07:00
William Vu 4b01213fb5 Rewrite the logic to be positive
unless is the devil. unless/else doubly so.
2016-07-01 09:15:42 -05:00
Bigendian Smalls 3842753ce4
Added JCL header data to mainframe payload module
Currently any existing and future JCL payload has to have a 'job card'
basically data that defines the job to z/OS.  It has information about
the job's owner, place it will run, output creation, etc.  All JCL
shares the same job card format.  As such, creating a shared payload
method that allows this text to be imported into any JCL payload.
Additionally, that job card is now parameterized, allowing the
exploit/payload user to edit these job card values-as this may be needed
in order to run the job sucessfully on any given system.

This PR sets up the mf module - next PRs will update the existing
payloads to use this module.
2016-06-21 22:06:44 -05:00
Brent Cook 8612eaa553 remove senduuid for now, give RC4PASSWORD a default 2016-05-26 06:34:51 -05:00
Brent Cook c65401026a wip fixup rc4 2016-05-25 06:17:02 -05:00
Brendan Watters 43f79f34a9 Removed superfluous instruction 2016-05-24 09:03:14 -05:00
RageLtMan efc64eaa5f Implement reverse_tcp_rc4_dns payload in metasm
Using the ruby methods for generating assembly blocks defined or
separated in prior commits, create a new payload from the existing
assembly blocks which performs a DNS lookup of the LHOST prior to
establishing a corresponding socket and downloading, and
decrypting the RC4 encrypted payload.

For anyone looking to learn how to build these payloads, these
three commits should provide a healthy primer. Small changes to
the payload structure can yield entropy enough to avoid signature
based detection by in-line or out-of-band static defenses. This
payload was completed in the time between this commit and the last.

Testing:
  Win2k8r2

ToDo:
  Update payload sizes when this branch is "complete"
  Ensure UUIDs and adjacent black magic all work properly
2016-05-23 14:27:11 -05:00
RageLtMan 0e69040a6a Implement reverse_tcp_dns as metasm payload
Using the separation of block_recv and reverse_tcp, implement
reverse_tcp_dns using original shellcode as template with dynamic
injection of parameters. Concatenate the whole thing in the
generation call chain, and compile the resulting shellcode for
delivery.

Metasploit module pruned to bare minimum, with the LHOST OptString
moved into the library component.

Testing:
  Win2k8r2

ToDo:
  Update payload sizes when this branch is "complete"
  Ensure UUIDs and adjacent black magic all work properly

Misc:
  Clean up rc4.rb to use the rc4_keys method when generating a
stage. Makes the implementation far more readable and reduces
redundant code.
2016-05-23 14:27:11 -05:00
RageLtMan df2346d9e0 Implement RC4 metasm payloads for tcp bind and rev
Convert reverse_tcp_rc4 and bind_tcp_rc4 from static shellcode
substitution payloads to metasm compiled assembly approach.

Splits up metasm methods for bind_tcp and reverse_tcp into socket
creation and block_recv to allow for reuse of the socket methods
with the RC4 payloads, while substituting the block_recv methods
for those carrying the appropriate decryptor stubs.

Creates a new rc4 module carrying the bulk of the decryptor and
adjacent convenince methods for standard payload generation.

Testing:
 Tested against Win2k8r2, Win7x64, and WinXPx86

ToDo:
 Ensure all the methods around payload sizing, UUIDs, and other
new functionality, the semantics of which i do not yet fully
understand, are appropriate and do not introduce breakage.
2016-05-23 14:27:11 -05:00
Christian Mehlmauer 7fcddd5a05
Add axis2 payload generator 2016-05-12 22:48:07 +02:00
OJ b95267997d Fix LURI support for stageless, transport add/change and code tidies 2016-04-18 08:24:41 -05:00
Rory McNamara 7eda08aa2e windows/x64 support 2016-04-18 08:16:35 -05:00
Rory McNamara 1e16804c63 size considerations for LURI, stageless 2016-04-18 08:16:35 -05:00
Rory McNamara b122dffe3d initial LURI commit. windows, python functional 2016-04-18 08:13:10 -05:00
James Lee c21bad78e8
Fix some more String defaults 2016-03-16 14:13:18 -05:00
Brent Cook 85acfabfca remove various library workarounds for the datastore not preserving types 2016-03-05 23:10:57 -06:00
Tim 5d0e868fd6 facebook.orca fixes 2015-12-24 12:21:08 +00:00
Tim 69b65e7d39 fix error handling 2015-12-24 09:13:56 +00:00
Tim eeea4bde9d integrate ./msfvenom -x for android payloads 2015-12-22 15:58:27 +00:00
Tim 662a6dfd53 ¯\_(ツ)_/¯ 2015-12-22 14:49:00 +00:00
Spencer McIntyre 388edd3207 Fix the scheme for the pymet ProxyHandler 2015-11-30 13:45:24 -05:00
Spencer McIntyre fba9715a56 Add stageless python meterpreter http & https payloads 2015-11-28 17:41:55 -05:00
Spencer McIntyre 1b495e73ac Further reduce python reverse_http duplicate code 2015-11-26 14:31:00 -05:00
Spencer McIntyre bd25ffa48c Consolidate py reverse http uri code into a mixin 2015-11-26 13:32:50 -05:00
Jon Cave d9655fc882 Use LPORT if opts[:lport] is undefined
`nil.to_i` returns 0 which will short circuit the || resulting in port 0
being used. nil should be checked for prior to casting to int.
2015-11-26 16:08:22 +00:00
Brent Cook 5654b6b2e2 Land #6227, reverse_hop_http updates and HTTPS unification 2015-11-23 06:29:15 -06:00
sammbertram 9d9865150b Transport priority changes
Default transport request should set the priority to the Host: request header, and the subsequent OverrideRequestHost, OverrideLHOST, and OverrideLPORT options in the handler for reverse_http(s).
2015-11-13 13:19:01 +00:00
scriptjunkie 8703987535 Add HTTPS and new transport support for hop 2015-11-11 21:25:23 -06:00
void-in f629f98fdc Resolve 6174, require meterpreter_options 2015-10-31 18:47:22 +05:00
Spencer McIntyre 8bb694fa5c Add stageless Python Meterpreter for reverse tcp 2015-10-21 18:23:04 -04:00
wchen-r7 8aed503ad2 Change EXITFUNC acceptable options
This gets rid of the nil option because this is the same as "".
And then we change the empty value to ''.
2015-10-08 16:52:17 -05:00
Brent Cook 2769d66bfc Check if the payload has a include_send_uuid method before calling it
Otherwise we get an undefined method exception and the payload fails to stage.
Fixes #6040
2015-10-05 15:13:11 -05:00
OJ 22c424a4c6 Fix CreatProcessA stack alignment in prependmigrate x64 2015-10-01 10:24:13 +10:00
OJ b35a0166bf
Merge branch 'upstream/master' into fix-prepend-https 2015-10-01 09:07:28 +10:00
Brent Cook 54f9a3b25a
Land #6013, add mainframe as a platform and architecture 2015-09-29 13:28:23 -05:00
jvazquez-r7 9444c8c410
Fix #5988, windows x64 stagers
* Also, use mov esi, esi to save an extra byte
* Also, modify the block_recv.asm code, just to have it up to date
2015-09-28 15:52:50 -05:00
bigendian smalls ff87fbc976
Added a mainframe.rb in core/payload
Base module for payloads to be developed on the mainframe / SystemZ
(z/os mvs) architecture
2015-09-28 10:06:09 -05:00
OJ 46e00389c4 Adjust payload size for stageless in prepend migrate 2015-09-22 18:07:53 +10:00
Brent Cook 1440f31756
Land #5637, resiliency improvements to TCP stagers 2015-09-02 22:50:12 -05:00
OJ 9767de9bd0 Truncate payload size to 32 bits 2015-09-03 11:56:59 +10:00
OJ e141d1451c Fix calls to stage_payload 2015-08-10 09:33:38 +10:00
OJ 0929d7695a Fix PHP stagers 2015-07-23 14:50:04 +10:00
OJ 121fe1adda
Land #5654 : Python Meterpreter Transport 2015-07-22 10:39:06 +10:00
OJ 51f59b3c8c Re-add URI generation to reverse_http 2015-07-10 16:21:55 +10:00
Brent Cook 0b59e63084 keep advanced options on the fat side of the conditional 2015-07-07 22:44:34 -05:00
Brent Cook 23abc288c8 Resolved conflicts with master 2015-07-07 22:34:30 -05:00
Spencer McIntyre 2a89e248d7 Pymet fix send uuid logic for Python 3.x 2015-07-06 11:20:34 -04:00
OJ aaaf6807ed Minor indentation/space fixes 2015-07-05 09:18:27 +10:00