Commit Graph

1055 Commits (7790f14af2d5a137792461b9dd6bf1e1c4a292ab)

Author SHA1 Message Date
Jack64 97f4ec72f9 minor fixes 2015-07-20 01:20:36 +01:00
Jack64 ad86a72918 send_sms + wlan_geolocate 2015-07-20 01:16:58 +01:00
William Vu 6685fc479b Add multi-glob filesystem search to Meterpreter 2015-07-14 20:23:23 +00:00
rwhitcroft 0a581be9f9 put -u back for removing transports 2015-07-13 12:10:32 -04:00
OJ 4fc258ec0c Remove duplicate entries, allow for output to file
This commit does a few tidies of code, as well as adds the ability to
write all the kiwi output to disk as well as to the console. We can't
yet add this stuff to the credential DB because it's tied to machine,
where the creds that come out of kiwi are often tied to domains.

This also removes duplicate creds from the output list, and gets rid of
the auth id stuff from the output too (not sure why it was useful
before).
2015-07-13 14:17:31 +10:00
rwhitcroft eaa0d0a44e first msg was better 2015-07-11 22:50:38 -04:00
rwhitcroft 508c9f55df specify transports by index 2015-07-11 22:22:50 -04:00
Joshua Smith 5be94c12b6
Land #5602, adds irb -e to core 2015-07-02 16:21:20 -05:00
Joshua Smith 434cffa258 clean up so idiomatic ruby details 2015-07-02 16:16:57 -05:00
Spencer McIntyre 0af397217c Merge pymet transport feature into fresh branch 2015-07-02 08:43:13 -04:00
wchen-r7 a17b27efce Update descriptions 2015-07-01 21:47:51 -05:00
wchen-r7 caddf545c4 Make getsystem more verbose
Resolves #4401
2015-07-01 20:49:14 -05:00
Tod Beardsley 37ac5f0ee3 Use environment variables for Program Files
Done, thanks @Meatballs1 !
2015-06-30 17:28:21 -05:00
Spencer McIntyre 7aae9b210e Add pymet support for core_enumextcmd 2015-06-26 11:32:51 -04:00
OJ f6ae1f4223
Merge branch 'upstream/master' into android-java-transport-refactor 2015-06-26 14:12:56 +10:00
OJ 5a24dc8e64 Enable the transport command for java 2015-06-25 14:08:41 +10:00
Spencer McIntyre f9642da387 Support expressions for meterpreter's irb too 2015-06-24 21:02:18 -04:00
Brent Cook 5c65c58fdf
Land #5598:handle nil or short machine_ids gracefully 2015-06-24 19:11:08 -05:00
HD Moore 24a6e4c110 Comment update 2015-06-24 16:33:07 -05:00
HD Moore 4d58e49cdc
Land #5600, update session info after migrate 2015-06-24 15:16:58 -05:00
Meatballs 151fa2f676
Update user info on migrate 2015-06-24 20:50:29 +01:00
HD Moore aa9ea13934 Fix up the core_machine_id call to handle weirdness better 2015-06-24 11:44:54 -07:00
Brent Cook e696d2f3dc Merge branch 'master' into land-5348-ntds 2015-06-22 17:18:13 -05:00
Brent Cook 6a0a410cad fix minor issue typing 'transport remove'
meterpreter > transport remove
[-] Error running command transport: NoMethodError undefined method `end_with?' for nil:NilClass
2015-06-22 16:56:16 -05:00
Brent Cook 732192aeaf move ntds from priv to extapi 2015-06-22 09:04:08 -05:00
Meatballs 65adb7a770
Inlcude interactive channel logging 2015-06-21 17:00:51 +01:00
OJ 8656add0ad Add uri parameter when removing http/s transports 2015-06-19 10:55:22 +10:00
OJ 9573c7e415 Implement transport remove 2015-06-16 11:38:59 +10:00
David Maloney 2a474c8375
Merge branch 'master' into feature/MSP-12358/ntds-dump-module 2015-06-08 11:42:03 -05:00
Brent Cook 346ea40d66 fix some alignment, add usage 2015-06-04 16:14:31 -05:00
Brent Cook 06cc759080 Use the correct help output for the ps command
It should not look like this:

```
meterpreter > ps -h
Usage: ps [ options ]

OPTIONS:
 -S       Search string to filter by
 -h 		This help menu
```

It should not not look like this:

```
meterpreter > ps -h
Use the command with no arguments to see all running processes.
The following options can be used to filter those results:

OPTIONS:

    -A <opt>  Filters processes on architecture (x86 or x86_64)
    -S <opt>  String to search for (converts to regex)
    -U <opt>  Filters processes on the user using the supplied RegEx
    -h        Help menu.
    -s        Show only SYSTEM processes
```
2015-06-04 16:06:07 -05:00
OJ 1c73c190fc Add machine_id support to windows php meterp 2015-05-22 14:55:29 +10:00
OJ 10bd75348c
Merge branch 'upstream/master' into uuid-stagers 2015-05-22 13:07:25 +10:00
RageLtMan e9be0d3f7a Allow cmd_arp to use -S flag
Allow searching for regex' through ARP output using Table's new
'SearchTerm' parameter.

Example:
```
meterpreter > arp -S 10.2.1.1

ARP cache
=========

    IP address   MAC address        Interface
    ----------   -----------        ---------
    10.2.1.1     00:01:02:03:04:05  15
```
2015-05-20 11:26:06 -05:00
RageLtMan b20c1c51b5 Import -S option for netstat
Allow searching through netstat output tables for specific strings.

Example:
```
meterpreter > netstat -S 192

Connection list
===============

    Proto  Local address    Remote address         State        User  Inode  PID/Program name
    -----  -------------    --------------         -----        ----  -----  ----------------
    tcp    10.1.1.20:3389   192.168.100.186:38470  ESTABLISHED  0     0      3076/svchost.exe
    tcp    10.1.1.20:63826  192.168.100.186:31158  ESTABLISHED  0     0      4568/powershell.exe
    tcp    10.1.1.20:64887  192.168.100.186:31158  ESTABLISHED  0     0      -
```
2015-05-20 11:26:06 -05:00
Brent Cook e4165d3ae0 whitespace fixes
from @sempervictus
2015-05-20 11:26:04 -05:00
Brent Cook 66bd881ac5 support filtering on processes with a regex
from @sempervictus

Merge forked changes to cmd_ps allowing for the use of string
matching on listing output via Rex::Ui::Text::Table's SearchTerm
facility

Example:
```
meterpreter > ps -S x64.*Auth.*Sys

Process list
============

 PID   Name                       Arch  Session  User                          Path
 ---   ----                       ----  -------  ----                          ----
 400   smss.exe                   x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\smss.exe
...
```
2015-05-20 11:25:56 -05:00
Brent Cook 6fd82ad996 add cp / copy commands
from @sempervictus
2015-05-20 11:25:36 -05:00
Brent Cook 282c7eb81e add -S regex search to ls, normalize arg parsing
from @sempervictus

Merge forked changes to cmd_ls allowing for the use of string
matching on listing output via Rex::Ui::Text::Table's SearchTerm
facility.

Example:

```
meterpreter > ls chef -R -S wget
No entries exist in chef/backup/chef/handlers
No entries exist in chef/backup/chef/ohai_plugins
No entries exist in chef/backup/chef
No entries exist in chef/backup
No entries exist in chef/cache/cookbooks/avast/attributes
No entries exist in chef/cache/cookbooks/avast/recipes
No entries exist in chef/cache/cookbooks/avast
No entries exist in chef/cache/cookbooks/chef-client/attributes
No entries exist in chef/cache/cookbooks/chef-client/libraries
No entries exist in chef/cache/cookbooks/chef-client/recipes
No entries exist in chef/cache/cookbooks/chef-client
No entries exist in chef/cache/cookbooks/chef_handler/attributes
No entries exist in chef/cache/cookbooks/chef_handler/libraries
No entries exist in chef/cache/cookbooks/chef_handler/providers
No entries exist in chef/cache/cookbooks/chef_handler/recipes
No entries exist in chef/cache/cookbooks/chef_handler/resources
No entries exist in chef/cache/cookbooks/chef_handler
No entries exist in chef/cache/cookbooks/cron/providers
No entries exist in chef/cache/cookbooks/cron/recipes
No entries exist in chef/cache/cookbooks/cron/resources
No entries exist in chef/cache/cookbooks/cron
No entries exist in chef/cache/cookbooks/logrotate/attributes
No entries exist in chef/cache/cookbooks/logrotate/definitions
No entries exist in chef/cache/cookbooks/logrotate/libraries
No entries exist in chef/cache/cookbooks/logrotate/recipes
No entries exist in chef/cache/cookbooks/logrotate
No entries exist in chef/cache/cookbooks/ohai/attributes
No entries exist in chef/cache/cookbooks/ohai/files/default/plugins
No entries exist in chef/cache/cookbooks/ohai/files/default
No entries exist in chef/cache/cookbooks/ohai/files
No entries exist in chef/cache/cookbooks/ohai/recipes
No entries exist in chef/cache/cookbooks/ohai
No entries exist in chef/cache/cookbooks/svit-windows/attributes
No entries exist in chef/cache/cookbooks/svit-windows/recipes
No entries exist in chef/cache/cookbooks/svit-windows/templates/default/plugins
No entries exist in chef/cache/cookbooks/svit-windows/templates/default
No entries exist in chef/cache/cookbooks/svit-windows/templates
No entries exist in chef/cache/cookbooks/svit-windows
No entries exist in chef/cache/cookbooks/windows/attributes
No entries exist in chef/cache/cookbooks/windows/files/default/handlers
No entries exist in chef/cache/cookbooks/windows/files/default
No entries exist in chef/cache/cookbooks/windows/files
No entries exist in chef/cache/cookbooks/windows/libraries
No entries exist in chef/cache/cookbooks/windows/providers
No entries exist in chef/cache/cookbooks/windows/recipes
No entries exist in chef/cache/cookbooks/windows/resources
No entries exist in chef/cache/cookbooks/windows
No entries exist in chef/cache/cookbooks
No entries exist in chef/cache
No entries exist in chef/handlers
No entries exist in chef/log
No entries exist in chef/ohai_plugins
No entries exist in chef/run
Listing: chef
=============

Mode              Size  Type  Last modified              Name
----              ----  ----  -------------              ----
100666/rw-rw-rw-  161   fil   2014-07-21 11:08:26 -0400  wget.ps1
100666/rw-rw-rw-  1285  fil   2014-07-21 11:08:26 -0400  wget.vbs

meterpreter >
```
2015-05-20 11:25:33 -05:00
Stuart Morgan b2aef62a40 MSFTidy 2015-05-19 14:42:30 +01:00
Stuart Morgan ea4d3415ec Continued to tidy up code, added verbose mode to assist in debugging 2015-05-19 12:21:00 +01:00
Stuart Morgan d704e95890 Tidying up 2015-05-19 11:34:25 +01:00
Stuart Morgan e152ceb05d Tidied up code, added MWR labs logo 2015-05-19 10:33:32 +01:00
Stuart Morgan a4fc8aefd5 Working, tested & cleans up after itself 2015-05-19 10:21:08 +01:00
Stuart Morgan b749d44c6a Tidied up working version, logic has now moved to a POST module 2015-05-19 10:00:50 +01:00
Stuart Morgan 2d2032c96b Merge remote-tracking branch 'upstream/master' into pageant_extension 2015-05-19 09:20:58 +01:00
OJ 4488a5e634 Add uuid support to python, and rework stages/stagers 2015-05-18 14:33:35 +10:00
OJ d725554a87 Fix UUID code so that it always deals with 16 bytes
Also re-add the payload ID to session validation now that the UUID stuff
is reliable.
2015-05-17 17:49:21 +10:00
Brent Cook b1507f6d2a
Land #5339, support for 'sleep' with meterpreter sessions 2015-05-15 18:14:37 -05:00
Brent Cook fb3a2079f2 Merge branch 'master' into land-5339-sleep 2015-05-15 18:00:52 -05:00
David Maloney 7d44d6d67a
client side for new sysinfo fields
added Domain and Logged On Users fields to
the meterpreter sysinfo command

MSP-12715
2015-05-15 15:09:33 -05:00
Brent Cook 93ba08738c add backward compatibility for hash responses 2015-05-15 11:53:12 -05:00
Brent Cook c614f6059d Merge branch 'master' into land-5326- 2015-05-15 11:29:54 -05:00
Stuart Morgan c8174119bf Initial working pageant extension 2015-05-15 11:29:20 +01:00
OJ 1ff6d6298e Remove stray comma causing help to be incorrect 2015-05-15 09:23:55 +10:00
OJ 7c013c0486
Merge branch 'upstream/master' into add-transport-sleep 2015-05-15 08:00:04 +10:00
David Maloney 6e813f6abd
Merge branch 'master' into feature/MSP-12357/meterp-ntds 2015-05-14 10:30:48 -05:00
OJ 83fbd41970 Merge branch 'upstream/master' into multi-transport-support
Conflicts:
	Gemfile.lock
	modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb
2015-05-14 14:50:25 +10:00
OJ 60d331fe0c Add support for a "sleep" command
This makes meterpeter shut down it's comms and sleep for a while before
it attempts to open communications again. This is effectively the same
as doing a transport change back to the same transport, but with
a timeout.
2015-05-13 10:13:08 +10:00
OJ 836feaa2d8 Fix uuid setting, fix reverse_https x64 payload
The payload changes in this PR will be fixed up/removed in the
update-x64-stagers PR.
2015-05-12 10:24:11 +10:00
David Maloney f3effe5fbb
some minor cleanup
cleanup based on feedback from Kronicdeth

MSP-12357
2015-05-11 11:17:58 -05:00
Tim d3ba84b378
Add TLV_TYPE_FILE_HASH 2015-05-10 14:18:16 +01:00
jvazquez-r7 c103779eab
Land #5080, @bcook-r7's 'ls' and 'download' meterpreter improvements 2015-05-08 18:02:16 -05:00
jvazquez-r7 422e261b36
Use parenthesis 2015-05-08 17:59:04 -05:00
Brent Cook 2f9205abc3 recover consistent parenthesis usage 2015-05-08 14:15:06 -05:00
Brent Cook 8d5ef42c2d be sure to pass the pattern more than one level deep 2015-05-08 14:03:12 -05:00
Brent Cook 710a2a007b fix format error 2015-05-05 15:27:06 -05:00
David Maloney 1a8e8c624c
Merge branch 'master' into feature/MSP-12357/meterp-ntds 2015-05-05 11:07:36 -05:00
OJ 62fa14326d Merge branch 'upstream/master' into multi-transport-support
Merged with HD's stuff as he fixed up a few things that I had done too.

Conflicts:
	lib/msf/base/sessions/meterpreter_options.rb
	lib/rex/post/meterpreter/client_core.rb
	lib/rex/post/meterpreter/packet_dispatcher.rb
2015-05-05 17:18:01 +10:00
OJ c540ba4b98
Land #5297 : Track machine_id and dead sessions 2015-05-05 17:08:39 +10:00
OJ 852961f059 Tweaking of transport behaviour, removal of patch 2015-05-05 11:45:22 +10:00
OJ b42f4f5cd2 Merge branch 'upstream/master' into multi-transport-support
Conflicts:
	lib/msf/core/payload/windows/stageless_meterpreter.rb
	lib/msf/core/payload/windows/x64/stageless_meterpreter.rb
	lib/rex/post/meterpreter/client_core.rb
	modules/payloads/stages/linux/x86/meterpreter.rb
	modules/payloads/stages/windows/meterpreter.rb
	modules/payloads/stages/windows/x64/meterpreter.rb
2015-05-05 07:53:54 +10:00
OJ e45bf5cf51 Remove the URI patcher now that it's not used at all 2015-05-05 07:35:49 +10:00
Brent Cook 05e4af8162
Land #5214, initial meterpreter session recovery support 2015-05-04 16:25:27 -05:00
Brent Cook e6ea5511ca update linux and windows meterpreters to use metasploit-payloads 2015-05-04 09:44:36 -05:00
Brent Cook f42334414a add recursion limit 2015-05-04 04:00:58 -05:00
Brent Cook 7ff3044552 style cleanups and guard search where not implemented 2015-05-04 03:56:17 -05:00
Brent Cook 8cab350275 use the search API when downloading recursive patterns 2015-05-04 03:56:17 -05:00
Brent Cook eefc6f78c6 avoid redownloading files that have not changed 2015-05-04 03:56:16 -05:00
Brent Cook 9672a59b05 support download globbing 2015-05-04 03:56:16 -05:00
Brent Cook 43be856b95 keep the glob going into subdirectories 2015-05-04 03:56:16 -05:00
Brent Cook 8617115483 simplify arg parsing, compute initial stat path correctly 2015-05-04 03:56:15 -05:00
Brent Cook d934027b3b expand glob match 2015-05-04 03:56:15 -05:00
Brent Cook 866955b6fd added -R recursive, glob filtering and a dummy '-l' option 2015-05-04 03:56:14 -05:00
HD Moore a577bef9c3 Rework dirty cleanup to use skip_cleanup instead 2015-05-04 03:52:55 -05:00
HD Moore e7ba6e8a9a Speed up dead session cleanup by skipping shutdown/cleanup 2015-05-04 03:40:48 -05:00
HD Moore 3080feb188 Track the machine_id and drop non-responsive sessions automatically 2015-05-04 03:22:29 -05:00
OJ 451484cb0d Add support for transport listing
Includes a verbose flag for the extra HTTP/S properties
2015-05-04 11:19:53 +10:00
HD Moore 8ca66e03aa Track and display the last checkin time for Meterpreter sessions 2015-05-03 10:52:54 -05:00
OJ 2189c6d868 Pass timeouts to clients and correctly patch timeouts
Timeouts are correctly passed through to the client instances from the
handlers. The cilent also passes those values through to the RDI code so
that the binaries are correctly patched.
2015-05-02 10:01:32 +10:00
David Maloney acb833bd09
NTDS::Parser class built out
the NTDS Parser class will take a meterpreter
client and a fielpath and provide an enumerator for reading
out the user accounts as ruby objects

MSP-12357
2015-04-30 14:57:30 -05:00
OJ 8ddd7a4891 Fix session removal code, prevent missing transport param fail 2015-04-30 22:39:48 +10:00
OJ 919b96e4cf Fix up UUID handling 2015-04-28 21:59:19 +10:00
OJ 4f9c8d04a2 Add support for moving transports and uuid fetching
The 'next' and 'prev' commands were added so that the session can jump
transports without having to add new ones at the same time.

There's also a command which gives the UUID now so that this can be
reused across sessions.
2015-04-28 20:24:44 +10:00
OJ f711e5dee7 Update migration support
Migration now uses the new meterpreter loader. Migration configuration
is loaded and created by meterpreter on the fly, and supports the
multiple transport stuff that's just been wired in.
2015-04-28 17:41:43 +10:00
Tod Beardsley 9aaa2ec8cc
First pass at making webcam_chat more functional 2015-04-27 16:23:35 -05:00
David Maloney 6c77c4bb52
opening groundwork
added a priv extension method to open
a stream channel to read ntdsaccounts from
and an NTDS account class to accept the
data and parse it into a useable structure

MSP-12357
2015-04-24 15:50:12 -05:00
Spencer McIntyre edbf9b766f
Land #5100, @bcook-r7's deletekey API usage fix
Fixes #5099
2015-04-21 12:58:02 -04:00
OJ c8bab6ace1 Fix help for timeouts 2015-04-21 20:35:46 +10:00
OJ f654fea9b3 Adjust transport command to work with posix 2015-04-21 20:16:57 +10:00