fe9972cc25
fork early and use WfsDelay
2016-12-13 17:02:23 +08:00
891fccb4e2
add pattern for GT-S7392
2016-12-13 17:02:23 +08:00
07ce7f3aed
fix make run
2016-12-13 17:02:23 +08:00
9ece45a180
dont exit(0) when exploit fails
2016-12-13 17:02:23 +08:00
ebf7ae0739
add CVE-2013-6282, put_user/get_user exploit for Android
2016-12-13 17:02:23 +08:00
31b593ac67
Land #7402 , Add Linux local privilege escalation via overlayfs
2016-11-01 12:46:40 -05:00
0d1fe20ae5
revamped
2016-10-15 20:57:31 -04:00
12493d5c06
moved c code to external sources
2016-10-13 20:37:03 -04:00
36b989e6d7
Initial import of .NET compiler and persistence
...
Add Exploit::Powershell::DotNet namespace with compiler and
runtime elevator.
Add compiler modules for payloads and custom .NET code/blocks.
==============
Powershell-based persistence module to compile .NET templates
with MSF payloads into binaries which persist on host.
Templates by @hostess (way back in 2012).
C# templates for simple binaries and a service executable with
its own install wrapper.
==============
Generic .NET compiler post module
Compiles .NET source code to binary on compromised hosts.
Useful for home-grown APT deployment, decoy creation, and other
misdirection or collection activities.
Using mimikatz (kiwi), one can also extract host-resident certs
and use them to sign the generated binary, thus creating a
locally trusted exe which helps with certain defensive measures.
==============
Concept:
Microsoft has graciously included a compiler in every modern
version of Windows. Although executables which can be easily
invoked by the user may not be present on all hosts, the
shared runtime of .NET and Powershell exposes this functionality
to all users with access to Powershell.
This commit provides a way to execute the compiler entirely in
memory, seeking to avoid disk access and the associated forensic
and defensive measures. Resulting .NET assemblies can be run
from memory, or written to disk (with the option of signing
them using a pfx cert on the host). Two basic modules are
provided to showcase the functionality and execution pipeline.
Usage notes:
Binaries generated this way are dynamic by nature and avoid sig
based detection. Heuristics, sandboxing, and other isolation
mechanisms must be defeated by the user for now. Play with
compiler options, included libraries, and runtime environments
for maximum entropy before you hit the temmplates.
Defenders should watch for:
Using this in conjunction with WMI/PS remoting or other MSFT
native distributed execution mechanism can bring malware labs
to their knees with properly crafted templates.
The powershell code to generate the binaries also provides a
convenient method to leave behind complex trojans which are not
yet in binary form, nor will they be until execution (which can
occur strictly in memory avoiding disk access for the final
product).
==============
On responsible disclosure: I've received some heat over the years
for prior work in this arena. Everything here is already public,
and has been in closed PRs in the R7 repo for years. The bad guys
have had this for a while (they do their homework religiously),
defenders need to be made aware of this approach and prepare
themselves to deal with it.
2016-10-08 14:05:53 -05:00
0e82ced082
Add LPE exploit module for the capcom driver flaw
...
This commit includes:
* RDI binary that abuses the SMEP bypass and userland function pointer
invocation that is provided by the driver.
* Related metasploit module.
* Associated make.build to build from command line.
* Updated command line build file.
This also includes the beginnings of a new set of functions that help
with the management/automation of kernel-related work on Windows for
local priv esc exploits.
2016-09-27 22:37:45 +10:00
21e6211e8d
add exploit for cve-2016-0189
2016-08-01 13:26:35 -05:00
7b1d9596c7
Land #7068 , Introduce 'mettle' - new POSIX meterpreter
2016-07-11 22:38:40 -05:00
b4b3a84fa5
refactor ms16-016 code
2016-07-05 20:50:43 -05:00
0390ed4d6e
Add MIPS O32 Linux support (big and little endian)
2016-07-05 11:24:54 -05:00
8de508c4e0
Add mettle module for ARM
2016-07-05 11:24:54 -05:00
3147553d4f
armeb comments modified
2016-06-10 19:59:59 +02:00
26680f58ca
Original shellcode added for Linux ARM big endian bind ipv4 tcp
2016-06-10 19:19:16 +02:00
6eda702b25
Land #6292 , add reverse_tcp command shell for Z/OS (MVS)
2015-12-23 14:11:37 -06:00
5a19caf10a
remove temp file
2015-12-23 11:42:09 -06:00
eb4611642d
Add Jenkins CLI Java serialization exploit module
...
CVE-2015-8103
2015-12-11 14:57:10 -06:00
09d63de502
Added revshell shellcode source
...
Put shell_reverse_tcp.s shellcode source for mainframe reverse shell
into external/source/shellcode/mainframe
2015-12-01 08:26:42 -06:00
4eaf1ace81
Bugfix loading address of library path into rcx
...
The old code breaks if the payload is executed from a memory area where the 4 most significant bytes are non-zero.
2015-11-02 16:56:07 +01:00
9444c8c410
Fix #5988 , windows x64 stagers
...
* Also, use mov esi, esi to save an extra byte
* Also, modify the block_recv.asm code, just to have it up to date
2015-09-28 15:52:50 -05:00
2c9734f178
Add exploit source
2015-09-15 14:54:05 -05:00
6e857568e0
Delete comments
2015-09-03 13:33:40 -05:00
b39575928e
Update reflective exploit
2015-09-03 11:01:41 -05:00
ecf3fb61d6
Replace external source
2015-08-26 15:32:50 -05:00
d54249370b
Move tpwn source to external/source/exploits
2015-08-17 18:27:47 -05:00
7113c801b1
Land #5732 , reliability update for adobe_flash_hacking_team_uaf
2015-07-17 16:43:39 -05:00
255d8ed096
Improve adobe_flash_opaque_background_uaf
2015-07-16 14:56:32 -05:00
ab5c7a806e
Update flash exploiter
2015-07-15 18:32:45 -05:00
bd5d372436
Add build comment
2015-07-15 18:30:05 -05:00
138789b77c
Fix indentation
2015-07-15 18:29:28 -05:00
b504f0be8e
Update adobe_flash_hacking_team_uaf
2015-07-15 18:18:04 -05:00
d6565a9aee
Merge branch 'bes_flash' into bapv2_flash_test
2015-07-14 00:34:54 -05:00
b72ba7f51c
Add AS2 flash detection code
2015-07-13 18:26:02 -05:00
8fb6bedd94
Delete as3 detecotr
2015-07-13 18:23:39 -05:00
9116460cb0
Add prototype with AS3
2015-07-13 16:33:55 -05:00
299978d0e2
Put again old exploiter
2015-07-11 00:36:32 -05:00
63005a3b92
Add module for flash CVE-2015-5122
...
* Just a fast port for the exploit leaked
* Just tested on win7sp1 / IE11
2015-07-11 00:28:55 -05:00
3d630de353
Replace with a real CVE number
2015-07-07 14:44:12 -05:00
d9aacf2d41
Add module for hacking team flash exploit
2015-07-07 11:19:48 -05:00
1de94a6865
Add module for CVE-2015-3113
2015-07-01 13:13:57 -05:00
e49c36998c
Fix indentation
2015-06-25 14:12:23 -05:00
a87d4e5764
Add flash_exploiter template
2015-06-25 13:52:57 -05:00
ee0377ca16
Add module for CVE-2015-3105
2015-06-25 13:35:01 -05:00
2206a6af73
Support older targets x86 for MS15-051
2015-06-25 09:33:15 +10:00
3686accadd
Merge branch 'upstream/master' into cve-2015-1701
2015-06-22 07:52:17 +10:00
b78ba55c25
Merge minor CVE-2015-1701 from zeroSteiner
2015-06-22 07:50:26 +10:00
d73a3a4a5f
Dont call ExitProcess because it might kill the shell
2015-06-21 16:16:33 -04:00
27a583853c
Fix one more line indentation
2015-06-18 12:40:30 -05:00
55f077fa9e
Fix indentation
2015-06-18 12:38:36 -05:00
de1542e589
Add module for CVE-2015-3090
2015-06-18 12:36:14 -05:00
17b8ddc68a
Land #5524 , adobe_flash_pixel_bender_bof in flash renderer
2015-06-15 02:42:16 -05:00
72672fc8f7
Delete debug
2015-06-11 17:39:36 -05:00
8ed13b1d1b
Add linux support for CVE-2014-0515
2015-06-11 16:18:50 -05:00
ae21b0c260
Land #5523 , adobe_flash_domain_memory_uaf in the flash renderer
2015-06-10 16:59:19 -05:00
4c5b1fbcef
Land #5522 , adobe_flash_worker_byte_array_uaf in the flash renderer
2015-06-10 14:49:41 -05:00
af31112646
Fix exploit indentation
2015-06-10 14:19:36 -05:00
64562565fb
Fix method indentation
2015-06-10 14:16:47 -05:00
2bb3a5059c
Fix else indentation
2015-06-10 14:15:58 -05:00
1d05ce1cdc
Fix for indentation
2015-06-10 14:14:29 -05:00
7202e27918
Fix indentation
2015-06-10 14:12:26 -05:00
ab132290d7
Add Exploiter AS
2015-06-10 13:53:45 -05:00
6c7ee10520
Update to use the new flash Exploiter
2015-06-10 13:52:43 -05:00
0d2454de93
Fix indentation
2015-06-10 12:27:52 -05:00
7fba64ed14
Allow more search space
2015-06-10 12:26:53 -05:00
ecbddc6ef8
Play with memory al little bit better
2015-06-10 11:54:57 -05:00
d622c782ef
Land #5519 , adobe_flash_uncompress_zlib_uninitialized in the flash renderer
2015-06-10 11:52:47 -05:00
667db8bc30
Land #5517 , adobe_flash_casi32_int_overflow (exec from the flash renderer)
2015-06-10 11:39:13 -05:00
2b4fe96cfd
Tweak Heap Spray
2015-06-10 10:56:24 -05:00
a6fe383852
Use AS Exploiter
2015-06-10 09:32:52 -05:00
64b486eeac
Change filename
2015-06-10 09:12:52 -05:00
d95a0f432d
Update AS codE
2015-06-10 09:12:25 -05:00
e5d6c9a3cb
Make last code cleanup
2015-06-09 16:01:57 -05:00
d9db45690f
Delete debug messages
2015-06-09 15:47:59 -05:00
cf8c6b510b
Debug version working
2015-06-09 15:46:21 -05:00
f4649cb3fb
Delete old AS
2015-06-09 14:50:59 -05:00
4f1ee3fcdf
Really fix indentation
2015-06-09 12:42:32 -05:00
5bab1cfc68
Fix indentation
2015-06-09 12:38:24 -05:00
39851d277d
Unset debug flag
2015-06-09 11:36:09 -05:00
b7f0fad72f
Modify CVE-2014-0569 to use the flash exploitation code
2015-06-09 11:31:39 -05:00
5a6a16c4ec
Resolve #4326 , remove msfpayload & msfencode. Use msfvenom instead!
...
msfpayload and msfencode are no longer in metasploit. Please use
msfvenom instead.
Resolves #4326
2015-06-08 11:30:04 -05:00
b291d41b76
Quick hack to remove hard-coded offsets
2015-06-05 13:19:41 +10:00
51d98e1008
Update AS code
2015-06-04 18:34:08 -05:00
02181addc5
Update CVE-2014-0556
2015-06-04 18:23:50 -05:00
23df66bf3a
Land #5481 , no powershell. exec shellcode from the renderer process.
2015-06-04 15:45:09 -05:00
75454f05c4
Update AS source code
2015-06-04 12:12:49 -05:00
80cb70cacf
Add support for Windows 8.1/Firefox
2015-06-03 22:46:04 -05:00
74117a7a52
Allow to execute payload from the flash renderer
2015-06-03 16:33:41 -05:00
455a3b6b9d
Add butchered version of CVE-2015-1701
2015-06-03 21:48:23 +10:00
e9714bfc82
Solve conflics
2015-05-27 23:22:00 -05:00
e749733eb6
Land #5419 , Fix Base64 decoding on ActionScript
2015-05-27 23:13:51 -05:00
e5d42850c1
Add support for Linux to CVE-2015-0336
2015-05-27 17:05:10 -05:00
801deeaddf
Fix CVE-2015-0336
2015-05-27 15:42:06 -05:00
bd1bdf22b5
Fix CVE-2015-0359
2015-05-26 17:27:20 -05:00
19c7445d9d
Fix CVE-2015-0336
2015-05-26 17:20:49 -05:00
23d244b1fa
Fix CVE-2015-0313
2015-05-26 16:11:44 -05:00
5c8c5aef37
Fix CVE-2014-8440
2015-05-26 16:05:08 -05:00
da362914e2
Fix indentation
2015-05-26 15:50:31 -05:00
d78d04e070
Fix CVE-2014-0569
2015-05-26 15:49:22 -05:00
e0a1fa4ef6
Fix indentation
2015-05-26 15:38:56 -05:00
1742876757
Fix CVE-2014-0556
2015-05-26 15:30:39 -05:00
a1538fc3ba
Update AS code
2015-05-26 15:18:01 -05:00
f35d7a85d3
Adjust numbers
2015-05-21 15:56:11 -05:00
a8e9b0fb54
Update ActionScript
2015-05-21 14:58:38 -05:00
51bb4b5a9b
Add module for CVE-2015-0359
2015-05-07 17:00:00 -05:00
582919acac
Add module for CVE-2015-0336
2015-05-05 17:25:19 -05:00
b07a864416
Fix as indentation
2015-04-29 19:01:11 -05:00
dbba466b5b
Add module for CVE-2014-8440
2015-04-29 17:52:04 -05:00
28fac60c81
Add module for CVE-2015-0556
2015-04-15 14:08:16 -05:00
91f5d0af5a
Add module for CVE-2014-0569
...
* Adobe flash, Integer overflow on casi32
2015-04-09 19:37:26 -05:00
11c6f3fdca
Do reliable resolution of kernel32
2015-03-29 15:52:13 -05:00
f84a46df63
Add module for CVE-2015-0313
2015-03-27 18:51:13 -05:00
dab4333867
updated asm in block
2015-03-18 16:07:46 -04:00
bb81107e51
Land #4927 , @wchen-r7's exploit for Flash PCRE CVE-2015-0318
2015-03-13 23:58:05 -05:00
2a25e2b2e1
Update Main.as
2015-03-13 11:40:16 -05:00
0ee0a0da1c
This seems to work
2015-03-13 04:43:06 -05:00
0c3329f69e
Back on track
2015-03-12 15:26:55 -05:00
b604599c8e
Fix comments
2015-03-11 21:32:35 -05:00
479a9cc1a9
Fix missing stack variables & remove old comment
2015-03-11 21:23:27 -05:00
7e3b4017f0
Rename and resynced with master, ready for refactoring
2015-03-11 14:36:27 -05:00
ea1bc69e2e
Merge branch 'master' into feature/add-reverse_winhttp-stagers
2015-03-11 14:29:34 -05:00
43b90610b1
Temp
2015-03-11 13:53:34 -05:00
2a9d6e64e2
Starting point for CVE-2015-0318
2015-03-11 09:58:41 -05:00
991e72a4fa
HTTP stager based on WinHttp
2015-03-10 13:40:16 -05:00
14c3848493
Delete useless comment
2015-03-09 16:59:10 -05:00
cb72b26874
Add module for CVE-2014-0311
2015-03-09 16:52:23 -05:00
5297ebc1a1
Merge branch 'master' into land-1396-http_proxy_pstore
...
Bring things back to the future
2015-02-20 08:50:17 -06:00
4da28324e7
expound on java signer build instructions
2015-02-12 16:13:08 -06:00
af405eeb7d
Land #4287 , @timwr's exploit form CVS-2014-3153
2015-02-09 10:33:14 -06:00
aa7f7d4d81
Add DLL source code
2015-02-01 19:59:10 -06:00
89e5a2b892
disable -no-thumb, doesn't work with latest NDK?
2015-01-30 09:36:21 -06:00
47cd5a3e59
Land #4562 , wchen-r7's Win8 NtApphelpCacheControl privilege escalation
2015-01-15 13:52:07 -06:00
7e1b8a1c83
Not needed anymore
2015-01-09 19:05:44 -06:00
c79589509c
Old comment
2015-01-09 19:04:50 -06:00
74e8e057dd
Use RDL
2015-01-09 19:02:08 -06:00
f998bfc246
Update exploit.cpp
2015-01-08 21:37:13 -06:00
eea6ccee1f
Source
2015-01-08 18:43:29 -06:00
844460dd87
Update bypass UAC to work on 8.1 and 2012
...
This commit contains a bunch of work that comes from Meatballs1 and
Lesage, and updates the bypassuac_inject module so that it works on
Windows 8.x and Windows 2012. Almost zero of the code in this module
can be attributed to me. Most of it comes from Ben's work.
I did do some code tidying, adjustment of style, etc. but other than
that it's all down to other people.
2015-01-08 15:39:19 +10:00
9791acd0bf
Add stager ipknock shellcode (PR 2)
2014-12-27 22:03:45 +01:00
e34c37042a
Readd block_hidden_bind_tcp.asm
...
Because stager_hidden_bind_tcp.asm includes it.
2014-12-22 11:13:07 -06:00
c0fa8c0e3f
Add stager for hidden bind shell payload
2014-12-22 17:21:11 +01:00
e3943682a2
Improves linux/armle payloads, lands #3315
2014-12-13 18:27:14 -06:00
e8728943ec
Shave off two more bytes for HTTP(s) stagers
2014-12-13 11:49:30 -06:00
69c938f65a
More shellcode golf
2014-12-13 11:49:15 -06:00
5c50a07c0f
futex_requeue
2014-12-01 03:49:22 +00:00
7772da5e3f
Change paths, add makefile and compile
2014-11-30 21:06:11 -06:00
b6306ef7a2
Move C source to exploits folder
2014-11-30 20:42:53 -06:00
7a3fb12124
Add an OSX privilege escalation from Google's Project Zero.
2014-11-25 12:34:16 -06:00
Tim
William Webb
h00die
RageLtMan
OJ
Pearce Barry
Adam Cammack
EarthQuake
Brent Cook
dmohanty-r7
Bigendian Smalls
Matthias Ganz
jvazquez-r7
William Vu
wchen-r7
Tod Beardsley
Spencer McIntyre
rwhitcroft
HD Moore
Borja Merino
Peregrino Gris
Michael Schierl
Joe Vennix