Commit Graph

385 Commits (a12aed7ffc303434f6eacb0571b6fe17f4a6d7fb)

Author SHA1 Message Date
HD Moore 5d0ebc18cf See #250. Adds a wait() wrapper to the HTTP service as well
git-svn-id: file:///home/svn/framework3/trunk@5927 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-16 21:00:44 +00:00
HD Moore 616491a552 Play nice with ruby implementations without readline and openssl
git-svn-id: file:///home/svn/framework3/trunk@5895 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-12 22:47:21 +00:00
HD Moore f5374fe2d2 Syntax fixups
git-svn-id: file:///home/svn/framework3/trunk@5894 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-12 19:31:11 +00:00
HD Moore 71448fd876 Typo for hashes
git-svn-id: file:///home/svn/framework3/trunk@5891 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-11 22:57:18 +00:00
HD Moore 10266c8e51 Better short read detection from antoine.
git-svn-id: file:///home/svn/framework3/trunk@5889 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-11 17:53:13 +00:00
kris aba3f95026 an empty string is better than a nil type-error (found by playing around, not
from a faulty module or whathaveyou)


git-svn-id: file:///home/svn/framework3/trunk@5878 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-11 04:01:21 +00:00
HD Moore bbb53dd9ea Default max_read to 1M, solves intermittent issues
git-svn-id: file:///home/svn/framework3/trunk@5876 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-10 23:03:16 +00:00
HD Moore b11939759e Fix an ugly error when the response was too small
git-svn-id: file:///home/svn/framework3/trunk@5875 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-10 22:56:25 +00:00
HD Moore f1789fc1b2 Adds the check() method and scanner module to ms08-067, massively upgrades the smb/version scanner, with better SP detection and remote language pack detection.
git-svn-id: file:///home/svn/framework3/trunk@5823 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-03 09:17:08 +00:00
HD Moore 65419ad206 Adds routines/tools for cracking the NTLM hash from the plaintext case-insensive LANMAN password
git-svn-id: file:///home/svn/framework3/trunk@5779 4d416f70-5f16-0410-b530-b9f4589650da
2008-10-22 22:42:52 +00:00
Ramon de C Valle f124597a56 Code cleanups
git-svn-id: file:///home/svn/framework3/trunk@5773 4d416f70-5f16-0410-b530-b9f4589650da
2008-10-19 21:03:39 +00:00
James Lee 36a06e7576 initial commit of php findsock. This patch makes all http connections global and removes the "close if (!pipelining)" checks, so beware of bugs.
git-svn-id: file:///home/svn/framework3/trunk@5678 4d416f70-5f16-0410-b530-b9f4589650da
2008-09-24 04:41:51 +00:00
Ramon de C Valle 58cef5775e Added ARCH_POWER constant and fixed AIX payload modules
git-svn-id: file:///home/svn/framework3/trunk@5663 4d416f70-5f16-0410-b530-b9f4589650da
2008-09-17 01:42:51 +00:00
HD Moore 0ad43aad70 Fix an exception that is encountered when not enough of the DCERPC packet has been read
git-svn-id: file:///home/svn/framework3/trunk@5468 4d416f70-5f16-0410-b530-b9f4589650da
2008-04-04 22:12:59 +00:00
HD Moore 06e47726ba Handle DCERPC reads over SMB pipes in a more efficient fashion. Rename the sadmind exploit, since Solaris is redundant
git-svn-id: file:///home/svn/framework3/trunk@5467 4d416f70-5f16-0410-b530-b9f4589650da
2008-04-04 21:15:55 +00:00
HD Moore 125d114526 Properly handle SMB::pipe_(read|write)_(min|max)
git-svn-id: file:///home/svn/framework3/trunk@5466 4d416f70-5f16-0410-b530-b9f4589650da
2008-04-04 20:54:39 +00:00
HD Moore 74f7fb0cb9 Patch from I)ruid
git-svn-id: file:///home/svn/framework3/trunk@5464 4d416f70-5f16-0410-b530-b9f4589650da
2008-04-02 19:03:42 +00:00
HD Moore 9c7f5d7130 Simple fix for bad calls to negotiate, remove useless disconnect call in the relay daemon
git-svn-id: file:///home/svn/framework3/trunk@5460 4d416f70-5f16-0410-b530-b9f4589650da
2008-03-26 22:36:42 +00:00
HD Moore 509fc09382 Lots of updates related to <secret project X>.
git-svn-id: file:///home/svn/framework3/trunk@5424 4d416f70-5f16-0410-b530-b9f4589650da
2008-03-02 04:46:13 +00:00
HD Moore 6677beb174 Merged revisions 5366-5377 via svnmerge from
svn+ssh://metasploit.com/home/svn/framework3/branches/framework-3.1

........
  r5366 | hdm | 2008-01-26 20:30:53 -0600 (Sat, 26 Jan 2008) | 2 lines
  
  Update version information
........
  r5367 | hdm | 2008-01-26 21:10:57 -0600 (Sat, 26 Jan 2008) | 3 lines
  
  Updated for version 3.1
........
  r5369 | hdm | 2008-01-26 21:13:31 -0600 (Sat, 26 Jan 2008) | 3 lines
  
  Wipe the private directories from the branch. 
........
  r5371 | hdm | 2008-01-27 17:24:24 -0600 (Sun, 27 Jan 2008) | 5 lines
  
  Timeout options added for dcerpc connect and read times. Addition of novell netware as a supported target platform. Inclusion of the serverprotect exploit (still works on the latest version). Addition of the first remote netware kernel exploit that leads to a shell, addition of netware stager and shell, and first draft of the release notes for 3.1
........
  r5372 | hdm | 2008-01-27 17:30:08 -0600 (Sun, 27 Jan 2008) | 3 lines
  
  Formatting, indentation, fixed the static IP embedded in the request
........
  r5373 | hdm | 2008-01-27 20:02:48 -0600 (Sun, 27 Jan 2008) | 3 lines
  
  Correctly trap exploit errors in a way that works with all of the UIs
........
  r5374 | hdm | 2008-01-27 20:23:25 -0600 (Sun, 27 Jan 2008) | 3 lines
  
  More last-minute bug fixes
........
  r5375 | hdm | 2008-01-27 20:37:43 -0600 (Sun, 27 Jan 2008) | 3 lines
  
  Force multi-bind off in netware, correct label display in gtk gui labels
........
  r5376 | hdm | 2008-01-27 20:50:03 -0600 (Sun, 27 Jan 2008) | 3 lines
  
  More exception handling fun
........


git-svn-id: file:///home/svn/framework3/trunk@5378 4d416f70-5f16-0410-b530-b9f4589650da
2008-01-28 03:06:31 +00:00
HD Moore 757b610a59 Fixes #163. Multiple headers with the same value are now squashed into a single long line in the response object.
git-svn-id: file:///home/svn/framework3/trunk@5273 4d416f70-5f16-0410-b530-b9f4589650da
2008-01-06 20:11:02 +00:00
HD Moore dbb22495a6 Unit test for #173 fix
git-svn-id: file:///home/svn/framework3/trunk@5272 4d416f70-5f16-0410-b530-b9f4589650da
2008-01-06 20:07:28 +00:00
HD Moore af9407e7b0 Fixes #173. Handle mixed-case header lookups better
git-svn-id: file:///home/svn/framework3/trunk@5271 4d416f70-5f16-0410-b530-b9f4589650da
2008-01-06 20:06:39 +00:00
HD Moore ad43a641f8 Patch from grutz (see #169). Added constants for SMB2
git-svn-id: file:///home/svn/framework3/trunk@5226 4d416f70-5f16-0410-b530-b9f4589650da
2007-12-27 17:42:32 +00:00
Matt Miller 3b74c476a1 patch from Kris K
git-svn-id: file:///home/svn/framework3/trunk@5210 4d416f70-5f16-0410-b530-b9f4589650da
2007-11-29 06:57:14 +00:00
HD Moore 21d971139b New HTTP NTLM code from Kurt Grutzmacher <grutz@jingojango.net>
git-svn-id: file:///home/svn/framework3/trunk@5143 4d416f70-5f16-0410-b530-b9f4589650da
2007-10-12 01:24:57 +00:00
HD Moore 7498562eb5 Add proxy support to HTTP mixin using modules. Fix socks proxy support.
git-svn-id: file:///home/svn/framework3/trunk@5113 4d416f70-5f16-0410-b530-b9f4589650da
2007-09-24 04:44:44 +00:00
HD Moore 6f23487daa Fixes #117. No longer treat connection: close as a stop-processing case
git-svn-id: file:///home/svn/framework3/trunk@5090 4d416f70-5f16-0410-b530-b9f4589650da
2007-09-09 22:27:27 +00:00
HD Moore bff51b5578 Typo fix
git-svn-id: file:///home/svn/framework3/trunk@5067 4d416f70-5f16-0410-b530-b9f4589650da
2007-07-30 05:21:02 +00:00
HD Moore b4fab66d40 Fixes #128. Applying a one-line typo fix from antoine. Thanks!
git-svn-id: file:///home/svn/framework3/trunk@5052 4d416f70-5f16-0410-b530-b9f4589650da
2007-07-16 13:43:52 +00:00
HD Moore 24aac8b5ae Fixes #127. Applying patch from Alex that solves ASN.1 encoding issues.
git-svn-id: file:///home/svn/framework3/trunk@5049 4d416f70-5f16-0410-b530-b9f4589650da
2007-07-16 01:13:25 +00:00
HD Moore d0b15d3d72 Lots of SMB fun, all preparation for Black Hat talk :-) More to come...
git-svn-id: file:///home/svn/framework3/trunk@5015 4d416f70-5f16-0410-b530-b9f4589650da
2007-07-03 04:20:50 +00:00
HD Moore ddfe651bc8 This adds support for smb_pipeio=trans
git-svn-id: file:///home/svn/framework3/trunk@4915 4d416f70-5f16-0410-b530-b9f4589650da
2007-05-15 16:48:15 +00:00
HD Moore 58a804e510 Small bug fix to allow pipeio on Novell
git-svn-id: file:///home/svn/framework3/trunk@4914 4d416f70-5f16-0410-b530-b9f4589650da
2007-05-15 15:44:39 +00:00
HD Moore e8c5c53e4b This adds pass-the-hash support from grutz.
git-svn-id: file:///home/svn/framework3/trunk@4890 4d416f70-5f16-0410-b530-b9f4589650da
2007-05-09 12:39:29 +00:00
HD Moore ebb84d5b32 Check for typos next time =P
git-svn-id: file:///home/svn/framework3/trunk@4879 4d416f70-5f16-0410-b530-b9f4589650da
2007-05-06 22:33:21 +00:00
bmc 21e37f1b0c * older IIS allowed you to encode multiple times. Expose the ability to encode as many times as you wish. 1 is default
git-svn-id: file:///home/svn/framework3/trunk@4867 4d416f70-5f16-0410-b530-b9f4589650da
2007-05-04 15:17:25 +00:00
HD Moore 65cfd287e5 Improvements to the SSL socket support in Rex, fixes #102, and a HTTP client response parsing bug
git-svn-id: file:///home/svn/framework3/trunk@4851 4d416f70-5f16-0410-b530-b9f4589650da
2007-05-03 20:01:29 +00:00
bmc c79649ebc3 add chunked encoding evasion back into the client API (not in the mixin yet)
git-svn-id: file:///home/svn/framework3/trunk@4790 4d416f70-5f16-0410-b530-b9f4589650da
2007-04-26 21:08:22 +00:00
HD Moore affc5fb958 fixes #85 (basic auth to http)
git-svn-id: file:///home/svn/framework3/trunk@4744 4d416f70-5f16-0410-b530-b9f4589650da
2007-04-23 22:48:22 +00:00
Matt Miller 1e1cc94831 req_string rather than req
git-svn-id: file:///home/svn/framework3/trunk@4732 4d416f70-5f16-0410-b530-b9f4589650da
2007-04-22 07:50:07 +00:00
HD Moore ab6f961ea4 Removed the buggy errors.txt loader, embedded the error messages into the files
git-svn-id: file:///home/svn/framework3/trunk@4584 4d416f70-5f16-0410-b530-b9f4589650da
2007-03-27 02:44:05 +00:00
HD Moore d14221898d Merge in the new generic PHP exploit with new targets
Added type definitions to HTTP::Client



git-svn-id: file:///home/svn/framework3/trunk@4537 4d416f70-5f16-0410-b530-b9f4589650da
2007-03-17 20:10:57 +00:00
HD Moore 4d87a3f9fb Adding the missing raw_headers function required for the recent php bug
git-svn-id: file:///home/svn/framework3/trunk@4518 4d416f70-5f16-0410-b530-b9f4589650da
2007-03-11 16:28:13 +00:00
HD Moore 547ec3c6c6 This patch adds header folding, fixed hex-random and u-random encoding, fake uri end, fake uri parameters. This fixes #16, the remaining two options (chunked and pipelining), will be added in a future version.
git-svn-id: file:///home/svn/framework3/trunk@4513 4d416f70-5f16-0410-b530-b9f4589650da
2007-03-10 05:58:14 +00:00
Matt Miller c61e0e8931 change the behavior of nil non-required options, fixes #49
git-svn-id: file:///home/svn/framework3/trunk@4509 4d416f70-5f16-0410-b530-b9f4589650da
2007-03-09 06:12:28 +00:00
HD Moore e6f221ad80 Major updates to the HTTP api, re-addition of HTTP evasion, see #16
git-svn-id: file:///home/svn/framework3/trunk@4506 4d416f70-5f16-0410-b530-b9f4589650da
2007-03-08 14:08:41 +00:00
Matt Miller e8d036cac8 fixed typo in simplified modules
git-svn-id: file:///home/svn/framework3/trunk@4465 4d416f70-5f16-0410-b530-b9f4589650da
2007-02-24 21:42:13 +00:00
HD Moore 2db1945637 Fix a bone-headed error when adding http evasion, this fixes #31
git-svn-id: file:///home/svn/framework3/trunk@4459 4d416f70-5f16-0410-b530-b9f4589650da
2007-02-22 07:33:00 +00:00
HD Moore fe540a3001 Cleanly handle EOFError's from DCERPC services. This fixes #27
git-svn-id: file:///home/svn/framework3/trunk@4453 4d416f70-5f16-0410-b530-b9f4589650da
2007-02-21 03:58:44 +00:00
HD Moore 51d61c161d Sessions can be detached and killed from the console
git-svn-id: file:///home/svn/framework3/trunk@4437 4d416f70-5f16-0410-b530-b9f4589650da
2007-02-18 22:35:07 +00:00
HD Moore a4b06e1653 fixes a file descriptor leak in the SMB and DCERPC exception translation code
git-svn-id: file:///home/svn/framework3/trunk@4423 4d416f70-5f16-0410-b530-b9f4589650da
2007-02-18 03:07:40 +00:00
HD Moore 2980467f1b Formatting updates
git-svn-id: file:///home/svn/framework3/trunk@4315 4d416f70-5f16-0410-b530-b9f4589650da
2007-02-04 01:54:10 +00:00
Matt Miller 279c0e3e52 defanged mode
git-svn-id: file:///home/svn/framework3/trunk@4303 4d416f70-5f16-0410-b530-b9f4589650da
2007-01-30 04:48:35 +00:00
HD Moore d09046a5b9 Accessing res['header'] is now case insensitive for HTTP responses
Added the Google Appliance exploit



git-svn-id: file:///home/svn/framework3/trunk@4259 4d416f70-5f16-0410-b530-b9f4589650da
2007-01-05 05:22:39 +00:00
HD Moore 2bc1d4be18 Updates to the client API
git-svn-id: file:///home/svn/framework3/trunk@4242 4d416f70-5f16-0410-b530-b9f4589650da
2006-12-28 23:42:54 +00:00
HD Moore 804df25240 Initial overhaul of the HTTP client api. This removes nearly all of the client evasion methods, but leaves the code in a great state to reimplement them with less issues.
git-svn-id: file:///home/svn/framework3/trunk@4222 4d416f70-5f16-0410-b530-b9f4589650da
2006-12-19 07:11:55 +00:00
Matt Miller f1fb05690f misc bugfixes in the http subsystem
git-svn-id: file:///home/svn/framework3/trunk@4019 4d416f70-5f16-0410-b530-b9f4589650da
2006-10-11 09:27:39 +00:00
Matt Miller abf2e057c8 apache chunked encoding win32 port
git-svn-id: file:///home/svn/framework3/trunk@4017 4d416f70-5f16-0410-b530-b9f4589650da
2006-10-11 08:31:54 +00:00
HD Moore 0b71dc5d04 A few updates to add NT Trans2 secondary requests, fix an authentication issue, and support a new denial of service module
git-svn-id: file:///home/svn/framework3/trunk@3885 4d416f70-5f16-0410-b530-b9f4589650da
2006-09-14 05:41:54 +00:00
HD Moore 7a0c8d2c8d Cleanup
git-svn-id: file:///home/svn/framework3/trunk@3846 4d416f70-5f16-0410-b530-b9f4589650da
2006-08-28 00:24:34 +00:00
HD Moore 651a1a7965 Bug fix to support NT 4.0
git-svn-id: file:///home/svn/framework3/trunk@3822 4d416f70-5f16-0410-b530-b9f4589650da
2006-08-12 23:07:25 +00:00
Matt Miller 7bd26e4925 fixed bug in service manager hardcore alias, new passivex dll/proj files
git-svn-id: file:///home/svn/framework3/trunk@3807 4d416f70-5f16-0410-b530-b9f4589650da
2006-08-08 03:29:26 +00:00
HD Moore 1a7ba78dc8 Removed a dumb debugging line that was accidentally comitted
git-svn-id: file:///home/svn/framework3/trunk@3752 4d416f70-5f16-0410-b530-b9f4589650da
2006-07-20 04:43:52 +00:00
Spoon M df32aedf44 added parens to fix precedence/void context bug
git-svn-id: file:///home/svn/framework3/trunk@3747 4d416f70-5f16-0410-b530-b9f4589650da
2006-07-18 17:32:09 +00:00
HD Moore 775183661d Split trans into two routines, one of which sets maxparm/maxdata to zero, which is required to trigger the mailslot bug. Thanks Nico!
git-svn-id: file:///home/svn/framework3/trunk@3741 4d416f70-5f16-0410-b530-b9f4589650da
2006-07-13 03:04:53 +00:00
HD Moore 35568b570a Demo code added for MS06-035, mailslot write added to client.rb
git-svn-id: file:///home/svn/framework3/trunk@3740 4d416f70-5f16-0410-b530-b9f4589650da
2006-07-11 20:02:45 +00:00
bmc 6e6b1bb2a7 * NDR has been moved, so remove the tests for now, removing the code later
git-svn-id: file:///home/svn/framework3/trunk@3734 4d416f70-5f16-0410-b530-b9f4589650da
2006-06-28 13:35:19 +00:00
HD Moore d1efbad1e7 Minor updates
git-svn-id: file:///home/svn/framework3/trunk@3722 4d416f70-5f16-0410-b530-b9f4589650da
2006-06-23 06:20:52 +00:00
HD Moore b2895bec0d Minor sanity checks added
git-svn-id: file:///home/svn/framework3/trunk@3697 4d416f70-5f16-0410-b530-b9f4589650da
2006-06-17 17:36:19 +00:00
bmc 9352454791 * add warnings, gonna go away soon
git-svn-id: file:///home/svn/incoming/trunk@3659 4d416f70-5f16-0410-b530-b9f4589650da
2006-06-13 21:26:34 +00:00
Matt Miller 1a61d3d2fb changes to support native win32
git-svn-id: file:///home/svn/incoming/trunk@3654 4d416f70-5f16-0410-b530-b9f4589650da
2006-06-08 20:53:15 +00:00
bmc 049b71e236 move username & password to the test suite config thingie
git-svn-id: file:///home/svn/incoming/trunk@3652 4d416f70-5f16-0410-b530-b9f4589650da
2006-06-01 15:30:26 +00:00
bmc c9a3258f81 removing dup trans function with a no_response argument to trans
git-svn-id: file:///home/svn/incoming/trunk@3650 4d416f70-5f16-0410-b530-b9f4589650da
2006-06-01 15:18:53 +00:00
bmc 09786d3eaa tiny cleanups
git-svn-id: file:///home/svn/incoming/trunk@3649 4d416f70-5f16-0410-b530-b9f4589650da
2006-05-31 21:49:46 +00:00
bmc 2f33ece43b * cleanup extra whitespaces at the end of the line
* collect = good


git-svn-id: file:///home/svn/incoming/trunk@3648 4d416f70-5f16-0410-b530-b9f4589650da
2006-05-30 17:18:27 +00:00
HD Moore c3e0146443 Cleanups to SMB tests, minor fixes.
git-svn-id: file:///home/svn/incoming/trunk@3646 4d416f70-5f16-0410-b530-b9f4589650da
2006-05-30 16:11:00 +00:00
HD Moore 18bb4f9e6d Fixed spaces before paranethesis issues in dcerpc/packet.rb
Fixed comment in smb/client.rb
Fixed ReadAndX in smb/client.rb
Updated ReadAndX struct in constants.rb


git-svn-id: file:///home/svn/incoming/trunk@3643 4d416f70-5f16-0410-b530-b9f4589650da
2006-05-15 16:44:44 +00:00
HD Moore 71ac31446f SupportWords for a tree connect response are arbitrary new words that increment the WordCount, hopefully this wont break response parsing for the actual payload/bytecount. The current struct2 system can't take abitrary WordCount responses into account yet :-/
git-svn-id: file:///home/svn/incoming/trunk@3635 4d416f70-5f16-0410-b530-b9f4589650da
2006-05-05 13:53:16 +00:00
HD Moore 64827d1238 New evasion options for controlling how many fake uuids to place before and after the real uid when eexploiting DCERPC bugs
Added a new evasion option for picking readAndX/writeAndX or transNamedPipe methods for DCERPC delivery, however a struct2 issue seems to be breaking this (will investigate tomorrow).

Fixed a typo in the initialize method of the OpenPipe class


git-svn-id: file:///home/svn/incoming/trunk@3634 4d416f70-5f16-0410-b530-b9f4589650da
2006-05-03 05:53:37 +00:00
HD Moore 1fd5d698a2 Migrated client.rb to new smb time api (missed one)
Removed debugging print from the SMB mixin


git-svn-id: file:///home/svn/incoming/trunk@3632 4d416f70-5f16-0410-b530-b9f4589650da
2006-05-03 04:49:47 +00:00
HD Moore 44f578bf41 Changed 'boolean' flags to true/false from 0/1 in client.rb
Updated constants.rb to more accurately reflect packet structure in SMB responses
Updated client.rb to match the changes to constants
Updated utils.rb to include smb to unix conversation routines for time fields
Updated utils.rb to create security blobs for both client and server packets


git-svn-id: file:///home/svn/incoming/trunk@3631 4d416f70-5f16-0410-b530-b9f4589650da
2006-05-03 04:43:19 +00:00
HD Moore 1a54cc810a Fixed numerous issues involving smb/dcerpc interaction
Fixed 'bad' use of method definition (space after method name, will be depreciated soon)


git-svn-id: file:///home/svn/incoming/trunk@3626 4d416f70-5f16-0410-b530-b9f4589650da
2006-04-30 19:49:27 +00:00
HD Moore 42bc7496cf All sorts of fun changes to smb/dcerpc, the basics are:
1) Clean up SMB constants, add new ones, define which ones are supported by dialect
2) DCERPC over SMB uses a 'OpenPipe' class, not an 'OpenFile'
3) A new DCERPC option called 'smb_pipeio' allows the user to switch between Read/Write and TransactNamedPipe()


git-svn-id: file:///home/svn/incoming/trunk@3622 4d416f70-5f16-0410-b530-b9f4589650da
2006-04-26 16:59:44 +00:00
bmc df49cfabb0 * add SSL TCP server support, using runtime generated/signed keys
* add HTTPS support

note, SSL service tests don't work.  Right now, the tests just bail early.  The
client spins forever trying to get data.  When the client & server are in
seperate processes, this isn't a problem.  A threaded test implementation is
closer, as data sent from the client gets to the server just fine.


git-svn-id: file:///home/svn/incoming/trunk@3616 4d416f70-5f16-0410-b530-b9f4589650da
2006-04-24 18:49:00 +00:00
HD Moore f4736c3eae Minor improvements
git-svn-id: file:///home/svn/incoming/trunk@3593 4d416f70-5f16-0410-b530-b9f4589650da
2006-04-08 06:35:35 +00:00
bmc 676a582814 oops, forgot to add these
git-svn-id: file:///home/svn/incoming/trunk@3582 4d416f70-5f16-0410-b530-b9f4589650da
2006-03-30 15:13:14 +00:00
bmc dbf0fcf0f2 * add object_id and random object_id call evasion
git-svn-id: file:///home/svn/incoming/trunk@3579 4d416f70-5f16-0410-b530-b9f4589650da
2006-03-29 20:46:29 +00:00
bmc 839ad37dc4 * update testset
git-svn-id: file:///home/svn/incoming/trunk@3578 4d416f70-5f16-0410-b530-b9f4589650da
2006-03-29 19:34:46 +00:00
bmc c96065fc3b * update testset, thanks to changes HD made
git-svn-id: file:///home/svn/incoming/trunk@3577 4d416f70-5f16-0410-b530-b9f4589650da
2006-03-29 19:34:25 +00:00
bmc 9a0b748a4b * add header test suite
git-svn-id: file:///home/svn/incoming/trunk@3567 4d416f70-5f16-0410-b530-b9f4589650da
2006-03-09 19:52:34 +00:00
bmc 5b675262be properlly support responses when we get a request like this:
(echo "GET / HTTP/1.0"; echo ) |nc IP PORT


git-svn-id: file:///home/svn/incoming/trunk@3566 4d416f70-5f16-0410-b530-b9f4589650da
2006-03-09 19:51:37 +00:00
bmc 223d22c2e6 * object cleanups
* add tcp request fragmentation support


git-svn-id: file:///home/svn/incoming/trunk@3562 4d416f70-5f16-0410-b530-b9f4589650da
2006-03-08 19:13:27 +00:00
bmc 93870878fe * no self wrapper to unicode
* update tests to make more sense when they fail


git-svn-id: file:///home/svn/incoming/trunk@3557 4d416f70-5f16-0410-b530-b9f4589650da
2006-03-07 20:19:30 +00:00
HD Moore feca661373 Fixed typos in the license
Fixed exception issues


git-svn-id: file:///home/svn/incoming/trunk@3552 4d416f70-5f16-0410-b530-b9f4589650da
2006-03-07 06:50:25 +00:00
bmc 279abda264 * uri encoding is now part of Rex::Text
* add junk param start
* add junk URI end


git-svn-id: file:///home/svn/incoming/trunk@3546 4d416f70-5f16-0410-b530-b9f4589650da
2006-02-27 19:55:22 +00:00
bmc 524c0a3f74 * add 'none' encoding
git-svn-id: file:///home/svn/incoming/trunk@3521 4d416f70-5f16-0410-b530-b9f4589650da
2006-02-10 15:44:15 +00:00
bmc 1351ceed1c * add support to hex/%u encode a URI
git-svn-id: file:///home/svn/incoming/trunk@3517 4d416f70-5f16-0410-b530-b9f4589650da
2006-02-06 22:48:57 +00:00
bmc 0f6055c73c support both POST and SEARCH as basic post request types.
git-svn-id: file:///home/svn/incoming/trunk@3512 4d416f70-5f16-0410-b530-b9f4589650da
2006-02-06 20:23:52 +00:00
vlad902 27e12952d0 Replace get_once with get()
git-svn-id: file:///home/svn/incoming/trunk@3487 4d416f70-5f16-0410-b530-b9f4589650da
2006-02-01 00:01:57 +00:00
bmc d668b87f68 * remove some comments
git-svn-id: file:///home/svn/incoming/trunk@3481 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-30 22:09:58 +00:00
bmc 05b9aacbc1 'none' is an ok content-encoding, just does nothing... (passed in from the exploit mixin)
git-svn-id: file:///home/svn/incoming/trunk@3475 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-30 17:31:32 +00:00
bmc 20fec01d68 * add junk pipelined request support
* fix socket creation on pipelined requests
* when a server says that the connection should be closed (Connection: closed), then close the connection, since its going to regardless, and we don't want to loose our state
* support non-standard line termination in headers.  ie \n instead of \r\n
* add junk headers (X-rand: rand)
* add header folding (for evasion)
* add parse_header_re (still leaving parse_header around, though its dead code ATM) that does the right thing on non-standard line endings
* move 'gzip' to a 'compression' option
* add 'deflate' compression option (really, just raw zlib, and only firefox does deflate right)
* fix a bunch of TE:chunked decoding bugs based based on the fact that Apache doesn't always close chunks appropriately
* modify parse_body to not return state, since it doesn't always do that, and the return isn't used... self.state is.
* add TE:chunked request support
* normalize URIs in requests before saving them
* Move params out of the URI, but when the uri is requested, and the method is GET, and there are params, return a URI that has the params that are approrpiately encoded (needed for junk_params, see below)
* move request.to_s support of params to use the request params array when a POST, allows use of junk params support (see below).  NOTE:  If the body is provided, use the body instead of params, in case you want to hardcode the params in a POST request, eg: php_xmlrpc_eval.rb
* Add junk params when building a param list, eg: a=b becomes asdfasdf=asdrt32a&asdfad=okhgasd&a=b&hjklasdf=hkasgd
* add URI junk slash support (eg: /////foo.html)
* param splitting now supports both '&', and ';', which CGI.pm and PHP both allow
* add URI junk directory support, eg: /asdf/../foo.html
* add param encoding support, eg: param A with value '=' is  A=%3d
* add URI junk self referring directory support, eg: /././foo.html


git-svn-id: file:///home/svn/incoming/trunk@3457 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-27 21:57:44 +00:00
HD Moore b4ad4a5d75 Tabs vs Spaces
git-svn-id: file:///home/svn/incoming/trunk@3453 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-27 05:33:08 +00:00
HD Moore e9b4b96f0d Tabs vs spaces
git-svn-id: file:///home/svn/incoming/trunk@3452 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-27 05:29:06 +00:00
HD Moore 93045fa927 Tab fixes
git-svn-id: file:///home/svn/incoming/trunk@3451 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-27 05:28:16 +00:00
bmc a1db0b6196 space to tab (happy skape?)
git-svn-id: file:///home/svn/incoming/trunk@3445 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-25 21:57:30 +00:00
bmc 98b9a977f4 * these need to go away
git-svn-id: file:///home/svn/incoming/trunk@3440 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-24 16:01:49 +00:00
bmc 55ba865f30 * few cleanups plus addition of self referring directories (eg: /././././)
git-svn-id: file:///home/svn/incoming/trunk@3437 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-23 23:57:50 +00:00
bmc 52fa0da439 * add support for inserting junk directories, slashes, and params
git-svn-id: file:///home/svn/incoming/trunk@3436 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-23 21:58:53 +00:00
vlad902 2346b83ef4 Slightly re-structured and bug fixed
git-svn-id: file:///home/svn/incoming/trunk@3420 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-21 02:44:01 +00:00
vlad902 d051386d63 Basic SunRPC wrapper
git-svn-id: file:///home/svn/incoming/trunk@3419 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-21 02:43:44 +00:00
bmc 9913f6d953 * add SSL support to the client (pass another arg to enable)
git-svn-id: file:///home/svn/incoming/trunk@3411 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-20 18:59:24 +00:00
HD Moore 737a1cb711 Pass socket context to child sockets from server, pass context from http mixin to socket
git-svn-id: file:///home/svn/incoming/trunk@3402 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-17 04:35:44 +00:00
vlad902 dc83e49db2 Initial revision
git-svn-id: file:///home/svn/incoming/trunk@3400 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-17 01:12:38 +00:00
vlad902 da81906949 rpc -> sunrpc
git-svn-id: file:///home/svn/incoming/trunk@3397 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-17 01:09:15 +00:00
Matt Miller 0b27b07a5d possible fix for header parsing issue
git-svn-id: file:///home/svn/incoming/trunk@3390 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-16 16:29:22 +00:00
Matt Miller 679d192173 patch to allow non-default server name
git-svn-id: file:///home/svn/incoming/trunk@3369 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-11 22:16:20 +00:00
Matt Miller ae5c816e85 various enhancements to support passivex, seems to be functional, somewhat
git-svn-id: file:///home/svn/incoming/trunk@3322 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-07 10:04:30 +00:00
HD Moore 8049b32cbc Patches from <anon>
git-svn-id: file:///home/svn/incoming/trunk@3310 4d416f70-5f16-0410-b530-b9f4589650da
2006-01-05 22:20:28 +00:00
HD Moore f468b10cff Tweaks
git-svn-id: file:///home/svn/incoming/trunk@3286 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-31 18:03:02 +00:00
HD Moore 082a62afd7 NetDDE + smb code frmo pusscat
git-svn-id: file:///home/svn/incoming/trunk@3243 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-18 02:07:33 +00:00
HD Moore 88658064df /usr/bin/ruby vs /usr/bin/env ruby
git-svn-id: file:///home/svn/incoming/trunk@3242 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-17 06:46:23 +00:00
Matt Miller 410770bae6 fixes for some socket association stuff
git-svn-id: file:///home/svn/incoming/trunk@3233 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-15 04:46:52 +00:00
HD Moore e79c9f8658 Something is still breaking, use w3who, show payloads, exploit, breaks
git-svn-id: file:///home/svn/incoming/trunk@3218 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-14 00:21:23 +00:00
HD Moore 6063908cd4 Catch ugly Interrupt error in msfconsole, fixed tabs in simpleclient
git-svn-id: file:///home/svn/incoming/trunk@3213 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-13 06:27:34 +00:00
HD Moore f9edc88699 SMB/DCERPC errors/exceptions
Added default tab targets for TARGET/PAYLOAD/ENCODER/NOP


git-svn-id: file:///home/svn/incoming/trunk@3212 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-13 06:22:56 +00:00
HD Moore 557153e01c Code from Brian Caswell
git-svn-id: file:///home/svn/incoming/trunk@3210 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-13 06:08:40 +00:00
Matt Miller 947f53518a some cleanup
git-svn-id: file:///home/svn/incoming/trunk@3191 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-08 05:55:44 +00:00
Matt Miller 9e217054dc fix for erb thing
git-svn-id: file:///home/svn/incoming/trunk@3173 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-05 15:22:17 +00:00
HD Moore 11da735d7a More test suites
git-svn-id: file:///home/svn/incoming/trunk@3166 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-02 02:35:49 +00:00
HD Moore 526b9f199d Changes from Brian Caswell
git-svn-id: file:///home/svn/incoming/trunk@3165 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-02 02:35:30 +00:00
HD Moore daa523ef70 More code from bmc, forgot to commit
git-svn-id: file:///home/svn/incoming/trunk@3164 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-02 01:20:31 +00:00
HD Moore b931b02c14 Changes from Brian Caswell
git-svn-id: file:///home/svn/incoming/trunk@3161 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-30 19:42:19 +00:00
HD Moore 9bf0d901cf Added the egghunter mixin
Consolidated all unicode routines to go through Rex::Text.to_unicode()
Added a new function for sending evil blobs through smb


git-svn-id: file:///home/svn/incoming/trunk@3114 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-26 02:34:39 +00:00
Matt Miller bd70905c03 escape
git-svn-id: file:///home/svn/incoming/trunk@3095 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-25 04:16:43 +00:00
Matt Miller 8580264110 more exploits msfweb stuff
git-svn-id: file:///home/svn/incoming/trunk@3078 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-24 05:51:20 +00:00
Matt Miller 68e661065d more msfweb foo
git-svn-id: file:///home/svn/incoming/trunk@3077 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-24 05:13:40 +00:00
Matt Miller a19e98757d more hackery on msfweb
git-svn-id: file:///home/svn/incoming/trunk@3076 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-24 04:23:43 +00:00
Matt Miller adc09f4aa1 hacking on msfweb
git-svn-id: file:///home/svn/incoming/trunk@3069 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-24 03:31:23 +00:00
Matt Miller fc9376d385 enhanced http server crap
git-svn-id: file:///home/svn/incoming/trunk@3063 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-24 02:02:10 +00:00
Matt Miller 2dc8cd66d3 added dir resource, fixed body parsing issue
git-svn-id: file:///home/svn/incoming/trunk@3060 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-23 17:06:16 +00:00
Matt Miller 22542607cf very basic start to msfweb
git-svn-id: file:///home/svn/incoming/trunk@3056 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-22 03:20:09 +00:00
HD Moore 4edf57d731 ms04_011 works perfectly
updated smb, evasion can be set via SMBEvasion datastore (temporary)
added the first osx exploit, cant test for a week or so


git-svn-id: file:///home/svn/incoming/trunk@3044 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-17 19:41:54 +00:00
HD Moore 16c5e232f5 Addition of get_once() in io::stream, rewritten recv code for smb/dcerpc, error handling in exploit mixins
git-svn-id: file:///home/svn/incoming/trunk@3042 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-16 17:56:07 +00:00
HD Moore 3150bd2f3a SMB mixin is mostly working now
git-svn-id: file:///home/svn/incoming/trunk@3037 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-15 23:02:17 +00:00
Matt Miller 95f8210853 major doc update
git-svn-id: file:///home/svn/incoming/trunk@3029 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-15 05:22:13 +00:00
Matt Miller da05fa0415 somewhat gracefully handle missing ossl, fix missing method
git-svn-id: file:///home/svn/incoming/trunk@3014 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-03 04:43:19 +00:00
Matt Miller 6a5870ddcd updated comments to be more uniformed in class definition
git-svn-id: file:///home/svn/incoming/trunk@3004 4d416f70-5f16-0410-b530-b9f4589650da
2005-11-02 16:49:45 +00:00
HD Moore a5cde85299 More SMB
git-svn-id: file:///home/svn/incoming/trunk@2954 4d416f70-5f16-0410-b530-b9f4589650da
2005-10-03 13:51:05 +00:00
HD Moore cb69d58ca5 Still working on the simpleclient interface
git-svn-id: file:///home/svn/incoming/trunk@2946 4d416f70-5f16-0410-b530-b9f4589650da
2005-10-02 06:53:39 +00:00
HD Moore cfbeff077e Added SimpleClient, moderate bug fixes
git-svn-id: file:///home/svn/incoming/trunk@2873 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-23 09:14:03 +00:00
HD Moore 17e2527f07 Evasion code is more sane, mostly working
git-svn-id: file:///home/svn/incoming/trunk@2870 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-23 06:27:22 +00:00
HD Moore 40da41eb8d Massive overhaul to packet parsing and error handling
Introducing the new evasion system


git-svn-id: file:///home/svn/incoming/trunk@2867 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-23 03:43:04 +00:00
HD Moore 3114a95235 wee eh
git-svn-id: file:///home/svn/incoming/trunk@2866 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-22 09:04:54 +00:00
HD Moore ea4448bee4 More SMB - DCERPC transactions work, woop!
git-svn-id: file:///home/svn/incoming/trunk@2865 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-22 09:04:40 +00:00
HD Moore 04abd76d8d More SMB stuff
git-svn-id: file:///home/svn/incoming/trunk@2863 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-22 04:04:06 +00:00
Matt Miller fe0a151d7e ported ie object type, more work on http stuff
git-svn-id: file:///home/svn/incoming/trunk@2861 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-22 03:24:32 +00:00
Matt Miller 811789fa01 back from the dead, ignore service manager stuff for now, it sux
git-svn-id: file:///home/svn/incoming/trunk@2860 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-21 04:48:37 +00:00
HD Moore 053e2ba70d More SMB work
git-svn-id: file:///home/svn/incoming/trunk@2857 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-19 23:35:51 +00:00
HD Moore 0f569bc65d Fixed up DCERPC test cases
Started on SMB


git-svn-id: file:///home/svn/incoming/trunk@2856 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-16 09:27:41 +00:00
HD Moore 18f8b2ca9b Added exception checks
git-svn-id: file:///home/svn/incoming/trunk@2855 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-16 07:53:57 +00:00
HD Moore 5e5f7eed24 DCERPC foo
git-svn-id: file:///home/svn/incoming/trunk@2852 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-16 03:29:27 +00:00
HD Moore 63f67869de Updates to HTTP:
* chunked transfer support
	* generic Request factory Client.request
	* runtime configuration via Client.config

Still busted:
	* Enforcement of max_data length
	* Error handling on incomplete responses


git-svn-id: file:///home/svn/incoming/trunk@2849 4d416f70-5f16-0410-b530-b9f4589650da
2005-09-15 23:37:38 +00:00
Matt Miller 654b7f034c service allocation draft
git-svn-id: file:///home/svn/incoming/trunk@2844 4d416f70-5f16-0410-b530-b9f4589650da
2005-08-22 04:34:40 +00:00
Matt Miller 2b82d4c4c4 fixed up the ol' http server
git-svn-id: file:///home/svn/incoming/trunk@2843 4d416f70-5f16-0410-b530-b9f4589650da
2005-08-22 02:36:09 +00:00
HD Moore 1ed981ea51 Loader class
git-svn-id: file:///home/svn/incoming/trunk@2830 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-25 09:41:07 +00:00
HD Moore 153f0d4245 Reorg
git-svn-id: file:///home/svn/incoming/trunk@2829 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-25 09:40:31 +00:00
HD Moore 02e168f3ed Standardized heads, extracted the unit tests
git-svn-id: file:///home/svn/incoming/trunk@2828 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-25 09:34:53 +00:00
Matt Miller 934c50c878 rex proto stuff
git-svn-id: file:///home/svn/incoming/trunk@2826 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-25 02:44:07 +00:00
Matt Miller 342c9f1cbf evil ruby ownage
git-svn-id: file:///home/svn/incoming/trunk@2825 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-25 02:39:14 +00:00
Matt Miller cfe5d10a48 http server stuff
git-svn-id: file:///home/svn/incoming/trunk@2824 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-25 02:18:37 +00:00
Matt Miller ba794cc6d8 added some http protocol stuff, ruby's builtin stuff sucks
git-svn-id: file:///home/svn/incoming/trunk@2823 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-24 20:53:54 +00:00
HD Moore 98244e5000 Bugfix to x86
More tweaks to dcerpc
Fixed up dcom


git-svn-id: file:///home/svn/incoming/trunk@2789 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-18 03:58:29 +00:00
HD Moore 5049896454 Fixes, tweaks, etc
git-svn-id: file:///home/svn/incoming/trunk@2783 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-17 23:28:28 +00:00
HD Moore 3448092976 Should be ready to roll..
git-svn-id: file:///home/svn/incoming/trunk@2781 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-17 10:24:19 +00:00
HD Moore 65670cd33e multi-line fixes
git-svn-id: file:///home/svn/incoming/trunk@2780 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-17 08:28:52 +00:00
HD Moore e6aa776371 Tweaky tweak
git-svn-id: file:///home/svn/incoming/trunk@2779 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-17 08:24:30 +00:00
HD Moore 334860ad91 First start of the DCERPC code
git-svn-id: file:///home/svn/incoming/trunk@2768 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-16 09:37:42 +00:00
HD Moore eda702774d Fixed missing end tag
git-svn-id: file:///home/svn/incoming/trunk@2767 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-16 09:37:18 +00:00
HD Moore 1c2ddba531 Fixed name
git-svn-id: file:///home/svn/incoming/trunk@2766 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-16 09:36:37 +00:00
HD Moore a820ba273c Fixed name
git-svn-id: file:///home/svn/incoming/trunk@2764 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-16 07:38:31 +00:00
vlad902 ce99b97c35 Make XDR a module not a class
git-svn-id: file:///home/svn/incoming/trunk@2489 4d416f70-5f16-0410-b530-b9f4589650da
2005-05-11 04:10:48 +00:00
HD Moore 95023a82e9 SMB Crypt library
git-svn-id: file:///home/svn/incoming/trunk@2332 4d416f70-5f16-0410-b530-b9f4589650da
2005-03-27 00:23:10 +00:00
vlad902 77d1ffb488 XDR-fu j0!
git-svn-id: file:///home/svn/incoming/trunk@2331 4d416f70-5f16-0410-b530-b9f4589650da
2005-03-27 00:02:09 +00:00