6e06b61e48
php doesn't reuse array indexes with [], so do some acrobatics to figure out a real channel id. fixes #4418
...
git-svn-id: file:///home/svn/framework3/trunk@12605 4d416f70-5f16-0410-b530-b9f4589650da
2011-05-13 01:22:53 +00:00
8c0773ba71
and the bin for r12372, see #3898
...
git-svn-id: file:///home/svn/framework3/trunk@12373 4d416f70-5f16-0410-b530-b9f4589650da
2011-04-19 22:40:13 +00:00
78396e94f9
move linux meterpreter bin to the correct place
...
git-svn-id: file:///home/svn/framework3/trunk@11938 4d416f70-5f16-0410-b530-b9f4589650da
2011-03-11 20:29:25 +00:00
6eac24e940
handle dead resources more gracefully
...
git-svn-id: file:///home/svn/framework3/trunk@11770 4d416f70-5f16-0410-b530-b9f4589650da
2011-02-18 00:24:18 +00:00
758da50090
use the correct length for copying arguments, fixes #3526 , thanks mihi!
...
git-svn-id: file:///home/svn/framework3/trunk@11700 4d416f70-5f16-0410-b530-b9f4589650da
2011-02-02 21:26:29 +00:00
41e5a4c61d
Fix for #3482 , the empty value occurs when no service pack is present. The fix simply tests for this. Also remove the two unused params on the _snprintf call.
...
git-svn-id: file:///home/svn/framework3/trunk@11542 4d416f70-5f16-0410-b530-b9f4589650da
2011-01-11 14:29:16 +00:00
dd61fa950f
when socket creation fails, return a relevant windows error code so the client will raise ::Rex::ConnectionError instead of just erroring out with a RequestError. This fixes some problems with backtraces when routing through a php meterp. See r9794, #3481 .
...
git-svn-id: file:///home/svn/framework3/trunk@11532 4d416f70-5f16-0410-b530-b9f4589650da
2011-01-10 08:31:10 +00:00
bf8a534a72
clean up process handling in php meterp a bit, fixes the 'shell' command and hopefully makes process interaction a little more robust.
...
git-svn-id: file:///home/svn/framework3/trunk@11531 4d416f70-5f16-0410-b530-b9f4589650da
2011-01-10 08:04:17 +00:00
599df0a71a
Fix error with recording on certain Windows versions.
...
git-svn-id: file:///home/svn/framework3/trunk@11311 4d416f70-5f16-0410-b530-b9f4589650da
2010-12-12 20:12:03 +00:00
61242f3c2c
Catch invalid webcam frame requests.
...
git-svn-id: file:///home/svn/framework3/trunk@11160 4d416f70-5f16-0410-b530-b9f4589650da
2010-11-29 02:23:01 +00:00
2e72926638
Add audio (microphone) recording support to stdapi.
...
git-svn-id: file:///home/svn/framework3/trunk@11087 4d416f70-5f16-0410-b530-b9f4589650da
2010-11-22 00:32:39 +00:00
560c1847c3
Properly return error if no webcams present (instead of killing session).
...
git-svn-id: file:///home/svn/framework3/trunk@11041 4d416f70-5f16-0410-b530-b9f4589650da
2010-11-14 19:59:31 +00:00
594a46bfc7
Merge webcam extension into stdapi.
...
git-svn-id: file:///home/svn/framework3/trunk@10997 4d416f70-5f16-0410-b530-b9f4589650da
2010-11-11 22:36:54 +00:00
2d2e1989aa
Fix memory leak.
...
git-svn-id: file:///home/svn/framework3/trunk@10964 4d416f70-5f16-0410-b530-b9f4589650da
2010-11-09 23:37:56 +00:00
db602dd478
Add functional in-memory webcam support.
...
git-svn-id: file:///home/svn/framework3/trunk@10954 4d416f70-5f16-0410-b530-b9f4589650da
2010-11-09 02:24:28 +00:00
20b96ae0c1
Partial implementation of in memory execution and update binary
...
git-svn-id: file:///home/svn/framework3/trunk@10839 4d416f70-5f16-0410-b530-b9f4589650da
2010-10-28 12:44:39 +00:00
ecc98849a6
remove debugging error_reporting
...
git-svn-id: file:///home/svn/framework3/trunk@10778 4d416f70-5f16-0410-b530-b9f4589650da
2010-10-21 22:47:16 +00:00
5960dc6753
take out debugging
...
git-svn-id: file:///home/svn/framework3/trunk@10745 4d416f70-5f16-0410-b530-b9f4589650da
2010-10-19 12:51:09 +00:00
2e9138ebbc
This commit overhauls much of the meterpreter timeouts and staging processes. This fixes a bug with concurrent session handling, reduces CPU load by caching a single SSL certificate for all sessions, increases all of the critical timeouts, and generally makes mass ownage work better. We still need to limit the maximum number of concurrent on_session() threads to something sane to prevent sesssion spikes from dragging out the process even longer. The C-side meterpreter change is minimal and will only help with future compatibility if we move to non-blocking fd's for the SSL socket.
...
git-svn-id: file:///home/svn/framework3/trunk@10595 4d416f70-5f16-0410-b530-b9f4589650da
2010-10-08 04:11:47 +00:00
754225a80d
Implement per dispatch run channel_write of packets, remove __FUNCTION__ due to dprintf changes, and fix shutting down networkpug interfaces. Re-add networkpug binary.
...
git-svn-id: file:///home/svn/framework3/trunk@10586 4d416f70-5f16-0410-b530-b9f4589650da
2010-10-07 11:52:38 +00:00
14cabd2611
Allow debugging to be enabled.
...
This will make it easier to hopefully track down bugs.
exploitme-posix.c - make complete stack executable. On some kernel versions, execstack doesn't do the trick.
git-svn-id: file:///home/svn/framework3/trunk@10485 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-26 05:58:59 +00:00
50241faa57
Implement a sniffer for posix meterpreter using libpcap.
...
This version of the sniffer supports packet filtering after the packet count variable, like so:
meterpreter > sniffer_interfaces
1 - 'eth0' ( type:0 mtu:1514 usable:false dhcp:false wifi:false )
2 - 'any' ( type:0 mtu:1514 usable:false dhcp:false wifi:false )
3 - 'lo' ( type:0 mtu:1514 usable:false dhcp:false wifi:false )
meterpreter > use sniffer
Loading extension sniffer...success.
meterpreter > sniffer_start 1 500000 icmp <-- picks up only icmp packets.
[*] Capture started on interface 1 (500000 packet buffer)
meterpreter > sniffer_stop 1
[*] Capture stopped on interface 1
git-svn-id: file:///home/svn/framework3/trunk@10424 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-21 11:43:30 +00:00
a179836fca
Initial import of networkpug, a pivoting interface using libpcap to monitor/inject packets on a interface on the remote machine.
...
git-svn-id: file:///home/svn/framework3/trunk@10423 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-21 09:35:46 +00:00
4fd054476c
Update the posix meterpreter binaries.
...
git-svn-id: file:///home/svn/framework3/trunk@10420 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-21 05:14:07 +00:00
7957c8872e
add in the new bins (and delete the old railgun dll)
...
git-svn-id: file:///home/svn/framework3/trunk@10320 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-14 23:31:35 +00:00
007ffc1821
updated binary, see #2418
...
git-svn-id: file:///home/svn/framework3/trunk@10316 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-14 20:38:14 +00:00
07f1b6affb
update to java meterpreter, now supports file search, thanks mihi! see #406
...
git-svn-id: file:///home/svn/framework3/trunk@10295 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-11 17:55:10 +00:00
b453665e5f
avoid infinite recursion when links cause circular directory paths by not following symlinks
...
git-svn-id: file:///home/svn/framework3/trunk@10244 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-05 22:18:43 +00:00
35fab7b5ae
default to the current directory instead of failing
...
git-svn-id: file:///home/svn/framework3/trunk@10243 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-05 22:08:05 +00:00
efeffe3185
add support for file search to php meterp
...
git-svn-id: file:///home/svn/framework3/trunk@10242 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-05 21:49:48 +00:00
9060ce379b
add preliminary support for querying registry values when running on Windows
...
git-svn-id: file:///home/svn/framework3/trunk@10241 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-05 20:54:32 +00:00
1bd084ff9f
add posix meterpreter linux x86 binaries from philip
...
git-svn-id: file:///home/svn/framework3/trunk@10223 4d416f70-5f16-0410-b530-b9f4589650da
2010-09-02 16:56:47 +00:00
a0f86c62e3
Meterpreter search support to leverage the index on older systems (2000/XP/2003) via Windows Desktop Search v2.
...
git-svn-id: file:///home/svn/framework3/trunk@10187 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-30 09:50:41 +00:00
aa6ef3615e
...and the bins for file searching.
...
git-svn-id: file:///home/svn/framework3/trunk@10166 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-27 14:45:36 +00:00
49d34d048f
...and the bins
...
git-svn-id: file:///home/svn/framework3/trunk@10054 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-19 11:35:17 +00:00
ec1db10fa3
stupid missing files. /me grumbles
...
git-svn-id: file:///home/svn/framework3/trunk@9975 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-09 17:49:01 +00:00
4a5f800064
i swear i added this before.
...
git-svn-id: file:///home/svn/framework3/trunk@9973 4d416f70-5f16-0410-b530-b9f4589650da
2010-08-09 16:18:35 +00:00
02167b8d16
move the stdapi constants into the stdapi extension to save a little space when php meterpreter is standalone
...
git-svn-id: file:///home/svn/framework3/trunk@9939 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-27 21:16:15 +00:00
8de510f914
add udp support for tunneling. tested with udp_probe
...
git-svn-id: file:///home/svn/framework3/trunk@9816 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-13 22:51:15 +00:00
30d3440b5d
New bins, implements the server side of multi-call railgun
...
git-svn-id: file:///home/svn/framework3/trunk@9806 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-13 19:19:21 +00:00
a47ced6ac4
Partial solution for #1448 . Fall back to CreateProcessWithTokenW when CreateProcessAsUser fails with ERROR_PRIVILEGE_NOT_HELD. While only available on 2003 and above this works on my server 2008 test case which was failing before.
...
git-svn-id: file:///home/svn/framework3/trunk@9781 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-11 18:36:57 +00:00
7a57ca57a6
Bug fix for a misplaced & in call to DestroyEnvironmentBlock() during process_execute(), was causing a hang on Vista and an Access Violation on server 2008.
...
git-svn-id: file:///home/svn/framework3/trunk@9779 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-11 16:37:50 +00:00
d3a6418e53
Revert changes to elevate, still not getting around restrictions on primary token creation, needs a deeper look
...
git-svn-id: file:///home/svn/framework3/trunk@9759 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-09 21:59:31 +00:00
3d01172af5
Binaries for the previous commit
...
git-svn-id: file:///home/svn/framework3/trunk@9757 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-09 21:41:06 +00:00
ec9156827e
Switch the elevator methods to DuplicateHandleEx to get a primary token
...
git-svn-id: file:///home/svn/framework3/trunk@9755 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-09 21:23:05 +00:00
29f9f6671e
This *should* fix all cases where execute -t would fail to use an impersonated token
...
git-svn-id: file:///home/svn/framework3/trunk@9754 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-09 19:32:51 +00:00
972e7bc282
Clean up some of the token impersonation code around process execution
...
git-svn-id: file:///home/svn/framework3/trunk@9751 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-09 18:54:20 +00:00
114ca4e535
replace / and \ with the current system's directory separator so it doesn't matter what the user types
...
git-svn-id: file:///home/svn/framework3/trunk@9727 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-07 20:40:19 +00:00
38d15c016d
Rebuilds of meterpreter, including x64
...
git-svn-id: file:///home/svn/framework3/trunk@9716 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-07 16:47:35 +00:00
ce1116e622
Add railgun binary
...
git-svn-id: file:///home/svn/framework3/trunk@9711 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-07 16:29:55 +00:00
e34bbc281a
Merge railgun binary and new builds
...
git-svn-id: file:///home/svn/framework3/trunk@9710 4d416f70-5f16-0410-b530-b9f4589650da
2010-07-07 16:29:37 +00:00
2638153f46
abstract connect out into it's own function
...
git-svn-id: file:///home/svn/framework3/trunk@9617 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-25 00:39:48 +00:00
c9c3e806a5
use $GLOBALS instead of assuming vars declared outside of a function will be global. allows it to work inside a create_function() eval
...
git-svn-id: file:///home/svn/framework3/trunk@9597 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-23 22:38:01 +00:00
c3d183c98d
split stadpi out into an extension, add a reverse_tcp stager, make the main meterpreter stage-aware so it will work as a standalone or eval'd by a stager that sets $msgsock and $msgsock_type; see #2128
...
git-svn-id: file:///home/svn/framework3/trunk@9594 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-23 20:00:27 +00:00
998509529c
don't consider compression when looking for a tlv
...
git-svn-id: file:///home/svn/framework3/trunk@9527 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-15 17:55:37 +00:00
dacd38c49c
consolidate debugging functions in the file
...
git-svn-id: file:///home/svn/framework3/trunk@9517 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-15 00:33:24 +00:00
7498c30b30
replace $setsockopt with a function, remove unused hexdump function
...
git-svn-id: file:///home/svn/framework3/trunk@9516 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-14 23:20:57 +00:00
e2740c9e2b
watch stderr as well as stdout
...
git-svn-id: file:///home/svn/framework3/trunk@9513 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-14 05:01:37 +00:00
a39a0df5dc
shell interaction works in linux, still broken in windows. kill and ps work in windows now
...
git-svn-id: file:///home/svn/framework3/trunk@9512 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-13 16:44:22 +00:00
975e2c326e
ps now works in windows by shelling out to tasklist.exe
...
git-svn-id: file:///home/svn/framework3/trunk@9497 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-11 22:07:23 +00:00
d47ded220f
overhaul socket handling to use fsockopen if socket_create isn't available. portfwd now works on default Windows and Ubuntu installs
...
git-svn-id: file:///home/svn/framework3/trunk@9450 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-08 07:59:36 +00:00
f13417be08
stdapi is still in the base payload, but this file needs to exist
...
git-svn-id: file:///home/svn/framework3/trunk@9446 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-07 17:00:47 +00:00
ff0af3fb5a
turn off debug logging
...
git-svn-id: file:///home/svn/framework3/trunk@9428 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-04 15:59:45 +00:00
07ec574c3c
fail if the socket couldn't connect
...
git-svn-id: file:///home/svn/framework3/trunk@9427 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-04 15:28:11 +00:00
b23696a916
Woot, portfwd works.
...
git-svn-id: file:///home/svn/framework3/trunk@9418 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-04 02:43:17 +00:00
c068e8e6dc
standardize whitespace
...
git-svn-id: file:///home/svn/framework3/trunk@9413 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-03 23:18:21 +00:00
5c87771a89
basic client sockets, connect and write work
...
git-svn-id: file:///home/svn/framework3/trunk@9404 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-03 04:45:48 +00:00
e4e2bc61a4
break out of the main loop when we get eof (or any other area) on the main socket. fixes infinite loop in the server when client exits
...
git-svn-id: file:///home/svn/framework3/trunk@9402 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-03 00:24:55 +00:00
975b207710
switch debug logging to the webserver error_log for easier perusement; add fs_stat which fixes downloads; only return success from delete_file if it actually deleted the file
...
git-svn-id: file:///home/svn/framework3/trunk@9399 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-02 22:43:03 +00:00
4f0ee6d44c
add support for deleting files
...
git-svn-id: file:///home/svn/framework3/trunk@9398 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-02 18:36:14 +00:00
cf4597df3f
use posix_getuid if it exists
...
git-svn-id: file:///home/svn/framework3/trunk@9397 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-02 18:08:09 +00:00
fe43e91bad
initial commit of php meterpreter, see #391 . upload, download, cd, pwd, ls, cat, sysinfo, getpid, and ps all work fine.
...
* execute works with channel read/write but no interact yet
* getuid is weird, since php's get_current_user() and getmyuid() return the owner of the file instead of the running uid (wtf?)
git-svn-id: file:///home/svn/framework3/trunk@9393 4d416f70-5f16-0410-b530-b9f4589650da
2010-06-02 08:28:39 +00:00
c6c956ab46
Small patch to enable a new stager
...
git-svn-id: file:///home/svn/framework3/trunk@8984 4d416f70-5f16-0410-b530-b9f4589650da
2010-04-03 05:21:15 +00:00
edf030df53
...and finally the bins!
...
git-svn-id: file:///home/svn/framework3/trunk@8789 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-11 17:12:31 +00:00
195d1ab4b8
Commit snojobs jpeg patch for espia with an x64 build and some minor changes on the ruby side (The 'screenshot' command is now 'screengrab' to avoid a future conflict with changes happening in stdapi).
...
git-svn-id: file:///home/svn/framework3/trunk@8726 4d416f70-5f16-0410-b530-b9f4589650da
2010-03-05 15:50:24 +00:00
4ed9e71b76
Commit the meterpreter C side (and bins) for transparent zlib (zlib.c copied from the posix meterpreter source) compression of TLV's and channels. To use transparent compression with channels, create them with CHANNEL_FLAG_COMPRESS. To use transparent compression with any TLV value, bitwise or the TLV type with TLV_META_TYPE_COMPRESSED (Don't create the TLV type with TLV_META_TYPE_COMPRESSED as the compressed flag is removed on the remote end after compression). For consistency with the ruby side we could at a later stage add a boolean compress parameter to all the packet_add_tlv_* functions so you don't have to manually specify TLV_META_TYPE_COMPRESSED flag.
...
git-svn-id: file:///home/svn/framework3/trunk@8515 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-16 14:56:24 +00:00
23901c83ea
...and the bins.
...
git-svn-id: file:///home/svn/framework3/trunk@8433 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-09 16:48:13 +00:00
b12ac46d9e
...and the stdapi bins.
...
git-svn-id: file:///home/svn/framework3/trunk@8385 4d416f70-5f16-0410-b530-b9f4589650da
2010-02-06 18:00:09 +00:00
42b331b47f
Fix #790 . Initialize the client state to be alive, tweak a few things on the meterpreter side
...
git-svn-id: file:///home/svn/framework3/trunk@8327 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-29 18:52:44 +00:00
0099fedeb3
...and the bins for the ps command fix.
...
git-svn-id: file:///home/svn/framework3/trunk@8323 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-29 12:01:26 +00:00
fc6eca57ec
...and finally the bins.
...
git-svn-id: file:///home/svn/framework3/trunk@8320 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-29 01:14:23 +00:00
284af1260a
Disable debug tracing
...
git-svn-id: file:///home/svn/framework3/trunk@8312 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 23:10:58 +00:00
f3408fd327
Fixes #744 . The core issue was the migrate code waiting on SetEvent, but the migrate stub was blocked on a WSASocket due to a pending packet_receive in the main server thread. Simply settin the thread termination signal did not work, as the SSL_read was already in progress. This change forcible terminates the main server thread before waiting on the event in order to bypass this deadlock. The downside is a failed migrate has no way to recover if it makes it this far.
...
git-svn-id: file:///home/svn/framework3/trunk@8309 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 22:55:41 +00:00
6772efb79c
...and finally the bins.
...
git-svn-id: file:///home/svn/framework3/trunk@8297 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-28 13:59:00 +00:00
de691597b6
...and finally the bins :)
...
git-svn-id: file:///home/svn/framework3/trunk@8200 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-22 19:48:21 +00:00
c92d7b68bf
...and the bins!
...
git-svn-id: file:///home/svn/framework3/trunk@8159 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-19 11:10:55 +00:00
42b3a5774d
Adds the process username to the ps output (when possible).
...
git-svn-id: file:///home/svn/framework3/trunk@8056 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-02 03:41:21 +00:00
4d7aec7c2d
Fixes #745 . This commit changes how token manipulation works, adds the steal_token, drop_token, and getprivs commands. Tested on NT 4.0, 2000 SP4, XP SP3, 2003 SP2, Vista, and Windows 7
...
git-svn-id: file:///home/svn/framework3/trunk@8055 4d416f70-5f16-0410-b530-b9f4589650da
2010-01-02 00:35:10 +00:00
9bf88af0cc
Add 64-bit
...
git-svn-id: file:///home/svn/framework3/trunk@8047 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-31 15:56:09 +00:00
98f83bbab1
Adds reg queryclass
...
git-svn-id: file:///home/svn/framework3/trunk@8046 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-31 15:52:30 +00:00
68aafc8e13
Fixes #658 by adding a 250ms sleep to the dispatch of the close call.
...
git-svn-id: file:///home/svn/framework3/trunk@7934 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-21 19:53:10 +00:00
cf6732d570
Fresh bins (including sniffer). See #672
...
git-svn-id: file:///home/svn/framework3/trunk@7807 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-10 18:36:01 +00:00
be588716c5
Bug fix for meterpreter on NT4 (Tested on NT4.0 SP6). Add a function thread_open() in thread.c to wrap the use kernel32!OpenThread and ntdll!NtOpenThread for backwards compatibility.
...
git-svn-id: file:///home/svn/framework3/trunk@7806 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-10 18:12:51 +00:00
6da0fda5ed
Updated meterpreter binaries with a slight change to the thread schedule (solves a looping problem when the socket is dead).
...
git-svn-id: file:///home/svn/framework3/trunk@7793 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-10 05:42:47 +00:00
ff19b649f3
See #662 . This should fix most of the meterpreter-side issues with sockets, there is still a second piece of this which is unflushed data on the local forwards from the ruby code.
...
git-svn-id: file:///home/svn/framework3/trunk@7761 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-08 22:08:06 +00:00
353fa1dba5
Updated binaries (32/64) with the first round of socket fixes
...
git-svn-id: file:///home/svn/framework3/trunk@7751 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-08 15:01:44 +00:00
e99e2a8d95
Rebuild with Stephen's mutex changes (rebuild of sniffer, but checking in the others as well to match).
...
git-svn-id: file:///home/svn/framework3/trunk@7734 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-07 14:44:35 +00:00
56a64a0e2d
Commit the latest windows x86/x64 build of the multi-threaded meterpreter (An x64 build of espia has been added too).
...
git-svn-id: file:///home/svn/framework3/trunk@7733 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-07 13:07:26 +00:00
dfa0d155fc
See #607 . Switch sniffer code to use mutexes
...
git-svn-id: file:///home/svn/framework3/trunk@7728 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-07 05:19:46 +00:00
8a186921e7
Rebuilt Stephen's changes locally, including the sniffer extension
...
git-svn-id: file:///home/svn/framework3/trunk@7700 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-04 17:54:01 +00:00
10d9105708
Initial commit of the multi-threaded meterpreter binaries. Only x86 today (minus the sniffer extension), x64 will follow next Monday.
...
git-svn-id: file:///home/svn/framework3/trunk@7699 4d416f70-5f16-0410-b530-b9f4589650da
2009-12-04 17:39:32 +00:00
54f952129a
A fresh build of the x64 meterpreter and extensions to sync up with the recent changes with SSL in #7311 and the addition of the rm/del command from #7291
...
git-svn-id: file:///home/svn/framework3/trunk@7316 4d416f70-5f16-0410-b530-b9f4589650da
2009-11-01 16:49:01 +00:00
e5e89906d0
Switch the meterpreter to SSLv3 and try to generate a slightly more realistic CN for the certificate. The goal is to work through a wider range of inline proxies.
...
git-svn-id: file:///home/svn/framework3/trunk@7311 4d416f70-5f16-0410-b530-b9f4589650da
2009-10-31 20:44:23 +00:00
5234fe8ff8
Fixes 416. Adds the rm/del commands to meterpreter, fixes build problems triggered by the POSIX code merge
...
git-svn-id: file:///home/svn/framework3/trunk@7291 4d416f70-5f16-0410-b530-b9f4589650da
2009-10-27 02:31:07 +00:00
8325b46694
Add Alexander Sotirov's metsvc binaries to the metepreter data directory
...
git-svn-id: file:///home/svn/framework3/trunk@7214 4d416f70-5f16-0410-b530-b9f4589650da
2009-10-20 18:43:27 +00:00
bf5068f6b1
Fixes #288 and #320 . This should fix the BSoD issue with the sniffer module (other than the mac filter change, this matches the vendor's example) and confirmed that the keyscan_dump fix works
...
git-svn-id: file:///home/svn/framework3/trunk@7066 4d416f70-5f16-0410-b530-b9f4589650da
2009-09-26 16:26:05 +00:00
3993aaf79c
espia dll
...
git-svn-id: file:///home/svn/framework3/trunk@7064 4d416f70-5f16-0410-b530-b9f4589650da
2009-09-26 04:25:37 +00:00
1937839e79
Patch meterpreter's sysinfo command to resolve the system language and architecture.
...
git-svn-id: file:///home/svn/framework3/trunk@7028 4d416f70-5f16-0410-b530-b9f4589650da
2009-09-10 13:09:48 +00:00
36d60d5d12
Commit the x64 build of the meterpreter incognito extension.
...
git-svn-id: file:///home/svn/framework3/trunk@7009 4d416f70-5f16-0410-b530-b9f4589650da
2009-09-07 09:25:25 +00:00
ff9efacffa
Commit the x64 build of the meterpreter priv extension.
...
git-svn-id: file:///home/svn/framework3/trunk@7008 4d416f70-5f16-0410-b530-b9f4589650da
2009-09-07 09:17:29 +00:00
d584b4d314
Fixed migrate for x64 meterpreter (Tested on Win 7 and 2003).
...
git-svn-id: file:///home/svn/framework3/trunk@6999 4d416f70-5f16-0410-b530-b9f4589650da
2009-09-04 01:40:48 +00:00
8bb0efb97e
the first binaries for the windows x64 meterpreter. only metsrv and stdapi for now. source code to follow later.
...
git-svn-id: file:///home/svn/framework3/trunk@6998 4d416f70-5f16-0410-b530-b9f4589650da
2009-09-03 17:50:41 +00:00
da32f1bdea
Updated meterpreter code/binaries to scrub memory after use, works around Peter's memoryze signatures from BH/DC 2009
...
git-svn-id: file:///home/svn/framework3/trunk@6942 4d416f70-5f16-0410-b530-b9f4589650da
2009-08-08 14:22:32 +00:00
ed02a67367
Updated to match the new hashing alg from Stephen Fewer
...
git-svn-id: file:///home/svn/framework3/trunk@6924 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-31 17:58:11 +00:00
2a7467dd7f
Update the meterp binaries with clean builds from svn
...
git-svn-id: file:///home/svn/framework3/trunk@6888 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-24 04:01:26 +00:00
0d931953cf
The sniffer module is now compiled against the dnet headers for packet decodes
...
git-svn-id: file:///home/svn/framework3/trunk@6831 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-18 00:10:10 +00:00
f8c2a203fd
OSVDB references updates from Steve Tornio
...
git-svn-id: file:///home/svn/framework3/trunk@6812 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-16 16:02:24 +00:00
148ca687f5
Updated libraries and source code now using OpenSSL
...
git-svn-id: file:///home/svn/framework3/trunk@6773 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-13 03:10:39 +00:00
e8784d68fb
Fixes up the sniffer to handle large packet captures better, fixes a regression in the sysinfo command.
...
git-svn-id: file:///home/svn/framework3/trunk@6768 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-12 13:17:37 +00:00
f76d73a823
Free packet memory when the capture is stopped
...
git-svn-id: file:///home/svn/framework3/trunk@6765 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-11 18:19:42 +00:00
4989f9bdbe
Fixes a bug where if the sniffer SDK could not initialize, it would still be treated as initialized the next time it was checked.
...
git-svn-id: file:///home/svn/framework3/trunk@6764 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-11 17:52:40 +00:00
645ca020e9
Fixes a memory corruption issue with the SSL file descriptor (was using a stack reference instead of the Remote->fd reference), adds the source code sans the Packet SDK for the sniffer module
...
git-svn-id: file:///home/svn/framework3/trunk@6763 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-11 17:32:50 +00:00
82cf85680c
Adds the sniffer extension for testing
...
git-svn-id: file:///home/svn/framework3/trunk@6762 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-11 13:39:43 +00:00
608ca7aae8
This patch removes some of the meterpreter compiler warnings and fixes migration over SSL
...
git-svn-id: file:///home/svn/framework3/trunk@6761 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-09 22:44:33 +00:00
7b516e06fe
Transfer the migration payload over SSL, still working on a crash bug after migration completes
...
git-svn-id: file:///home/svn/framework3/trunk@6756 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-09 03:22:10 +00:00
485d3fcb17
Merge in the meterpreter binaries with the new kernel32 loader code
...
git-svn-id: file:///home/svn/framework3/trunk@6745 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-05 20:27:33 +00:00
0c4c05fb24
Commit the SSL-updated meterpreter binaries
...
git-svn-id: file:///home/svn/framework3/trunk@6741 4d416f70-5f16-0410-b530-b9f4589650da
2009-07-05 05:22:06 +00:00
43372de9f0
Fix a bug in the new SSL code that broke large transfers
...
git-svn-id: file:///home/svn/framework3/trunk@6720 4d416f70-5f16-0410-b530-b9f4589650da
2009-06-27 01:52:36 +00:00
a74d3a3f38
Switches meterpreter to SSL by default, using the PolarSSL library. To build this, just place polarssl.lib into an workspace/common/Release/
...
git-svn-id: file:///home/svn/framework3/trunk@6718 4d416f70-5f16-0410-b530-b9f4589650da
2009-06-26 23:18:53 +00:00
746a3c533a
ext. sample dll. not ready for production enviroments
...
git-svn-id: file:///home/svn/framework3/trunk@6506 4d416f70-5f16-0410-b530-b9f4589650da
2009-04-29 03:38:42 +00:00
b360e42171
Updated sysinfo and setdesktop code
...
git-svn-id: file:///home/svn/framework3/trunk@6462 4d416f70-5f16-0410-b530-b9f4589650da
2009-04-07 15:46:45 +00:00
89ecdd9ac8
Mostly working setdesktop code, removed grabdesktop
...
git-svn-id: file:///home/svn/framework3/trunk@6393 4d416f70-5f16-0410-b530-b9f4589650da
2009-03-25 23:14:14 +00:00
8b27f5faef
Updated binaries, adds enumdesktops, setdesktop is still broken
...
git-svn-id: file:///home/svn/framework3/trunk@6383 4d416f70-5f16-0410-b530-b9f4589650da
2009-03-23 21:05:13 +00:00
ebcc19c54b
Recompiled, adds the grabdesktop, keyscan_start, keyscan_stop, and keyscan_dump commands to UI
...
git-svn-id: file:///home/svn/framework3/trunk@6367 4d416f70-5f16-0410-b530-b9f4589650da
2009-03-22 23:58:58 +00:00
5069038ecd
Fixes meterpreter's migrate function to work on DEP-enabled boxes (ticket 275). Patch by Stephen Fewer (harmonysecurity.com).
...
git-svn-id: file:///home/svn/framework3/trunk@6347 4d416f70-5f16-0410-b530-b9f4589650da
2009-03-16 21:10:58 +00:00
95f48966ed
Add the msfcli exe
...
git-svn-id: file:///home/svn/framework3/trunk@5838 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-04 20:09:16 +00:00
187f79eddf
Switch the DLLs for vnc/meterp to Stephen Fewer's reflective versions, check in the reflectve_meterpreter source code project
...
git-svn-id: file:///home/svn/framework3/trunk@5837 4d416f70-5f16-0410-b530-b9f4589650da
2008-11-04 20:08:24 +00:00
d94bfaf373
better support for nx with dllinject payloads/meterp
...
git-svn-id: file:///home/svn/framework3/trunk@5510 4d416f70-5f16-0410-b530-b9f4589650da
2008-05-26 06:34:12 +00:00
e63a121341
merge incognito updates from Luke Jennings
...
git-svn-id: file:///home/svn/framework3/trunk@5499 4d416f70-5f16-0410-b530-b9f4589650da
2008-04-28 16:57:49 +00:00
c9b652fb50
correct memset in libloader
...
git-svn-id: file:///home/svn/framework3/trunk@4725 4d416f70-5f16-0410-b530-b9f4589650da
2007-04-21 20:21:52 +00:00
80460af77e
fix DEP issue with meterp, fixes #48
...
git-svn-id: file:///home/svn/framework3/trunk@4704 4d416f70-5f16-0410-b530-b9f4589650da
2007-04-19 03:14:58 +00:00
3b1a8f31c6
updated meterp stdapi to properly detect windows vista
...
git-svn-id: file:///home/svn/framework3/trunk@4603 4d416f70-5f16-0410-b530-b9f4589650da
2007-04-01 22:04:24 +00:00
cc898298a9
new priv dll with proper page protections
...
git-svn-id: file:///home/svn/framework3/trunk@3879 4d416f70-5f16-0410-b530-b9f4589650da
2006-09-14 03:47:56 +00:00
243127447b
some meterp bugfixes found while creating a blog post :)
...
git-svn-id: file:///home/svn/incoming/trunk@3592 4d416f70-5f16-0410-b530-b9f4589650da
2006-04-07 03:02:37 +00:00
9612409872
timestomp integration
...
git-svn-id: file:///home/svn/incoming/trunk@3219 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-14 00:34:05 +00:00
e645a3f467
initial import of the priv esc extension
...
git-svn-id: file:///home/svn/incoming/trunk@3209 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-13 05:59:59 +00:00
d9ac34db33
support for locking images in memory to prevent swap out
...
git-svn-id: file:///home/svn/incoming/trunk@3208 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-13 04:09:12 +00:00
954588ea9e
support for RevertToSelf
...
git-svn-id: file:///home/svn/incoming/trunk@3207 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-13 03:57:20 +00:00
9becfdf944
added a command, cleaned up some code
...
git-svn-id: file:///home/svn/incoming/trunk@3179 4d416f70-5f16-0410-b530-b9f4589650da
2005-12-06 03:56:29 +00:00
d99e5b4f89
fix module dependency problem, made it so the server sock in meterp isn't inherited
...
git-svn-id: file:///home/svn/incoming/trunk@2842 4d416f70-5f16-0410-b530-b9f4589650da
2005-08-22 01:42:13 +00:00
9842cdc33b
migration now enables the debug privilege first so it can migrate to system services, added reboot/shutdown wrappers
...
git-svn-id: file:///home/svn/incoming/trunk@2834 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-26 04:52:59 +00:00
7eb2c68d58
fix interactive channels
...
git-svn-id: file:///home/svn/incoming/trunk@2833 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-26 04:08:01 +00:00
539af94716
made ls prettier/faster
...
git-svn-id: file:///home/svn/incoming/trunk@2821 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-23 17:52:29 +00:00
71f0bf7a23
pay attention to flags too
...
git-svn-id: file:///home/svn/incoming/trunk@2818 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-22 04:28:37 +00:00
7e1879d4d2
fixed in mem shit
...
git-svn-id: file:///home/svn/incoming/trunk@2817 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-22 04:25:57 +00:00
60baa323ea
new stdapi with in mem fixes
...
git-svn-id: file:///home/svn/incoming/trunk@2816 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-22 04:12:22 +00:00
ded1cec87a
new stdapi with in-mem support and sysinfo and getuid
...
git-svn-id: file:///home/svn/incoming/trunk@2810 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-22 03:40:39 +00:00
9f7f7f0e53
new version with the mad new skills
...
git-svn-id: file:///home/svn/incoming/trunk@2677 4d416f70-5f16-0410-b530-b9f4589650da
2005-07-08 03:16:26 +00:00
f699fd0a23
updated metsrv.dll
...
git-svn-id: file:///home/svn/incoming/trunk@2592 4d416f70-5f16-0410-b530-b9f4589650da
2005-06-08 06:52:18 +00:00
24f53393f3
maybe
...
git-svn-id: file:///home/svn/incoming/trunk@2518 4d416f70-5f16-0410-b530-b9f4589650da
2005-05-24 22:19:51 +00:00
ec177c9de2
stdapi
...
git-svn-id: file:///home/svn/incoming/trunk@2517 4d416f70-5f16-0410-b530-b9f4589650da
2005-05-24 21:11:57 +00:00
James Lee
amaloteaux
Stephen Fewer
Matt Weeks
HD Moore
Joshua Drake
Matt Miller
Spoon M