Commit Graph

840 Commits (d3c52f35ad203a6450ea6345296482d9ae3a887b)

Author SHA1 Message Date
OJ b60398b020 Merge branch 'upstream/master' into clipboard_monitor
Conflicts:
	lib/rex/post/meterpreter/extensions/extapi/tlv.rb
2014-01-29 23:07:05 +10:00
OJ ad1dce38d2 Final fixes before the monitor PR 2014-01-29 23:04:43 +10:00
OJ 2ef0e7e2a5 Small tidy of code 2014-01-29 17:07:06 +10:00
OJ e27707cac3 More tweaking of the clipboard monitor with dump/purge 2014-01-29 14:51:03 +10:00
OJ 10ac7a22af
Land #2897 Sane address resolution [FixRM #7259] 2014-01-28 23:09:44 +10:00
Meatballs 6d9e395d40
Use LPVOID to avoid ptr trunc 2014-01-24 23:27:56 +00:00
Tod Beardsley 1ff063d7de
Test the object not the class duhhh 2014-01-24 11:46:48 -06:00
Tod Beardsley 37b11ce2e1
Use Class#kind_of? instead of == 2014-01-24 11:31:04 -06:00
Meatballs 9fce617462
Fixup railgun utils
Implement DsGetDcNamea to return current domain using example
railgun utils techniques.
2014-01-24 16:22:05 +00:00
Meatballs 9acd0f4b56
Merge remote-tracking branch 'upstream/master' into enum_ad_perf 2014-01-22 21:46:50 +00:00
OJ 83358fbbf0 More work on the clipboard monitor 2014-01-22 22:56:13 +10:00
OJ a7d4aa5d46 Merge branch 'upstream/master' into clipboard_monitor
Conflicts:
	lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb
2014-01-22 11:51:10 +10:00
James Lee e9ccec4755
Refactor load_session_info
All of this code is in sore need of some specs but I think this change
makes it a bit easier to understand what it is supposed to be doing.
2014-01-21 18:55:54 -06:00
Meatballs 720f892e2f
Merge remote-tracking branch 'upstream/master' into enum_ad_perf 2014-01-21 21:00:51 +00:00
OJ 9212013c3e Add error message support
This commit enables returning of error messages based on the HRESULT.
They still aren't nice, but they're better than nothing.
2014-01-17 11:42:07 +10:00
OJ 8e1d3c9c2a Final tweaks for WMI support 2014-01-16 22:02:28 +10:00
OJ 69abffaff6 First pass of WMI support
Close but more to do.
2014-01-16 13:47:46 +10:00
OJ 870349acd0
Merge branch 'upstream/master' into basic_adsi_support 2014-01-15 19:57:07 +10:00
OJ 0f722cbe6d Add ext_server_kiwi, which is Mimikatz v2
This is a separate extension because the new version doesn't support
as many operating systems as the old version, but it does have more
new features which are really funky.
2014-01-10 16:51:01 +10:00
OJ e3b90f3c4e Fix issue with incorrect parameter parsing
Code was looking for -s instead of -a when dealing with domain
queries. This commit fixes that.
2014-01-05 20:06:47 +10:00
Tod Beardsley bd2033c587
Land #2814, streaming webcam STDAPI add 2014-01-03 12:09:25 -06:00
Meatballs 5adc9e93f4
Merge remote-tracking branch 'upstream/master' into extapi_service_post 2014-01-03 14:39:55 +00:00
OJ ef281bf31d Adjust the getenv API
The getenv call in sys/config was renamed to getenvs and now uses
the splat operator so that arrays don't have to be passed in. A
new function called getenv was added which takes a single argument
and returns a single value back (for ease of use).
2014-01-03 08:05:45 +10:00
sinn3r e6823c39c2 Incorrect variable used 2014-01-02 00:50:32 -06:00
sinn3r 92a0ff1096 Add webcam livestream feature for meterpreter
[SeeRM #8729] - This meterpreter command allows the attacker to observe the target at real-time
by turning their webcam live. There is also a HTML-based player provided, which does not require
a plugin or anything, just open it with a browser. The HTML-based player also allows the attacker
to put livestream on the web (evil? yeah, kind of.)
2013-12-30 18:38:13 -06:00
Meatballs 3ef1c0ecd6 Merge remote-tracking branch 'upstream/master' into enum_ad_perf 2013-12-19 14:25:07 +00:00
Meatballs 244cf3b3f6 Merge remote-tracking branch 'upstream/pr/2736' into enum_ad_perf 2013-12-19 13:59:57 +00:00
Meatballs 8e88b63ccb
Organise service constants
Try to establish some sanity to file...
2013-12-16 23:59:14 +00:00
Meatballs ca1c887e68 Add missing ] 2013-12-15 01:12:50 +00:00
Meatballs a930056d7f Added service status checks to Post::Windows::Services
Added QueryServiceStatus to Railgun Advapi32 Definitions
Added Checks to module

Conflicts:
	lib/msf/core/post/windows/services.rb
	lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_advapi32.rb
2013-12-15 01:12:45 +00:00
Spencer McIntyre a08c420862 Add railgun definitions for local exploit relevant functions. 2013-12-12 10:26:08 -05:00
OJ 64b1e78e34 Fix page size and max results 2013-12-11 00:03:05 +10:00
OJ 8a1517fde8 Fix issues with missing params on computer enum
No more late night and rushed commits, its still and wastes people's time.

Thanks sinn3r for getting on this. Apologies for the poor quality of the PR.
2013-12-10 21:06:28 +10:00
OJ 2237419134
Merge branch 'upstream/master' into basic_adsi_support 2013-12-10 20:58:38 +10:00
Meatballs 45a0ac9e68
Land #2602, Windows Extended API
Retrieve clipboard data
Retrieve window handles
Retrieve service information
2013-12-08 19:01:35 +00:00
Meatballs e5a92a18a5
and expand path 2013-12-08 19:01:03 +00:00
Meatballs 3c67f1c6a9
Fix file download 2013-12-08 18:57:10 +00:00
OJ a3c050c8b6 Added page size setting 2013-12-08 23:29:42 +10:00
OJ 8172596c0b Fix rendering of result total 2013-12-08 20:58:03 +10:00
OJ f13736d208 Add support for general domain queries
Specific queries are just wrappers over the top of the domain query
2013-12-08 20:41:30 +10:00
OJ 35b051174c Add basic ADSI enum of users and computers 2013-12-07 00:22:54 +10:00
OJ e90b7641ca Allow self-destruct via "kill -s"
HTTP(s) payloads don't exit cleanly at the moment. This is an issue that's
being addressed through other work. However, there's a need to be able to
terminate the current HTTP(s) session forcably.

This commit add a -s option to kill, which (when specified) will kill
the current session.
2013-12-06 14:56:19 +10:00
OJ 4ca48308c1 Fix downloading of files 2013-12-06 13:40:20 +10:00
OJ 1d757c40db Remove empty parens 2013-12-04 07:10:23 +10:00
OJ 8b77da4ef7 Fix non-rubyisms 2013-12-04 07:06:32 +10:00
OJ 18e1d9ce17 Revert "Start clipboard monitor functionality"
This reverts commit ecbdfd3502.

I don't know how this got in there, as it's in another branch waiting for more work.
My bad.
2013-12-04 07:03:12 +10:00
OJ 1a65566005 Add the getenv command which pulls env vars from the victim
This command will allow the attacker to grab environment variables from the
target, if they exist. Calling this function allows for one or more values
to be passed in, which should match the name of the variable required. If
the variable is found, it is returned. If it is not found, the variable
is not returned (ie. it's not present in the resulting hash).

Note 1: POSIX environment vars are case-senstive, whereas Windows is not.
Note 2: POSIX doesn't seem to cough up user environment vars, it only returns
system vars. I'm not sure why this is, but it could be because of the way
we do linking on POSIX.
2013-11-26 10:05:50 +10:00
OJ 86b6d647bf Merge branch 'upstream/master' into ext_server_extapi 2013-11-25 07:43:36 +10:00
OJ 4d1c3c1f01 Start clipboard monitor functionality
Added the basics of the clipboard monitor functionality with usage
messages and stuff like that. Lots more to do.
2013-11-22 13:31:40 +10:00
OJ ecbdfd3502 Start clipboard monitor functionality
Added the basics of the clipboard monitor functionality with usage
messages and stuff like that. Lots more to do.
2013-11-21 06:29:37 +10:00
jvazquez-r7 4cf16cf360
Land #2633, @OJ's port of Kitrap0d as local exploit 2013-11-14 09:27:10 -06:00
sinn3r d483f2ad79
Land #2618 - rm shebangs 2013-11-11 11:55:23 -06:00
OJ 6a25ba18be Move kitrap0d exploit from getsystem to local exploit
This version modifies the existing meterpreter session and bumps the privs
up to SYSTEM. However it's not how local exploits are supposed to work.
More work will be done to make this create a new session with the elevated
privs instead.
2013-11-11 17:14:40 +10:00
Tod Beardsley cc9ac7695d
Land #2592, add getproxy
Needed for new functionality in #2612
2013-11-08 13:20:20 -06:00
Jonathan 575072585f removed shebangs from files within rex 2013-11-07 18:51:59 -05:00
OJ 1dacf7e57e Last lot of shebangs removed 2013-11-07 07:35:51 +10:00
OJ 6422e1d6e8 Remove shebang, code tidy, as per @jlee-r7's gripes 2013-11-07 07:32:04 +10:00
OJ 7dcb071f11 Remote shebang and fix pxexeploit 2013-11-06 07:10:25 +10:00
OJ d1e008387a Stop auto preview, code clean
Removed the auto preview of captured images from the clipboard.

Removed parens from calls to print_line.
2013-11-05 07:15:31 +10:00
OJ f62247e731 Fix comments, indenting and pxexploit module
Updated the comments and indentation so they're not blatantly wrong.

Adjusted the pxexploit module so that it doesn't break any more as
a result of the refactoring.
2013-11-05 06:35:50 +10:00
OJ ff78082004 Refactor lanattacks ruby code, add command dispatcher
The lanattacks module didn't seem to have a command dispatcher, and
hence loading the module would always result in a failure. This
commit fixes this problem.

The commit contains a bit of a refactor of the lanattacks code to be
a little more modular. It also has a shiny new dispatcher which breaks
the DHCP and TFTP functionality up into separate areas.
2013-11-04 17:37:42 +10:00
OJ d658fa46b4 Updated help, removed binaries 2013-11-02 23:10:16 +10:00
OJ 67fbeacbf0 Add support for optional image downloading
Without -d, `CF_DIB` types will just show image dimensions. Running
with -d will result in the image being looted.
2013-11-02 23:07:13 +10:00
OJ 2fbac9b129 Add `getproxy` command
This command pulls out system proxy details on windows machines.
2013-10-30 18:40:51 +10:00
OJ 1f6c320bb3
Tidy up of extapi code, new bins
* Rename methods to remove redundancy.
* Update bins to freshly compiled version.
* Use the Rex Table functionality instead of custom look.
* Use the `usage` feature of the Arguments class for help.
2013-10-29 21:22:05 +10:00
OJ 606411de81 Fix mimikatz error when password is nil
In some cases the password value that comes out of mimikatz results
is `nil`, instead of an empty string. This fixes this so that if
the string is `nil` is falls back to an empty string, resulting in
the call to `gsub` working instead of failing.
2013-10-29 15:13:32 +10:00
sinn3r ee95ca5e2b
Land #2158 - Fix NoMethodError undefined method `split' for nil:NilClass 2013-10-22 16:01:27 -05:00
sinn3r e1c4aef805
Land #1789 - Windows SSO Post Module 2013-10-22 15:48:15 -05:00
OJ cf65f59a28 Retry shell without thread impersonation
In certain scenarios on Windows XP there are times when creating a
shell fails with the error `ERROR_PRIVILEGE_NOT_HELD`. When this
happens the user will usuall fallback to a non-impersonated shell
via the command: `execute -f cmd.exe -H -i -c`

This patch catches the error, warns the use of the failure and then retries
to create the interactive shell without the `-t` flag.
2013-10-21 15:29:19 +10:00
OJ 4e90394c7f
Add support for CF_DIB clipboard formats
Image data copied to the clipboard, such as a screenshot, is converted to a JPEG using GDI+, and downloaded to the local loot folder.

This feature doesn't work with W2K as a result, but that doesn't really bother me. The code is simpler and much smaller as a result and doesn't require the inclusion of the jpeg library code.
2013-10-21 00:05:42 +10:00
OJ d4d4839dc2
Add size (bytes) of the files on the clipboard
Output of the `clipboard_get_data` call now includes the size
of each file in bytes.
2013-10-16 22:54:55 +10:00
OJ afc5e282a9
Add CF_HDROP file support to the clipboard
`clipboard_get_data` has been changed so that raw text is supported and file listings are supported.

If files are on the clipboard, those files and folders are listed when this command is run. To download the files, pass in the `-d` option.
2013-10-16 17:46:22 +10:00
OJ 414a814d5d
Add the start of clipboard support
This commit adds support for getting text-based information from the
victim's clipboard and for setting text-based data to the victim's
clipboard. Early days, with much wiggle room left for extra fun
functionality.
2013-10-15 23:57:33 +10:00
OJ ea89b5e880
Add support for child window enumeration
Children of windows can now be enumerated via the -p parameter, which
specifies the handle of the parent window to enumerate.

There is also a -u parameter which includes unknown/untitled windows
in the result set.
2013-10-15 18:02:27 +10:00
OJ b99af52279 Improve extapi ruby structure, add bins
The extapi project will get bigger over time so this change allows for the code to get
bigger without becoming a headache before it starts.

Added binaries to this commit as well.
2013-10-11 09:52:23 +10:00
Meatballs 378f403fab
Land #2453, Add stdapi_net_resolve_host(s) to Python Meterpreter.
Moves resolve_host post module to multi and depreciates Windows module.
Resolve will now return nil for failed lookups instead of an empty
string.
2013-10-10 20:13:06 +01:00
OJ cbaeebeff7 Add service_query to ext_server_extapi
Once the user has queried the list of services they can now use the
`service_query` function to get more detail about a specific service.
2013-10-11 01:02:51 +10:00
OJ 23340e9df0 Add service_enum to the ext_server_extapi extension
This commit adds the ability to enumerate services on the target machine,
showing the PID, the service name, the display name and an indication of
the service's ability to interact with the desktop.

Some other small code tidies were done too.
2013-10-10 21:23:23 +10:00
Spencer McIntyre 6c382c8eb7 Return nil on error, and move the module to post/multi. 2013-10-09 16:52:53 -04:00
OJ 47801c17b3 MSF started to the extended API with window enum
Decided to kick off a new extended API extension with mubix and
kernelsmith to include some more advanced enumeration stuff. The goal of
this extension is to take stuff that wouldn't be part of the std api but
is rather useful for enumeration of a target once meterpreter has been
established.

This commit kicks things off with enumeration of top level windows on the
current desktop.
2013-10-09 22:25:43 +10:00
OJ 21afa9defe Meterpreter railgun multi call fix
Modifications accommodate changes in the multi-call railgun code that
were made to Meterpreter.

This also includes a fix for Redmine 8269, so the Windows constants
now work correctly with the multi-calls.
2013-10-04 12:04:18 +10:00
OJ 82162ef486 Add error message support to railgun
This code was lost in the transition when the meterpreter source was
removed from the metasploit-framework source. I'm pulling this in by
request of @dmaloney-r7 who originally requested this code be inculded
as part of https://github.com/rapid7/metasploit-framework/pull/740

I added an extra bit of code to free up memory that is allocated by the
call to FormatMessage and forced the ASCII-version (FormatMessageA) of
the call.

This PR is the MSF side of https://github.com/rapid7/meterpreter/pull/26
2013-10-01 17:23:08 +10:00
Tod Beardsley 701410f608
Land #2414, portfwd teardown and recreate
[FixRM #8240]
2013-09-25 17:40:47 -05:00
Tod Beardsley 1a515093cb Idiomatic Ruby
Assuming this gets accepted, this should [FixRM #8240]. Take a look, and
if you're good with it, I'll land on master. Everything seems to work
out on this end.
2013-09-25 17:26:00 -05:00
Meatballs f1e563d375 Merge branch 'master' of github.com:rapid7/metasploit-framework into enum_ad_perf 2013-09-24 19:08:52 +01:00
OJ 0038bb90b1 Remove unncessary counter var 2013-09-24 13:35:29 +10:00
OJ b91e344815 Add code to recreate the forwards after migration
* Feels like a bit of a hack job, but it works.
2013-09-24 13:27:58 +10:00
Tod Beardsley e885ab45b6
Land #1734 Metasploit side for ip resolv 2013-09-23 16:18:40 -05:00
sinn3r b6c7116890 Land #1778 - Mimikatz Fix for table.print and x86 warning 2013-09-20 16:13:53 -05:00
Meatballs 72155f8e9e Comment update 2013-09-19 19:46:05 +01:00
OJ 598e85a8d9 Fix for dangling port forwards
Code tears down the port forwards prior to migrating so that we don't end up with dangling connections that don't work.
2013-09-19 19:27:54 +10:00
Tod Beardsley dae8847c4d
Land #2374, more complete 32/64 migrate fix
[FixRM #8395]
2013-09-17 14:52:04 -05:00
James Lee 21055f6856 Add x86 to meterpreter's binary suffix
This makes x86 more consistent with x64.

Also replaces a bunch of instances of:
  File.join(Msf::Config.install_root, 'data', ...)
with the simpler
  File.join(Msf::Config.data_directory, ...)

[See rapid7/meterpreter#19]
2013-09-16 21:52:04 -05:00
James Lee d6954e9ce7 Fix migrate from 32- to 64-bit processes
In some cases, it was possible to end up in a situation where the x64
reflective library hadn't been loaded by the time a user typed migrate.
If the target process was 64-bit, msfconsole would error out with a
NoMethodError and much sadness would ensue.

[See #2356]
2013-09-16 16:04:50 -05:00
HD Moore 72dff03426 FixRM #8396 change all lib use of regex to 8-bit pattern 2013-09-12 16:58:49 -05:00
Tab Assassin b3b8cee870 Retab changes for PR #1473 2013-09-05 16:19:05 -05:00
Tab Assassin 0ba4e1da65 Merge for retab 2013-09-05 16:18:56 -05:00
Tab Assassin 2e9096d427 Retab changes for PR #1734 2013-09-05 14:59:41 -05:00
Tab Assassin 322ed35bb4 Merge for retab 2013-09-05 14:59:34 -05:00
Tab Assassin 701513a212 Retab changes for PR #1778 2013-09-05 14:56:35 -05:00
Tab Assassin 3788bab8e5 Merge for retab 2013-09-05 14:56:30 -05:00
Tab Assassin 26b8364dcb Retab changes for PR #1789 2013-09-05 14:44:21 -05:00
Tab Assassin 789be1fe3e Merge for retab 2013-09-05 14:44:14 -05:00
Tab Assassin 874ed2ac17 Retab changes for PR #2107 2013-09-05 14:30:08 -05:00
Tab Assassin 27564b2de2 Merge for retab 2013-09-05 14:30:03 -05:00
Tab Assassin daed98931e Retab changes for PR #2158 2013-09-05 14:19:55 -05:00
Tab Assassin 27fd54092a Merge for retab 2013-09-05 14:19:49 -05:00
Meatballs 051ef0bdfa Refactor to common post module 2013-09-02 20:24:54 +01:00
Tab Assassin 7e5e0f7fc8 Retab lib 2013-08-30 16:28:33 -05:00
Meatballs 08c32c250f File versions 2013-08-08 19:42:14 +01:00
Tod Beardsley 7e539332db Reverting disaster merge to 593363c5f with diff
There was a disaster of a merge at 6f37cf22eb that is particularly
difficult to untangle (it was a bad merge from a long-running local
branch).

What this commit does is simulate a hard reset, by doing thing:

 git checkout -b reset-hard-ohmu
 git reset --hard 593363c5f9
 git checkout upstream-master
 git checkout -b revert-via-diff
 git diff --no-prefix upstream-master..reset-hard-ohmy > patch
 patch -p0 < patch

Since there was one binary change, also did this:

 git checkout upstream-master data/exploits/CVE-2012-1535/Main.swf

Now we have one commit that puts everything back. It screws up
file-level history a little, but it's at least at a point where we can
move on with our lives. Sorry.
2013-07-29 21:47:52 -05:00
jvazquez-r7 455569aee8 Merge branch 'master' of https://github.com/rapid7/metasploit-framework 2013-07-29 12:10:12 -05:00
Meatballs b99ad41a64 Add api constants and tidy 2013-07-26 01:48:39 +01:00
Meatballs 0235e6803d Initial working 2013-07-25 23:24:11 +01:00
Meatballs 1d2d4b5345 Add some null checks 2013-07-25 18:35:11 +01:00
Meatballs 0ce3fe2e7c Added service status checks to Post::Windows::Services
Added QueryServiceStatus to Railgun Advapi32 Definitions
Added Checks to module
2013-07-05 22:25:04 +01:00
Meatballs 6c62463f83 Add ipv6 resolution and remove nix 2013-06-20 22:17:31 +01:00
Meatballs 1637651bbb Revert multilang test 2013-06-15 17:48:32 +01:00
Meatballs 62e335dab2 Resolve conflict 2013-06-15 17:40:37 +01:00
Meatballs fc7d151273 Add multilang syscheck 2013-06-15 17:39:01 +01:00
Tod Beardsley 14c4dbcf8c Also remove *.ts.rb files
On the heels of #1862, this gets rid of the "test suites" that bound
together all the old unit tests.
2013-05-28 17:05:44 -05:00
Tod Beardsley 05916c079e Inline unit tests are so last decade
Aside from codebase-wide changes, nearly all of these tests haven't been
touched since before 2010, and there is no effort to maintain this style
of testing. We've moved on to (correctly) seperating out our tests from
our codebase.
2013-05-23 12:41:14 -05:00
Meatballs 7fb092c58c Initial commit 2013-05-02 22:08:19 +01:00
Meatballs 293c847a32 Fix table.print 2013-04-29 22:02:41 -05:00
Meatballs 69dead8c8f Tidier 2013-04-29 23:17:11 +01:00
Meatballs 36ef2cb5a1 x86 warning for mimikatz 2013-04-29 23:14:32 +01:00
Meatballs 02788f71d9 Fix table.print 2013-04-29 22:37:02 +01:00
James Lee d53d6370b3 Land #1747, mimikatz meterpreter extension
[Closes #1747]

See rapid7/meterpreter#9
2013-04-29 14:45:07 -05:00
Meatballs fab1781812 Refactored to send custom commands 2013-04-22 10:04:38 +01:00
Meatballs 6656514616 Msftidy 2013-04-21 14:34:47 +01:00
Meatballs fc621e8d7e Parse ssp correctly 2013-04-21 10:55:01 +01:00
Meatballs 83fbc3e46f Small fix and attribution to gentilkiwi 2013-04-21 00:36:43 +01:00
Meatballs cec737d399 tidy and table header 2013-04-20 18:05:47 +01:00
Meatballs b219a23f00 Refactoring 2013-04-20 18:00:46 +01:00
Meatballs 20849714ac Add all methods 2013-04-20 17:27:32 +01:00
Meatballs ddaa09edad Added msv 2013-04-20 16:31:45 +01:00
Meatballs 83578dec68 Getprivs by default 2013-04-20 14:59:07 +01:00
Meatballs a23d7bb66f Add client UI and parse results 2013-04-20 12:20:38 +01:00
Meatballs 5fa81942db Initial comms 2013-04-19 22:19:50 +01:00
Meatballs 67791c12a5 Small tidy 2013-04-14 11:18:45 +01:00
Meatballs 26479bbe82 Fixup resolve_host 2013-04-14 10:58:51 +01:00
Meatballs 6a7fc70274 Remove length stuff 2013-04-14 10:54:19 +01:00
Meatballs 6bca2b305f Typo 2013-04-14 10:44:00 +01:00
Meatballs 849b42ffb9 Further tidy 2013-04-14 10:42:15 +01:00
Meatballs 4b4f77eb0f Finalize 2013-04-14 10:32:56 +01:00
Meatballs 3660ad8c0a Initial attempt 2013-04-07 23:03:43 +01:00
Meatballs d94360c451 Merge remote branch 'upstream/master' into enum_ad_perf 2013-04-07 14:29:45 +01:00
James Lee 067140643e Landing #1579, meterpreter mv
See rapid7/meterpreter/#6
2013-04-04 23:42:31 -05:00
James Lee ad46b46684 Landing #1463, Meatballs' cdecl fixes 2013-04-04 22:58:59 -05:00
RageLtMan d399093d80 Add Framework side of stdapi.fs.file.mv
Add the appropriate methods to Rex side of the FS extension and
the commensurate command dispatcher.

Requires https://github.com/rapid7/meterpreter/pull/6 from the
meterpreter repo as well as compiling fresh DLL for
ext_server_stdapi.
2013-03-12 02:06:38 -04:00
James Lee c3fa62cd59 Whitespace at EOL 2013-03-07 18:16:57 -06:00
Meatballs cbbfa1765e Handling for 1000 limit 2013-02-11 23:27:03 +00:00
Meatballs 595cace025 Fixup wldap32 mistakes 2013-02-08 22:25:07 +00:00
Meatballs a980419285 msftidy 2013-02-08 21:02:37 +00:00
Meatballs a6fea39583 Change to wldap to allow cdecl 2013-02-08 21:01:22 +00:00
Meatballs a9bf09aa06 Add calling conv to railgun 2013-02-08 19:26:33 +00:00
James Lee 071df7241b Merge branch 'rapid7' into sonicwall_gms
Conflicts:
	modules/exploits/multi/http/sonicwall_gms_upload.rb

Adds a loop around triggering the WAR payload, which was causing some
unreliability with the Java target.
2013-02-07 21:53:49 -06:00
James Lee bf28be7cff Fix some comments that yard parsed incorrectly 2013-02-07 18:36:04 -06:00
jvazquez-r7 1e1cbd7445 Merge branch 'wldap32_railgun' of https://github.com/Meatballs1/metasploit-framework into Meatballs1-wldap32_railgun 2013-01-30 21:01:31 +01:00
sinn3r fc833ea8df Catch exceptions and return value 2013-01-28 10:30:59 -06:00
rogueclown 169f91159e added 'from' PID to meterpreter migrate message 2013-01-27 21:18:49 -06:00
Rob Fuller 27aae87c18 Stop aggravating default show screenshot
A better fix would have it detect default browsers 
as being text only like lynx. But this has got to
go one way or another. Loosing shell because I forgot
to do -v false is wall punch worthy
2013-01-24 22:06:51 -05:00
Meatballs1 567185ec65 Better cleanup and address comments 2013-01-20 00:19:17 +00:00
Meatballs1 4ee80e76bd msftidy wldap32 2013-01-19 23:15:20 +00:00
Tod Beardsley 9f42abdb95 Whitespace fixup 2013-01-18 15:44:52 -06:00
Tod Beardsley 0c3e7ee3e0 Merge remote-tracking branch 'Meatballs1/reboot_force2' 2013-01-18 15:01:51 -06:00
James Lee 4fd4af1f43 Fix typo that breaks record_mic command 2013-01-16 16:30:38 -06:00
James Lee 0f346dde9e Some whitespace and ruby -c fixes 2013-01-10 17:29:54 -06:00
James Lee ab64c428ab Merge remote-tracking branch 'kernelsmith/RM7676-migrate-h' into rapid7 2013-01-10 17:24:11 -06:00
James Lee d4854606f2 Cosmetic fixes
[FixRM #7223][See #1283]
2013-01-10 17:18:25 -06:00
kernelsmith e8c239dc81 changed TODO to @todo per egypt 2013-01-10 16:35:01 -06:00
kernelsmith b3266823ba Addressed egypt's comments
-changed the suspend/resume loop logic to reduce code duplication.
-fixed up some print_*'s to remove embedded \n's
-changed formatting on some error messages
-switched comment to a TODO:
-change host_processes.select (blah} to use .find instead
-adjusted code due to remvoal of the pids.dup, resulting in arr_pids
disappearing
2013-01-10 15:40:54 -06:00
kernelsmith b11f941387 cleaned up at validate_pids conversion, fixed YARD doc
in validate_pids no longer need dup as conversion to ints was cleaned
up to use map.  Which also improved readability and allowed adding uniq
and compact, thanks egypt.
YARD doc on cmd_suspend was incorrectly organized
2013-01-10 14:59:02 -06:00
kernelsmith 92e8def889 adds suspend to meterp and adds full pid validation
This fully fixes RM7223 and adds the suspend command to the meterpreter
interface.
Suspend allows you to suspend and resume running processes on the
targethost.  It was originally written as a post module (and the dll
version will be submitted as such later), but egypt suggested I add it
to meterpreter
2013-01-09 23:25:32 -06:00
kernelsmith 4728a59189 fixes RM7676 migrate -h doesn't produce help
also adds YARD doc to cmd_migrate in collusion with egypt.
low threat change, but still tested on Win7-32 sp0, ruby 1.9.3-p125,
Framework Version: 4.6.0-dev just for kicks
2013-01-09 16:28:04 -06:00
kernelsmith 3b8914c270 skeleton & YARD doc for cmd_suspend added
functionality untested atm.
cmd_suspend_help also added
2013-01-09 15:34:04 -06:00
Meatballs1 04714893c8 Add force option to reboot command 2013-01-04 09:20:56 +00:00
Meatballs1 0b3143ff45 Fix railgun EOL 2012-12-30 16:32:15 +00:00
sinn3r e05b55f32d Add new functions 2012-12-28 03:48:35 -06:00
Meatballs1 378038afab Merge remote-tracking branch 'upstream/master' into wldap32_railgun 2012-12-17 17:23:43 +00:00
Meatballs1 6a92bd609a Tidying and refactoring 2012-12-17 15:29:04 +00:00
Meatballs1 b5fd3463d7 Initial working AD_LDAP lookup 2012-12-17 14:07:35 +00:00
Rob Fuller b3118afcbb Correct Railgun WriteProcessMemory var type
This is described here:
https://dev.metasploit.com/redmine/issues/7237

After change operates as expected.
2012-12-15 23:11:52 -05:00
kernelsmith 11fec0bc07 adds rudimentary validity checking to pids for meterp kill
addresses redmine https://dev.metasploit.com/redmine/issues/7223, but
may not be a truly encompassing solution.  'good bandaid' as egypt put
it
2012-12-05 13:17:33 -06:00
Meatballs1 e057467329 Initial attempt 2012-11-18 21:24:49 +00:00
James Lee d0650dfb25 Put a bandaid over getsockname
Depending on how a socket was created, #getsockname will return either a
struct sockaddr as a String (the default ruby Socket behavior) or an
Array (the extend'd Rex::Socket::Tcp behavior). Avoid the ambiguity when
generating SSL certificates for meterpreter handlers by always picking a
random hostname.

This is by no means a proper fix for the underlying problem of
Socket#getsockname having ambiguous behavior before and after being
extended with Rex::Socket::Tcp. It does, however, solve the immediate
problem of not being able to create tunneled meterpreter sessions over
http(s) sessions.

[SeeRM #7350]
2012-10-29 22:45:46 -05:00
James Lee dafb56f6b6 Merge branch 'dmaloney-r7-findpids' into rapid7
[Closes #950]
2012-10-22 15:52:07 -05:00
James Lee 651f9b9c8f Use opts.usage instead of a Table 2012-10-22 15:16:55 -05:00
James Lee 45a60b6bdd Clarify why we need to sleep.
[Closes #911][FixRM #7344]
2012-10-15 17:54:18 -05:00
Raphael Mudge f4b151f63d Detect and mitigate CPU starvation condition [SeeRM #7344] 2012-10-15 17:54:18 -05:00
Rob Fuller b984d33996 add RunAs ask module 2012-10-06 00:51:44 -04:00
Luke Imhoff df9db42c32 Fix module reloading
[#36737359]

The merging of reload_module and the various load_module methods
resulted in the module loading from disk, but because the Hash entry in
the module manager was not deleted before on_module_load was called, the
newly reloaded module was logged as an ambiguous module name instead of
a reload.  In order to report the reload errors correctly, I determined
that module_load_error_by_reference_name should really be
module_load_error_by_path.  I eliminated faild in favor of this new name
since failed was just calling the attribute and the attribute's name is
clearer about the format of the data.

Tested by run rexploit and then exiting over and over with
ms08_067_netapi.  When I messed up the file so it couldn't load, by
adding `inclde Exploit` (note mispelling of `include`), it reported the
error to msfconsole.  When I removed the bad line and added a puts
"RELOADING <n>", where I kept incrementing n and saving the file, the
new number appeared during each rexploit.
2012-10-04 16:32:12 -05:00
David Maloney 4511dead88 Fix up the ps help 2012-09-21 13:45:09 -05:00
David Maloney 5738d808ba Add a bunch of extra filter options 2012-09-21 13:27:16 -05:00
David Maloney 14c94e4f03 rolled changes into existing ps command
Some users requested this be added to the ps
command via a -S opt instead of creating a new command.
This limits the search to only one search parameter at a time
but with the ability to pass RegEx I think that's fine
2012-09-19 08:28:36 -05:00
David Maloney 4dbe7767ca Merge branch 'master' into findpids 2012-09-19 07:55:54 -05:00
David Maloney 71e57a6067 Moved help text into cmd_findpids_help 2012-09-12 08:26:31 -05:00
Tod Beardsley cf98f52036 Should resuce nil as well 2012-09-10 09:33:45 -05:00
RageLtMan 1facfcf6d9 remove commented old method 2012-09-10 09:33:45 -05:00
RageLtMan ef0f4d0acc Fix Meterpreter edit command file removal
fs.rb was originally attempting to call the "close" method on a
string holding the temporary path to the file being editted.
Replaced with ::File.delete(temp_path).
2012-09-10 09:33:45 -05:00