f0b945e4c4
Updated cache size
2016-05-24 09:06:46 -05:00
d328258db4
Updated Cache size
2016-05-24 09:06:28 -05:00
2694907b79
update cached payload size
2016-05-23 14:30:43 -05:00
cf62218139
Update payload sizes
2016-05-23 14:27:11 -05:00
efc64eaa5f
Implement reverse_tcp_rc4_dns payload in metasm
...
Using the ruby methods for generating assembly blocks defined or
separated in prior commits, create a new payload from the existing
assembly blocks which performs a DNS lookup of the LHOST prior to
establishing a corresponding socket and downloading, and
decrypting the RC4 encrypted payload.
For anyone looking to learn how to build these payloads, these
three commits should provide a healthy primer. Small changes to
the payload structure can yield entropy enough to avoid signature
based detection by in-line or out-of-band static defenses. This
payload was completed in the time between this commit and the last.
Testing:
Win2k8r2
ToDo:
Update payload sizes when this branch is "complete"
Ensure UUIDs and adjacent black magic all work properly
2016-05-23 14:27:11 -05:00
0e69040a6a
Implement reverse_tcp_dns as metasm payload
...
Using the separation of block_recv and reverse_tcp, implement
reverse_tcp_dns using original shellcode as template with dynamic
injection of parameters. Concatenate the whole thing in the
generation call chain, and compile the resulting shellcode for
delivery.
Metasploit module pruned to bare minimum, with the LHOST OptString
moved into the library component.
Testing:
Win2k8r2
ToDo:
Update payload sizes when this branch is "complete"
Ensure UUIDs and adjacent black magic all work properly
Misc:
Clean up rc4.rb to use the rc4_keys method when generating a
stage. Makes the implementation far more readable and reduces
redundant code.
2016-05-23 14:27:11 -05:00
df2346d9e0
Implement RC4 metasm payloads for tcp bind and rev
...
Convert reverse_tcp_rc4 and bind_tcp_rc4 from static shellcode
substitution payloads to metasm compiled assembly approach.
Splits up metasm methods for bind_tcp and reverse_tcp into socket
creation and block_recv to allow for reuse of the socket methods
with the RC4 payloads, while substituting the block_recv methods
for those carrying the appropriate decryptor stubs.
Creates a new rc4 module carrying the bulk of the decryptor and
adjacent convenince methods for standard payload generation.
Testing:
Tested against Win2k8r2, Win7x64, and WinXPx86
ToDo:
Ensure all the methods around payload sizing, UUIDs, and other
new functionality, the semantics of which i do not yet fully
understand, are appropriate and do not introduce breakage.
2016-05-23 14:27:11 -05:00
a71e853c2a
Fixed cache size for python/shell_reverse_tcp_ssl
2016-05-20 02:32:37 +00:00
87398d5195
Fixed python reverse shell ssl send for EOF occurred in violation of protocol error
2016-05-20 01:49:04 +00:00
8ce0365c7f
See rapid7/metasploit-payloads#98 , update cached payload sizes
2016-05-13 23:05:34 -05:00
74e5772bbf
Replace mknod with mkfifo for portability
...
Works on BSD and OS X now. This has been bugging me for a while.
2016-05-04 02:32:37 -05:00
2a91a876ff
Update php/meterpreter_reverse_tcp size
2016-04-27 16:14:38 -05:00
9a873a7eb5
more style fixes
2016-04-23 12:18:28 -04:00
d86174c3bf
style fixes
2016-04-23 12:18:28 -04:00
4250725b13
fix incorrect hex port conversion
2016-04-23 12:18:28 -04:00
7ff5a5fd7e
switch mainframe payloads to fixed size
2016-04-23 11:40:05 -04:00
c596421b01
use generate_uri_uuid_mode for java reverse_http
2016-04-18 08:26:02 -05:00
edd30e433e
https tweaks
2016-04-18 08:26:02 -05:00
555352b210
Force lurl string duplication to avoid stageless issues
...
I have NO idea why this is even a problem. Mutating state is the spawn of satan.
2016-04-18 08:25:19 -05:00
a74a7dde55
More fixies for LURI in Python, and native too
2016-04-18 08:25:19 -05:00
06d53112e3
Add support for LURI to the java and android payloads
2016-04-18 08:24:41 -05:00
b95267997d
Fix LURI support for stageless, transport add/change and code tidies
2016-04-18 08:24:41 -05:00
6ce7055130
Land #6737 , Added reverse shell JCL payload for z/OS
2016-04-13 22:19:15 -05:00
6a4d7e3b58
Revshell cmd JCL payload for z/OS
...
Added a JCL-based reverse shell. Uses the same source code as the
shellcode version does. Source code is in
external/source/shellcode/mainframe/shell_reverse_tcp.s
2016-03-31 20:42:42 -05:00
a6518b5273
Add generic JCL cmd payload for z/OS (mainframe)
...
This payload does nothing but return successfully. It can be used to
test exploits and as a basis for other JCL cmd payloads.
2016-03-28 21:01:39 -05:00
1375600780
Land #6644 , datastore validation on assignment
2016-03-17 11:16:12 -05:00
3123175ac7
use MetasploitModule as a class name
2016-03-08 14:02:44 +01:00
8faae94338
Land #6592 , make linux/x86/shell_reverse_tcp's shell path configurable and remove shell_reverse_tcp2
2016-03-06 15:33:53 -06:00
c7c0e12bb3
remove various module hacks for the datastore defaults not preserving types
2016-03-05 23:11:39 -06:00
d355b0e8b7
update payload sizes
2016-03-02 13:55:32 -06:00
c8b28d90d1
Fix old comment.
2016-02-19 19:08:38 -06:00
b3e8cd4f51
Save some bytes on the padded string.
2016-02-18 20:36:52 -06:00
2b784a48b9
Include cached size.
2016-02-18 20:29:42 -06:00
e67e477362
Make x86/shell_reverse_tcp's shell path configurable.
...
Also removes shell_reverse_tcp2 shell.
2016-02-18 20:24:35 -06:00
ff1cb4a2a4
update payload sizes
2016-02-10 22:44:17 -06:00
a3cafc3bae
Update PHP meterpreter size
2016-01-22 15:14:18 -06:00
28cf943bcb
Fix a couple of missing requires in payloads.
...
This pops up occasionally. This fixes a couple of anecdotal reports of missing
requires that cause the loader to fail, depending on the directory sort order.
It also fixes the problem as reported in #6460
2016-01-14 13:17:26 -06:00
6eda702b25
Land #6292 , add reverse_tcp command shell for Z/OS (MVS)
2015-12-23 14:11:37 -06:00
14b1b3a1f0
Land #6299 , Stageless HTTP(S) Python Meterpreter
2015-12-04 16:16:54 -06:00
644c1347cd
Update payload sizes
2015-12-04 16:14:37 -06:00
bb3a3ae8eb
Land #6176 , @ganzm's fix for 64 bits windows loadlibrary payload
2015-12-01 13:18:41 -06:00
3b3b569d8e
Fix payload CacheSize for current pymet
2015-12-01 13:00:15 -05:00
bfe81db9a5
Update cached size
2015-12-01 11:45:45 -06:00
2348cb7374
Update loadlibrary for 64 bits
2015-12-01 11:41:37 -06:00
fba9715a56
Add stageless python meterpreter http & https payloads
2015-11-28 17:41:55 -05:00
d2bfc4d8e0
Added reverse shell payload for Mainframe
...
This is the first and probably most useful shellcode for mainframe
platform. Standard reverse shell works just like any other platform
reverse shell.
2015-11-26 17:07:03 -06:00
1b495e73ac
Further reduce python reverse_http duplicate code
2015-11-26 14:31:00 -05:00
bd25ffa48c
Consolidate py reverse http uri code into a mixin
2015-11-26 13:32:50 -05:00
a7a89adfac
Land #6264 , meterpreter per-extension init string support, update payloads to 1.0.17
...
This brings in the following changes:
Changes to support maven 3.3+
Don't fall back to 0.0.0.0
Remove all debug builds from the Windows projects
Add show_mount, ps_list, and some core tweaks
Refactor TLV layout, add more debug output, token stealing
Add incognito binding, code tidies
Update packaged libs
Add transport list binding
Add transport add command to python binding
Update python core lib archive
change source perms back to non-executable
First pass of stageless initialisation script
Finalise stageless initialisation scripts
add BOOT_COMPLETED receiver that starts the Payload
Improve the implementation of the getuid command
Switch to Utils.runCommand per timwr's suggestion
Updated init script method
also bumps msgpack 0.7.1, which fixes a failure packing messages > 256k
2015-11-25 22:27:27 -06:00
78e306e281
s/Initialision/Initialization/
2015-11-25 22:07:25 -06:00
d984e5c781
update payload sizes
2015-11-25 22:04:52 -06:00
8703987535
Add HTTPS and new transport support for hop
2015-11-11 21:25:23 -06:00
0afc5be3bc
Finalise set up of stageless init
2015-11-10 20:01:23 +10:00
a28ab216d3
Adding stageless init script support
2015-11-10 19:18:47 +10:00
6458c591e4
Update loadlibrary.rb
2015-11-02 17:16:46 +01:00
a01d7c966a
Bugfix loading address of library path into rcx
...
Changed the following instruction:
67 48 8D 8D 00 01 00 00 lea rcx,[ebp+100h]
Into
90 nop
48 8D 8D 00 01 00 00 lea rcx,[rbp+100h]
The old code breaks if the payload is executed from a memory area where the 4 most significant bytes are non-zero.
The bugfix removes the Address-Size override prefix 0x67 of the lea instruction and replaces it with a nop 0x90 (to not mess up code alignment,relative addressing or jmps).
2015-11-02 12:54:44 +01:00
ec1682ebd9
update payload size cache
2015-10-30 17:35:05 -05:00
b4a8f80493
Update the cached size for the current met file
2015-10-22 08:54:14 -04:00
23d9efb5a3
Add stageless Python Meterpreter for bind tcp
2015-10-21 18:37:37 -04:00
8bb694fa5c
Add stageless Python Meterpreter for reverse tcp
2015-10-21 18:23:04 -04:00
c35e99664e
Land #6003 , @earthquake's x86-64 pushq signedness error fixed
2015-10-01 11:52:28 -05:00
aa01383361
Fix comment
2015-10-01 11:51:45 -05:00
195418b262
Update the sin_family on bind_tcp_small
2015-10-01 11:22:59 -05:00
77ce7ef5f0
Save 3 more bytes on shell_bind_ipv6_tcp
2015-10-01 09:45:02 -05:00
4efb3bf26c
Save 3 more bytes on shell_bind_tcp_small
2015-10-01 09:42:35 -05:00
04879ed752
Save two bytes on shell_bind_ipv6_tcp
2015-10-01 09:33:22 -05:00
88eecca4b1
Save two bytes on shell_bind_tcp_small
2015-10-01 09:29:39 -05:00
b608abffbc
Update payload cache sizes for x64 windows
2015-09-29 09:03:57 +10:00
46ed129966
update to metasploit-payloads 1.0.14
2015-09-26 10:50:20 -04:00
a863409734
x86-64 pushq signedness error fixed. Signed port numbers (2bytes) were not working properly. Fix means +6bytes in shellcode length
2015-09-24 13:07:02 +02:00
d2a17074b1
update payload sizes
2015-09-16 17:24:41 -05:00
1440f31756
Land #5637 , resiliency improvements to TCP stagers
2015-09-02 22:50:12 -05:00
3fd9e0311c
Update payload sizes
2015-09-03 12:01:11 +10:00
56a1cfd9c8
updated cached payload sizes
2015-09-01 18:02:16 -05:00
a8dd89cc0d
update cached payload sizes
2015-08-27 11:43:38 -05:00
593f501571
finish move of php / python meterpreters to metasploit-payloads
2015-08-27 11:34:22 -05:00
ca8353e1aa
update to metasploit-payloads 1.0.9
2015-08-25 17:44:01 -05:00
6b1e911041
Instantiate payload modules so parameter validation occurs
...
Calling .new on payload modules does not perform parameter validation, leading
to a number cached sizes based on invalid parameters. Most notably,
normalization does not occur either, which makes all OptBool params default to
true.
2015-08-14 11:35:39 -05:00
347f48b0ec
Land #5762 , adjust PHP stager to work in and outside of eval()
2015-07-24 17:43:26 -05:00
c30127cfe8
Land #5729 , add user-agent list, MeterpreterUserAgent derives from this
...
Later PRs will convert modules to use this. A random user agent might be nice
for meterpreter actually.
2015-07-24 17:39:30 -05:00
728e9b19ec
Update payload cached sizes
2015-07-23 15:15:13 +10:00
121fe1adda
Land #5654 : Python Meterpreter Transport
2015-07-22 10:39:06 +10:00
b6e25506d0
Add a common user agent list, use the shortest for Meterpreter
2015-07-15 13:03:47 +10:00
a2bdd0bab9
Land #5541 , add more compat fixed-cmd 64-bit BSD payloads
...
Merge branch 'land-5541-bsd-shellcode' into upstream-master
2015-07-13 21:01:55 -05:00
226137896e
updated cached payload sizes
2015-07-10 22:30:20 -05:00
c86d16ffb6
update payload sizes
2015-07-07 23:15:57 -05:00
23abc288c8
Resolved conflicts with master
2015-07-07 22:34:30 -05:00
e16cd08599
Update the payload CachedSize
2015-07-06 17:16:56 -04:00
2a89e248d7
Pymet fix send uuid logic for Python 3.x
2015-07-06 11:20:34 -04:00
29d45e3b18
Pymet patch in timeout info on generate_stage
2015-07-03 14:12:29 -04:00
d6261a54b1
Land #5608 , part 2, update payload cache sizes
2015-07-01 00:31:40 -05:00
6711091c70
update cached payload sizes
2015-07-01 00:31:09 -05:00
e99d63687f
Land #5608 , android and java meterpreter transport and sleep support
...
This also includes stageless Windows meterpreter fixes for process migration.
2015-07-01 00:23:36 -05:00
a44c31052b
reverse_tcp x64 stager reliability fixes
...
Also includes a slight tweak to x86
2015-07-01 12:43:41 +10:00
bb43f7e30f
use the correct transport for x64/meterpreter_reverse_https
2015-06-27 10:50:54 -05:00
007da4af41
Force :init_connect for stageless
2015-06-27 18:21:15 +10:00
a773979992
Java config wiring, tweak to include block counts
...
This commit adjusts the way that the config block is set for java and
android because behind the scenes the stageless connect-backs need to
know what to discard. as a result of connecting back to staged listeners
we need to be able to discard a number of bytes/blocks before we can
continue process (at least in the case of TCP).
2015-06-26 13:59:09 +10:00
0493ba83a0
Add transport configuration support
2015-06-24 21:26:47 +10:00
e796e56c6c
Modify the staging process
2015-06-24 13:22:33 +10:00
8ade66027a
update cached payload sizes
2015-06-22 17:19:02 -05:00
a99b001bd7
payloads_spec.rb modified, payloads added
2015-06-16 05:33:30 -04:00
5a6a16c4ec
Resolve #4326 , remove msfpayload & msfencode. Use msfvenom instead!
...
msfpayload and msfencode are no longer in metasploit. Please use
msfvenom instead.
Resolves #4326
2015-06-08 11:30:04 -05:00
1f11cd5470
Lands #5446 , support for 64-bit native powershell payloads
2015-06-07 14:16:19 -05:00
dddbf3886b
Updated payload spec to be in the correct order and updated payload cached size
2015-06-02 18:33:06 +01:00
ac2a52b522
fix android/java reverse_tcp
2015-06-02 10:54:49 +01:00
449ce32f07
update for new UUID namespace
2015-06-01 15:16:04 -05:00
9d1a7cead4
New modules to support 64bit process powershell.
2015-06-01 16:11:23 +01:00
64e86165ef
remove android meterpreter bins, update to payloads 1.0.2
...
This switches us to using the Android payload files from the
metasploit-payloads gem
2015-06-01 09:14:31 -05:00
70ef1b83f9
Merge branch 'master' into land-5366-android
2015-06-01 09:07:55 -05:00
3dd3ef5edb
Merge branch 'upstrea/master' into winhttp-ie-proxy
2015-05-30 08:03:43 +10:00
b8a8e65c2c
Merge branch 'master' into land-5394-uuid-tracker
2015-05-29 16:22:45 -05:00
307dcd09dd
Update payload cache sizes again
2015-05-25 20:12:20 +10:00
7f59a7482e
Update authors and stuff
2015-05-25 12:02:52 +10:00
e103b2365a
Update payload sizes and add new payloads to spec
2015-05-25 11:31:15 +10:00
9042f141ff
Implement the IPv6 UUID bind stagers
2015-05-25 11:21:28 +10:00
c17ee64d81
Merge branch 'master' into feature/uuid-registration
2015-05-22 00:29:16 -05:00
1c73c190fc
Add machine_id support to windows php meterp
2015-05-22 14:55:29 +10:00
7a9e875a25
use uuid aware generate_uri_uuid_mode
2015-05-22 05:21:08 +01:00
5963a5833a
Fix up php stageless payload includes
2015-05-20 16:50:00 +10:00
96a30118e2
add https cert validation
2015-05-20 07:27:59 +01:00
d0a5b803e8
Use generate_payload_uuid instead of manual obj creation
2015-05-20 16:25:52 +10:00
289873c25f
Merge all the stager changes
2015-05-20 16:02:37 +10:00
6859b24c1c
Fix missing label, update payload sizes
2015-05-20 15:42:31 +10:00
ebd20fbedd
fix http
2015-05-19 16:25:46 +01:00
e7c8a3b56c
add support for SessionRetryTotal and SessionRetryWait on Android
2015-05-19 16:16:04 +01:00
9fddc21cf3
Shaved another sneaky byte off the payload
2015-05-19 21:21:07 +10:00
6e96e6d118
Shellcode golf to make the payload smaller
...
Tried to implement some more of the stuff that egypt suggested, managed
to get some in, but not others. Ultimately, its smaller than it was, and
I'm sure there are ways to make it better as well.
2015-05-19 21:17:42 +10:00
62720ab357
Fix the wininet stager for http/s
...
For some reason this was only working on Windows7/2008, yet when tired
on Windows 2012 it was resulting in crashes. It was also stopping
working in exploits such as psexec_psh.
Went back to the beginning and started again. With this in place, we can
now do a bit of shellcode golf to make it a bit smaller.
Adjusted payload sizes as well.
2015-05-19 20:03:22 +10:00
c7932855f2
Move UUIDOptions to UUID::Options
2015-05-18 23:35:18 -05:00
4a5f92072e
Make msftidy happy
2015-05-18 22:00:51 +10:00
923c4274d3
Formatting fixes
2015-05-18 21:52:33 +10:00
28abceaec5
Update payload sizes and specs
2015-05-18 21:22:54 +10:00
e7f80042d4
Finalise work on the bind_ipv6_tcp stager for UUID support
2015-05-18 21:19:04 +10:00
6c00e62649
Small fix to PHP stage
2015-05-18 19:11:33 +10:00
e2d4ed6045
Add the UUID payloads for PHP
2015-05-18 17:49:34 +10:00
9296a024e2
PHP meterpreter refactoring in prep for uuid work
2015-05-18 17:40:48 +10:00
e41ae93524
Payload sizes, specs and more
2015-05-18 14:58:10 +10:00
4488a5e634
Add uuid support to python, and rework stages/stagers
2015-05-18 14:33:35 +10:00
0d56b3ee66
Stage UUIDs, generation options, php and python meterp uuid
2015-05-18 13:29:46 +10:00
bf2b113abb
Merge branch 'upstream/master' into update-x64-stagers
2015-05-18 13:28:36 +10:00
d804f5fe49
update to metasploit-payloads 0.0.7
2015-05-17 10:06:38 -05:00
829f8420e2
Update static payload sizes for metasploit-payloads-0.0.6
2015-05-15 18:43:47 -05:00
7b2aee2a60
Merge branch 'upstream/master' into update-x64-stagers
2015-05-15 12:27:40 +10:00
83fbd41970
Merge branch 'upstream/master' into multi-transport-support
...
Conflicts:
Gemfile.lock
modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb
2015-05-14 14:50:25 +10:00
36aa136091
missing require
2015-05-13 17:36:45 +01:00
1f294eac0b
Updated to remove dup code
2015-05-13 17:26:21 +01:00
e9e3d9c1e4
Update payloads gem, and updated payload sizes
2015-05-13 15:37:09 +10:00
7148e45bfc
Fix incorrect reference to data path for linux meterpreter stage
2015-05-13 14:21:22 +10:00
237827bfdc
Fix up payload cached sizes again
...
This time it's against the currently "installed" version of Meterpeter
binaries. When Meterpreter is landed down the track we'll need to make
sure that the payload sizes are updated again.
2015-05-12 12:44:34 +10:00
836feaa2d8
Fix uuid setting, fix reverse_https x64 payload
...
The payload changes in this PR will be fixed up/removed in the
update-x64-stagers PR.
2015-05-12 10:24:11 +10:00
51e6c13bc4
Adjust transport configuration include for x64/reverse_http
...
Not sure how I missed this, but I did!
2015-05-12 09:54:08 +10:00
474461d2a4
Merge format and structure changes from multi transport
2015-05-12 09:46:02 +10:00
69d2b8ffb1
Various code format, style changes, file moves
...
As per Egypt's suggestions.
2015-05-12 09:43:41 +10:00
0dbfc1e02b
Merge the stager size work from mult-transport-support
2015-05-12 07:50:56 +10:00
fe51f552b8
Make stageless, and reverse_tcp x64 non-dynamic
2015-05-12 07:37:12 +10:00
6fdf23ad98
Update payload sizes again
2015-05-11 22:33:45 +10:00
a97f24a12d
Update payload cached sizes
2015-05-11 10:00:14 +01:00
d9068b7719
Fix up payload cache sizes, and powershell include
2015-05-11 17:43:51 +10:00
e69e6c4a73
Implement winhttp for x64
...
Still has some quirks to fix up, but we're getting there. Everything
seems to work except for reverse_winhttps. I can't see why at this
point.
2015-05-11 17:27:47 +10:00
800ab11abd
Payload size adjustment, typo fix
...
Woot, this somehow reduces the payload sizes by 2 bytes... woot.. or
something.
2015-05-11 17:24:32 +10:00
21397b46aa
Add proxy user/pass to x64 reverse_http/s
2015-05-11 17:24:31 +10:00
b922da8f80
Add support for x64 reverse_http
...
Still need to bake in support for proxies in the stagers, but wer'e
getting there.
2015-05-11 17:24:31 +10:00
15e9fb7e40
Port reverse_https (wininet) x64 to metasm
...
This laid the groundwork for implementation of reverse_http as well.
2015-05-11 17:24:31 +10:00
c0388a770e
Update cached sizes
2015-05-10 22:01:30 +01:00
c916021fc5
SSL Support for Powershell Payloads
2015-05-10 21:45:59 +01:00
fd827db6dd
Fix up bind stager payload sizes
2015-05-07 10:13:27 +10:00
9d7a7cb68d
Merge branch 'upstream/master' into multi-transport-support
...
Conflicts:
lib/msf/core/payload/linux/bind_tcp.rb
2015-05-07 07:24:22 +10:00
0493f58834
Reenable metasm bind_tcp stager
2015-05-06 09:34:35 -05:00
3c2e6bb698
rollback linux bind_tcp stager metasm port
...
The new metasm port of the linux bind_tcp stager doesn't yet generate valid
executables. While we're debugging the problem, this reverts the bind_tcp.rb
stager to use the static ASM again.
2015-05-06 09:26:04 -05:00
a0c806c213
Update java meterpreter and payload references to use metasploit-payloads
2015-05-05 15:01:00 -05:00
232117117b
Fix missing includes
...
The powershell one broke thanks to include hierarchy changes. The others
failed in the specs only for some reason.
2015-05-05 14:24:21 +10:00
146f41992f
Fix up payload sizes
2015-05-05 13:52:20 +10:00
852961f059
Tweaking of transport behaviour, removal of patch
2015-05-05 11:45:22 +10:00
cf62d1fd7c
Remove patch and old stageless stuff
2015-05-05 09:27:01 +10:00
b42f4f5cd2
Merge branch 'upstream/master' into multi-transport-support
...
Conflicts:
lib/msf/core/payload/windows/stageless_meterpreter.rb
lib/msf/core/payload/windows/x64/stageless_meterpreter.rb
lib/rex/post/meterpreter/client_core.rb
modules/payloads/stages/linux/x86/meterpreter.rb
modules/payloads/stages/windows/meterpreter.rb
modules/payloads/stages/windows/x64/meterpreter.rb
2015-05-05 07:53:54 +10:00
05e4af8162
Land #5214 , initial meterpreter session recovery support
2015-05-04 16:25:27 -05:00
e6ea5511ca
update linux and windows meterpreters to use metasploit-payloads
2015-05-04 09:44:36 -05:00
c2dc4677fb
Prevent stagless from overwriting socket
...
Stageless payloads need to have the socket FD left along (ie. 0)
otherwise each of them will think that the socket is already open.
Instead we need to make sure it's left as 0 as per the configuration and
from there the stageless code will fire up a new socket based on the
transport in question.
2015-05-04 22:36:59 +10:00
e835f2b99c
Rejig transport config into module
...
Adjust a few other things along the way, including tidying of code,
removing of dead stuff.
2015-05-04 22:04:34 +10:00
93bf995b32
Reverse tcp support for POSIX
...
Ported the stager and wired in the new work to make the configuration
function.
2015-05-04 20:11:26 +10:00
9300158c9a
Initial rework of POSIX stuff to handle new configuration
2015-05-04 18:58:55 +10:00
0b580acfb4
\t removed
2015-05-02 21:16:50 +02:00
a0539cd672
new x64 bsd shellcodes (bind/reverse) ipv4/6. ipv4 shells are smaller than
...
the existing one.
2015-05-02 20:52:09 +02:00
6058dee99a
explicitly require bind_tcp/reverse_tcp modules
...
This transient error was noted in the release documentation builder.
metasploit-framework/modules/payloads/singles/windows/powershell_bind_tcp.rb:37:in
`initialize': uninitialized constant Msf::Handler::BindTcp (NameError)
2015-04-27 20:57:31 -05:00
1fd601510c
Lands #5194 , merges in PowerShell session support & initial payloads
2015-04-26 16:01:51 -05:00
f56eac7f10
Cosmetic cleanup and binary mode read for powershell script
2015-04-26 15:57:51 -05:00
82fe480c2e
Update session to display username and hostname
2015-04-26 21:47:49 +01:00
f2c745d2a7
update cached sizes
2015-04-26 20:24:41 +01:00
d19406c593
Update the payload cache size
2015-04-26 18:56:32 +01:00
1cc167a7fb
Inserted ARCH_X86 payloads, removed interactive_powershell and updated base powershell session
2015-04-26 18:50:42 +01:00
4cb1a6c255
Updated payload cached size
2015-04-26 09:30:41 +01:00
e6c61c461e
Updated payloads and fixed msftidy.
2015-04-26 09:20:29 +01:00
6da8a14f62
Initial work on x64 payloads for new config
2015-04-26 13:41:31 +10:00
6ac3ecfa7c
Refactor, add reverse_winhttps support
...
Getting closer to a normalised view of what this stuff will look like.
There URL patching is slowly being removed. Reverse HTTPS works fine,
and by default HTTP should too.
Next up, x64 for the same main ones.
2015-04-26 12:11:14 +10:00
2455163d24
Refactor configuration for meterpreter payloads (x86)
...
RDI is now back to what it was before, as this leaves all the other RDI
style payloads alone. Instead we have a new Meterpreter loader which
does the stuff that is required to make meterpreter work well with the
new configuration options.
This is just the case for reverse_tcp and bind_tcp so far, need to do
the other payloads too, along with all the x64 versions.
2015-04-26 09:57:30 +10:00
ded904c72c
New payloads
2015-04-26 00:16:59 +01:00
a02ea90824
New payloads which work with cmd
2015-04-25 16:49:22 +01:00
7afb6e1aa6
Removed stand-alone payloads and will push these as a seperate fork request.
2015-04-25 07:57:43 +01:00
6be2c0beab
Dynamic
2015-04-25 07:49:34 +01:00
2273fb541a
payload cached_sizes
2015-04-25 07:33:51 +01:00
215e67bcbd
Updated comments
2015-04-25 07:02:25 +01:00
941a4ee572
updated cached size using tools/update_payload_cached_sizes.rb
2015-04-24 19:13:54 +01:00
00d8958cc8
New payloads for reverse_tcp for powershell
2015-04-24 10:25:37 +01:00
9e137c6403
ref
2015-04-23 23:28:33 +01:00
468166408e
ref
2015-04-23 23:28:21 +01:00
3711b2579c
new powershell session
2015-04-23 23:13:12 +01:00
0f7442dec2
new powershell session
2015-04-23 23:12:58 +01:00
b642ddb989
interact powershell session
2015-04-23 23:12:38 +01:00
b6abd9dc8e
updates to rex
2015-04-23 22:14:11 +01:00
a3710752c6
updates to rex
2015-04-23 22:14:00 +01:00
3e693c95df
update bind_tcp settings
2015-04-23 14:43:08 +01:00
19a6ae68ff
Update bind_tcp sizes to dynamic
...
This is required due to the fact that we can now turn on/off the
closing of the listen socket.
2015-04-23 09:53:18 +10:00
99156f1247
reverse payload
2015-04-22 20:41:45 +01:00
4ae3c5925d
bind payload
2015-04-22 20:41:35 +01:00
86957d9b07
Merge branch 'upstream/master' into connection-recovery
2015-04-21 20:01:59 +10:00
3fbd4e2fe6
Land #5172 , x64 BSD shell_{bind,reverse}_tcp
2015-04-20 15:37:29 -05:00
b0d50dc2be
Create our own Rex connection to the endpoint
...
Ensure powershell process closes when module completes
Add a windows cmd interact payload
2015-04-19 23:41:28 +01:00
19f8a76475
Porting bind_tcp for posix to metasm
...
And supporting SO_REUSEADDR and stageless meterp
2015-04-18 19:19:40 +10:00
97912882ca
Adjustments for POSIX meterpreter patching
2015-04-17 19:53:05 +10:00
0a8b29dd86
Merge branch 'upstream/master' into connection-recovery
...
Conflicts:
lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb
2015-04-17 14:40:21 +10:00
9b6aea12e1
Oops, missed a comma.
2015-04-15 19:26:53 -05:00
4a18714191
Update authors and license to original osx x86 module.
2015-04-15 14:34:26 -05:00
a01d98d1f5
Implement shell_bind and shell_reverse payloads for bsd x64.
2015-04-15 14:33:27 -05:00
0d19b5d4c3
Fix require order issue.
2015-04-14 23:23:02 -05:00
e56590e1e3
DRY up common code between BSD / OSX.
2015-04-14 23:08:57 -05:00
e114c85044
Land #5127 , x64 OS X prepend stubs 'n' stuff
2015-04-14 01:25:39 -05:00
2d3614f647
Implement x64 BSD exec and exe template.
...
- Fixes bug in CachedSize due to all options being set
- Adds new payload to payload_spec.
2015-04-12 12:17:25 -05:00
ceadd1e6ec
Update osx x86 payload cached sizes to be accurate.
...
- Right now there is a bug in the payload_spec, which causes the payload's
datastore during the spec run to have things like 'PrependSetuid' => 'false',
where 'false' is a string, which means 'if (datastore['PrependSetuid'])'
branch will be taken, resulting in incorrect behavior.
2015-04-12 00:21:18 -05:00
91202e2447
Port of reverse_tcp payload to metasm
2015-04-10 17:46:27 +10:00
fadb13b8ef
Porting block api, exitfunk, bind to metasm
...
Also add the flag which lets the bind stager leave the listen socket
open.
2015-04-10 16:23:03 +10:00
809409d8c4
Lots of changes to support moving timeouts to common spots
...
Session expiry, comms timeout, retry total/wait are all now part of all
of the meterpreter payloads as these are going to be used for
maintaining access with resiliency and will aim for consistency across
the payload types.
2015-04-09 17:57:43 +10:00
bc5fd4b813
A few adjustments to make bind_tcp keep listen sockets open
2015-04-09 08:46:35 +10:00
e7a4ee637a
Port windows reverse_tcp|bind_tcp to Metasm, add error handling
...
Conflicts:
lib/msf/core/payload/windows/bind_tcp.rb
modules/payloads/stagers/windows/bind_tcp.rb
Cherry-picked form @hmoore-r7's repo.
2015-04-08 16:21:10 +10:00
9ebcb27929
Merge branch 'upstream/master' into connection-recovery
2015-04-08 15:48:21 +10:00
a9804dff62
Initial work to support fault-tolerant connectivity
...
This code adjusts the bind_tcp stager for x86 so that the listener
socket isn't close for meterpreter payloads. This means that meterpreter
can make an educated guess as to whether or not the payload was a bind
or tcp payload, and from there can attempt to establish communications
in the same way as before should something break along the way.
Some simple adjustments to the x64 meterpreter stage as well, but more
to come here.
2015-04-08 14:41:32 +10:00
9fd40870d0
Update http(s) generator functions
...
Methods now require a hash. I went with the hash because 1) that's what
we seem to use everywhere else, and 2) I couldn't get the new keyword
arguments working nicely with the block syntax (I'm clearly stupid).
2015-04-08 07:56:54 +10:00
8f58e08c13
Add support for stageless reverse_http payloads
...
This includes both x64 and x86.
2015-04-07 11:01:24 +10:00
78c73cc2a3
Update cached sizes with the new uri defaults
2015-04-05 22:11:12 -05:00
c9696d3f6c
Merge in stageless/transport work, deconflict
2015-04-04 11:52:26 -07:00
fd043d4842
Fix up build and missing uri_checksum stuff
...
Somehow this made it into a merge when it shouldn't have. This fix moves
the URI checksum module to where it needs to be and updates all the
references where required. This will result in a class with the dynamic
transport branch, but I can fix that after.
2015-04-03 13:42:25 +10:00
34ff94e0da
Fix the proxy user/pass options
2015-03-31 15:49:43 -05:00
a39ba05383
Functional Payload UUID embedding via PayloadUUIDSeed
2015-03-31 15:44:18 -05:00
253e5d7dff
Include correct module, remove specified encoder type
2015-03-31 07:23:51 +10:00
c28cc66398
Add x64 bind_tcp and reverse_ipv6_tcp
...
Also fix up a couple of modules to use Metasploit4 instead of
Metasploit3.
2015-03-30 18:59:30 +10:00
26792975eb
Refactor of code to reduce duplication
...
Add mixin for the stageless http preparation
2015-03-30 13:18:56 +10:00
f8851551c5
Add initial x64 stageless meterrpeter module
2015-03-30 11:23:51 +10:00
ce8f6d72e1
More work on x64 stageless
...
Testing with HD's new changes that allow for generation of larger x64
payloads
2015-03-30 09:51:04 +10:00
17dc2b184d
Merging upstream/master
2015-03-30 09:12:20 +10:00
e0568e95c2
Land #4978 @zerosteiner adds reverse https for python meterpreter
2015-03-26 19:16:46 -05:00
10e8cefd6d
Pymet dont validate ssl certs for 2.7.9/3.4.3
2015-03-25 19:49:42 -04:00
24d74b26e3
Beginning work for stageless x64 meterpreter
2015-03-24 06:50:06 +10:00
9c9d333a1b
Create verify ssl mixin, adjust some formatting
2015-03-23 13:21:08 +10:00
a407bc8d65
Fix the reverse_https stager CachedSize for the spec
2015-03-21 13:05:44 -04:00
7282968d8a
Python reverse HTTPS stager
2015-03-21 12:43:14 -04:00
fd4ad9bd2e
Rework changes on top of HD's PR
...
This commit removes duplication, tidies up a couple of things and puts
some common code into the x509 module.
2015-03-20 13:06:57 +10:00
7b4161bdb4
Update code to handle cert validation properly
...
This code contains duplication from HD's PR. Once his has been landed
this code can be fixed up a bit so that duplication is removed.
2015-03-20 12:52:47 +10:00
7899881416
Update POSIX bins from master
2015-03-19 14:50:14 +10:00
346b1d539f
Revert Java back to static size for cache purposes (less cpu usage on startup)
2015-03-18 16:24:01 -05:00
33bbf7cb7e
Dynamic URI generation for python/java http(s) stagers
2015-03-18 16:08:11 -05:00
7ae97393e0
fix x64/reverse_https stager shellcode
2015-03-18 15:34:31 -04:00
b62da42927
Merge branch 'master' into feature/add-proxies-to-wininet
2015-03-18 01:51:15 -05:00
ef443c83b9
Fix overgreed search/replace
2015-03-18 01:21:53 -05:00
f7a06d8e44
Rework PROXY_{HOST|PORT|TYPE|USERNAME|PASSWORD) to the new syntax
2015-03-18 01:15:32 -05:00
87a489907c
Place an IPv6 proxy IP between brackets
2015-03-18 01:01:16 -05:00
259db269bd
Remove user/pass and invalid class from the options
2015-03-18 01:01:16 -05:00
2ab14e7e79
Adds IPv6 and option-related issues with the previous patch
2015-03-18 01:01:10 -05:00
0601946830
Don't mandate and default PROXY_HOST (miscopy from the proxy stager)
2015-03-18 01:00:04 -05:00
85fb534e63
Fix up the offset detection again, cleanup redundant code
2015-03-18 00:59:25 -05:00
2f13988d7b
Use OptPort vs OptInt and cleanup the description
2015-03-18 00:59:25 -05:00
a01be365b0
Rework PROXYHOST/PROXYPORT to PROXY_HOST/PROXY_PORT
...
This also cleans up the windows reverse_https_proxy stager.
2015-03-18 00:59:13 -05:00
abb8a32e68
update spec for dynamic meterpreter payloads
2015-03-16 18:08:13 -05:00
7e89281485
Adds proxy (with authentication) support to reverse_http(s)
2015-03-16 00:03:31 -05:00
b68e05e536
Land #4914 , @hmoore-r7 and @BorjaMerino winhttp stagers
2015-03-13 08:24:11 -05:00
35cfdf051a
Add support for meterpreter_reverse_ipv6_tcp
...
New payload added, makes use of existing functionality.
2015-03-13 20:15:31 +10:00
744b1a680e
Reworks how payload prepends work internally, see #1674
2015-03-12 02:30:06 -05:00
345b5cc8e1
Add stageless meterpreter support
...
This commit adds plumbing which allows for the creation of stageless
meterpreter payloads that include extensions. The included transprots at
this point are bind_tcp, reverse_tcp and reverse_https, all x86.
More coming for x64. Will also validate http soon.
2015-03-12 13:22:04 +10:00
c3f2536ef6
Make the stager clear in the payload descriptions
2015-03-11 21:30:02 -05:00
b105a88b95
Fix https convention
2015-03-11 21:26:31 -05:00
8bae58d631
Updated cache sizes
2015-03-11 21:25:12 -05:00
1135e5e073
First take on WinHTTP stagers, untested
2015-03-11 16:27:14 -05:00
7e3b4017f0
Rename and resynced with master, ready for refactoring
2015-03-11 14:36:27 -05:00
ea1bc69e2e
Merge branch 'master' into feature/add-reverse_winhttp-stagers
2015-03-11 14:29:34 -05:00
ceeee4446f
Land #4904 , @hmoore-r7 reworks reverse_http/s stagers
...
They are now assembled dynamically and support more flexible options,
such as long URLs.
2015-03-11 10:41:59 -05:00
ad39adf9c2
Missing comma
2015-03-11 00:49:07 -05:00
a89926b663
Exclude vncinject from http stagers (depends on sockedi)
2015-03-11 00:46:04 -05:00
9ade107325
disable reverse_http methods from upexec and shell payloads
...
These don't work over http and don't appear to have ever, as far back as
I could test. They appear to be an accident perhaps.
2015-03-10 17:08:58 -05:00
db351317a5
Merge with PR branch
2015-03-10 14:08:35 -05:00
0f763c2cb3
First step to reworking the winhttp stagers
2015-03-10 14:07:25 -05:00
991e72a4fa
HTTP stager based on WinHttp
2015-03-10 13:40:16 -05:00
966848127a
Refactor x86 Windows reverse_http and reverse_https stagers
2015-03-10 12:48:30 -05:00
618fbf075a
Update CachedSize for the fixed stager
2015-03-09 16:57:14 -05:00
746f18d9bb
Fallback to a localhost variant to make the length predictable
2015-03-09 16:56:25 -05:00
6543c3c36f
Update CachedSize for the fixed stager
2015-03-09 16:54:57 -05:00
c676ac1499
Fallback to a localhost variant to make the length predictable
2015-03-09 16:53:28 -05:00
d0324e8ad3
Final cleanup, passing specs
2015-03-09 15:50:57 -05:00
da81f6b2a0
Correct the :dynamic cache sizes
2015-03-09 15:44:14 -05:00
02509d02e4
The result of running ./tools/update_payload_cached_sizes.rb
2015-03-09 15:31:04 -05:00
a648e74c4b
Remove unnecessary semicolon
2015-03-02 15:36:45 -06:00
80169de4d0
Remove -i from shell in reverse_python
2015-03-02 15:29:50 -06:00
5297ebc1a1
Merge branch 'master' into land-1396-http_proxy_pstore
...
Bring things back to the future
2015-02-20 08:50:17 -06:00
91b4a59fc7
msftidy fixes
2015-02-20 08:42:54 -06:00
bae19405a7
Various grammar, spelling, word choice fixes
2015-01-26 11:00:07 -06:00
d14413579c
HTTP stager based on WinHttp
2015-01-19 13:01:56 +01:00
7a2f0553a8
Update reverse_tcp.rb
...
prevent over-reading from socket
2015-01-18 17:32:53 +02:00
9c12fcc2f1
Update bind_tcp.rb
...
Read exactly l bytes
2015-01-18 15:42:09 +02:00
18e15a109a
Update bind_tcp.rb
...
Prevent over reading from socket
2015-01-18 15:35:56 +02:00
9791acd0bf
Add stager ipknock shellcode (PR 2)
2014-12-27 22:03:45 +01:00
93be828738
Fix invalid URL in splat
2014-12-22 11:26:20 -06:00
f1b9862665
Align shellcode in bind_hidden_tcp
2014-12-22 11:17:14 -06:00
9a7e431a4a
New block_api applied
2014-12-22 17:21:13 +01:00
42636fb3c0
Handler and block_hidden_bind_tcp deleted
2014-12-22 17:21:13 +01:00
fa8e944e34
AHOST OptAddress moved to the payload
2014-12-22 17:21:11 +01:00
c0fa8c0e3f
Add stager for hidden bind shell payload
2014-12-22 17:21:11 +01:00
2c0c732967
Fix #4414 & #4415 - exitfunc and proper null-terminated string
...
This patch fixes the following for messagebox.rb
Issue 1 (#4415 )
When exitfunc is none, the payload will not be able to generate
due to an "invalid opcode" error.
Issue 2: (#4414 )
After "user32.dll" is pushed onto the stack for the LoadLibrary
call, the payload does not actually ensure bl is a null byte, it
just assumes it is and uses it to modify the stack to get a
null-terminated string.
Fix #4414
Fix #4415
2014-12-19 03:19:06 -06:00
e3943682a2
Improves linux/armle payloads, lands #3315
2014-12-13 18:27:14 -06:00
5a645c5eba
Stagers updated from source
2014-12-13 12:50:47 -06:00
92490ab5e8
Singles updated from the source
2014-12-13 12:22:07 -06:00
79f2708a6e
Slight fixes to grammar/desc/whitespace
...
Note that the format_all_drives module had a pile of CRLFs that should
have been caught by msftidy. Not sure why it didn't.
2014-12-04 13:11:33 -06:00
fc96d011ab
Python reverse_http stager, lands #4225
2014-12-02 11:47:31 -06:00
7fe72fd118
Cosmetic tweaks for #4225
2014-12-02 11:47:14 -06:00
4a4608adbc
Add format_all_drives shellcode for Windows x86_x64
2014-11-27 23:06:54 +05:30
8473ed144a
Add format_all_drives shellcode for Windows x86_x64
2014-11-27 14:13:49 +05:30
f5633ba3c3
Add format_all_drives shellcode for Windows x86_x64
2014-11-26 20:29:25 +05:30
8e7e5590c9
rename SHELLARG to ARGV0 because that's really what it is
2014-11-19 22:14:24 +01:00
ac4c11ca39
work on linux/armle/shell_bind/tcp
...
same changes as to shell_reverse_tcp
2014-11-19 21:53:23 +01:00
fd7248b3c0
work on linux/armle/shell_reverse_tcp
...
shorten the execve code, remove exit, grow argv[0] space
2014-11-19 21:53:23 +01:00
d5ebd8a2dc
Shorten the reverse_http stager by renaming a var
2014-11-17 19:04:26 -05:00
0bf93acf6b
Pymeterp http proxy and user agent support
2014-11-16 14:29:20 -05:00
7c14e818f6
Patch pymeterp http settings
2014-11-14 17:12:23 -05:00
681ae8ce6b
Pymet reverse_http stager basic implementation
2014-11-14 14:15:46 -05:00
35d3bbf74d
Fix up comment splats with the correct URI
...
See the complaint on #4039 . This doesn't fix that particular
issue (it's somewhat unrelated), but does solve around
a file parsing problem reported by @void-in
2014-10-17 11:47:33 -05:00
e0016d4af3
Remove hash rocket from refs array #3766
...
[SeeRM #8776 ]
2014-10-08 09:16:38 +00:00
3c7be9c4c5
Remove hash rockets from references #3766
...
[SeeRM #8776 ]
2014-10-08 09:01:19 +00:00
9e5826c4eb
Land #3844 - Add the JSObfu mixin to Firefox exploits
2014-09-29 11:15:14 -05:00
b96a7ed1d0
Install a global object in firefox payloads, bump jsobfu.
2014-09-24 16:05:00 -05:00
0247e4a521
Change RequiredCmd for reverse_bash_telnet_ssl cmd payload
2014-09-24 00:40:14 -05:00
e1b6ee283f
Allow Msf::Payload::JSP to guess system shell path if it isnt provided
2014-08-30 16:27:02 -05:00
af3ca19ab2
Land #3501 , @AnwarMohamed's android meterpreter commands.
2014-08-09 16:29:59 -05:00
c31fc61617
Land #3270 , @jlee-r7 deprecation ipv6 payloads
...
These are not needed, since you can just config the regular handler now
and pick either.
This resolves the conflict (rm'ed the old modules)
Conflicts:
modules/payloads/stagers/windows/reverse_ipv6_http.rb
modules/payloads/stagers/windows/reverse_ipv6_https.rb
2014-08-01 16:27:59 -05:00
c2be3d6875
fixing autoload bug
2014-07-29 17:51:56 +02:00
6bbb2124a7
bug fixing
2014-07-29 15:49:14 +02:00
283046b25d
fixing auto load on new session
2014-07-28 10:49:50 +02:00
25f74b79b8
Land #3484 , bad pack/unpack specifier fix
2014-07-16 14:52:23 -05:00
de22aeba41
Land #3481 , meterpreter bins
2014-07-14 15:57:52 -05:00
8937fbb2f5
Fix email format
2014-07-11 12:45:23 -05:00
bcec2df0a4
Fix Meterpreter PHP hop description
2014-07-10 11:35:48 -05:00
038d1e210a
Merge upstream/master to deconflict.
...
Conflicts:
Gemfile.lock
2014-07-09 17:43:42 -05:00
e908bb6819
formating
2014-07-08 11:02:41 +02:00
34dcb609e2
android extension
2014-07-08 04:52:06 +02:00
9fef2ca0f3
Description/whitespace changes (minor)
...
Four modules updated for the weekly release with minor cosmetic fixes.
- [ ] See all affected modules still load.
- [ ] See all affected modules have expected `info`
2014-07-07 12:39:05 -05:00
Brendan Watters
Brent Cook
RageLtMan
root
William Vu
wchen-r7
Tim
OJ
Bigendian Smalls
James Lee
Christian Mehlmauer
joev
jvazquez-r7
Spencer McIntyre
scriptjunkie
Matthias Ganz
Balazs Bucsay
root
HD Moore
benpturner
Ben Turner
Meatballs
rwhitcroft
Borja Merino
Tod Beardsley
eyalgr
root
Peregrino Gris
HackSys Team
Mark Schloesser
URI Assassin
Brendan Coles
Joe Vennix
AnwarMohamed