Commit Graph

1114 Commits (e09fe089839403a93dfc51613a14c16a860f4686)

Author SHA1 Message Date
Brent Cook 288b39e37f update to mettle 0.0.6 2016-07-27 08:59:21 -05:00
Brent Cook ee90e5e96d
update payload sizes 2016-07-13 01:06:05 -05:00
William Webb 8f73167b15
Land #7060, Fix up the 64-bit BSD reverse shell 2016-07-12 14:37:51 -05:00
Brent Cook 21bede1166 unify stager style 2016-07-05 11:24:54 -05:00
Brent Cook 049b322ae4 add x86 and x64 stagers for mettle 2016-07-05 11:24:54 -05:00
Adam Cammack 8490a3b775 Remove hard-float requirement for MIPS O32 2016-07-05 11:24:54 -05:00
Adam Cammack 0390ed4d6e Add MIPS O32 Linux support (big and little endian) 2016-07-05 11:24:54 -05:00
Adam Cammack 8de508c4e0 Add mettle module for ARM 2016-07-05 11:24:54 -05:00
wchen-r7 6290cb681f Change class name Metasploit4 to MetasploitModule 2016-07-05 11:12:49 -05:00
Hans Jerry Illikainen 78335f8e20 Update the cache size in bsd/x64/shell_reverse_tcp 2016-07-04 00:35:52 +02:00
Hans Jerry Illikainen f246aa0b58 dup2() to STDERR_FILENO in bsd/x64/shell_reverse_tcp 2016-07-04 00:00:33 +02:00
Hans Jerry Illikainen 54092177a2 Remove superfluous xor in bsd/x64/shell_reverse_tcp 2016-07-03 23:53:11 +02:00
earthquake c0093381d7 Big endian ARM Linux bind shellcode for ipv4 2016-06-10 00:06:53 +02:00
earthquake a58a3d4330 one line aligned to the others, space replaced to tab 2016-06-09 20:53:12 +02:00
earthquake 5f4153308c one line aligned to the others, space replaced to tabx 2016-06-09 20:52:20 +02:00
Brendan Watters af86d63498 Updated Cache size 2016-05-24 09:07:05 -05:00
Brendan Watters f0b945e4c4 Updated cache size 2016-05-24 09:06:46 -05:00
Brendan Watters d328258db4 Updated Cache size 2016-05-24 09:06:28 -05:00
Brent Cook 2694907b79 update cached payload size 2016-05-23 14:30:43 -05:00
RageLtMan cf62218139 Update payload sizes 2016-05-23 14:27:11 -05:00
RageLtMan efc64eaa5f Implement reverse_tcp_rc4_dns payload in metasm
Using the ruby methods for generating assembly blocks defined or
separated in prior commits, create a new payload from the existing
assembly blocks which performs a DNS lookup of the LHOST prior to
establishing a corresponding socket and downloading, and
decrypting the RC4 encrypted payload.

For anyone looking to learn how to build these payloads, these
three commits should provide a healthy primer. Small changes to
the payload structure can yield entropy enough to avoid signature
based detection by in-line or out-of-band static defenses. This
payload was completed in the time between this commit and the last.

Testing:
  Win2k8r2

ToDo:
  Update payload sizes when this branch is "complete"
  Ensure UUIDs and adjacent black magic all work properly
2016-05-23 14:27:11 -05:00
RageLtMan 0e69040a6a Implement reverse_tcp_dns as metasm payload
Using the separation of block_recv and reverse_tcp, implement
reverse_tcp_dns using original shellcode as template with dynamic
injection of parameters. Concatenate the whole thing in the
generation call chain, and compile the resulting shellcode for
delivery.

Metasploit module pruned to bare minimum, with the LHOST OptString
moved into the library component.

Testing:
  Win2k8r2

ToDo:
  Update payload sizes when this branch is "complete"
  Ensure UUIDs and adjacent black magic all work properly

Misc:
  Clean up rc4.rb to use the rc4_keys method when generating a
stage. Makes the implementation far more readable and reduces
redundant code.
2016-05-23 14:27:11 -05:00
RageLtMan df2346d9e0 Implement RC4 metasm payloads for tcp bind and rev
Convert reverse_tcp_rc4 and bind_tcp_rc4 from static shellcode
substitution payloads to metasm compiled assembly approach.

Splits up metasm methods for bind_tcp and reverse_tcp into socket
creation and block_recv to allow for reuse of the socket methods
with the RC4 payloads, while substituting the block_recv methods
for those carrying the appropriate decryptor stubs.

Creates a new rc4 module carrying the bulk of the decryptor and
adjacent convenince methods for standard payload generation.

Testing:
 Tested against Win2k8r2, Win7x64, and WinXPx86

ToDo:
 Ensure all the methods around payload sizing, UUIDs, and other
new functionality, the semantics of which i do not yet fully
understand, are appropriate and do not introduce breakage.
2016-05-23 14:27:11 -05:00
root a71e853c2a Fixed cache size for python/shell_reverse_tcp_ssl 2016-05-20 02:32:37 +00:00
root 87398d5195 Fixed python reverse shell ssl send for EOF occurred in violation of protocol error 2016-05-20 01:49:04 +00:00
Brent Cook 8ce0365c7f
See rapid7/metasploit-payloads#98, update cached payload sizes 2016-05-13 23:05:34 -05:00
William Vu 74e5772bbf Replace mknod with mkfifo for portability
Works on BSD and OS X now. This has been bugging me for a while.
2016-05-04 02:32:37 -05:00
wchen-r7 2a91a876ff Update php/meterpreter_reverse_tcp size 2016-04-27 16:14:38 -05:00
Brent Cook 9a873a7eb5 more style fixes 2016-04-23 12:18:28 -04:00
Brent Cook d86174c3bf style fixes 2016-04-23 12:18:28 -04:00
Brent Cook 4250725b13 fix incorrect hex port conversion 2016-04-23 12:18:28 -04:00
Brent Cook 7ff5a5fd7e switch mainframe payloads to fixed size 2016-04-23 11:40:05 -04:00
Brent Cook c596421b01 use generate_uri_uuid_mode for java reverse_http 2016-04-18 08:26:02 -05:00
Tim edd30e433e https tweaks 2016-04-18 08:26:02 -05:00
OJ 555352b210 Force lurl string duplication to avoid stageless issues
I have NO idea why this is even a problem. Mutating state is the spawn of satan.
2016-04-18 08:25:19 -05:00
OJ a74a7dde55 More fixies for LURI in Python, and native too 2016-04-18 08:25:19 -05:00
OJ 06d53112e3 Add support for LURI to the java and android payloads 2016-04-18 08:24:41 -05:00
OJ b95267997d Fix LURI support for stageless, transport add/change and code tidies 2016-04-18 08:24:41 -05:00
Brent Cook 6ce7055130
Land #6737, Added reverse shell JCL payload for z/OS 2016-04-13 22:19:15 -05:00
Bigendian Smalls 6a4d7e3b58
Revshell cmd JCL payload for z/OS
Added a JCL-based reverse shell.  Uses the same source code as the
shellcode version does.  Source code is in
external/source/shellcode/mainframe/shell_reverse_tcp.s
2016-03-31 20:42:42 -05:00
Bigendian Smalls a6518b5273
Add generic JCL cmd payload for z/OS (mainframe)
This payload does nothing but return successfully.  It can be used to
test exploits and as a basis for other JCL cmd payloads.
2016-03-28 21:01:39 -05:00
James Lee 1375600780
Land #6644, datastore validation on assignment 2016-03-17 11:16:12 -05:00
Christian Mehlmauer 3123175ac7
use MetasploitModule as a class name 2016-03-08 14:02:44 +01:00
Brent Cook 8faae94338
Land #6592, make linux/x86/shell_reverse_tcp's shell path configurable and remove shell_reverse_tcp2 2016-03-06 15:33:53 -06:00
Brent Cook c7c0e12bb3 remove various module hacks for the datastore defaults not preserving types 2016-03-05 23:11:39 -06:00
Brent Cook d355b0e8b7
update payload sizes 2016-03-02 13:55:32 -06:00
joev c8b28d90d1 Fix old comment. 2016-02-19 19:08:38 -06:00
joev b3e8cd4f51 Save some bytes on the padded string. 2016-02-18 20:36:52 -06:00
joev 2b784a48b9 Include cached size. 2016-02-18 20:29:42 -06:00
joev e67e477362 Make x86/shell_reverse_tcp's shell path configurable.
Also removes shell_reverse_tcp2 shell.
2016-02-18 20:24:35 -06:00