210a4cb299
fix indent
2017-06-18 15:35:23 +08:00
1773a5f188
fix indent
2017-06-16 15:57:09 +09:00
9cf9d22bae
fix mmap return cmp
2017-06-16 06:26:40 +08:00
f17b28930d
Update executex64.asm
2017-06-04 13:18:50 +03:00
6a3fc618a4
Add bypassuac_injection_winsxs.rb module
2017-06-03 12:59:50 +02:00
ca5b20f4d0
Fixed an elusive bug on AMD CPUs
...
Details:
http://blog.rewolf.pl/blog/?p=1484
rwfpl/rewolf-wow64ext@8771485
2017-06-03 11:30:11 +03:00
bdf121e1c0
x86 kernels will safely ret instead of BSOD
2017-05-17 23:48:14 -06:00
4f3a98d434
add arch detection to shellcode
2017-05-17 23:36:17 -06:00
a5c391dae2
multi-arch ring0->ring3 shellcode .asm file (work in progress)
2017-05-17 23:29:05 -06:00
176e88f293
Land #7835 , Add Windows Local Privilege Escalation exploit stub
2017-03-08 06:20:58 -05:00
83cc28a091
Land #7972 , Microsoft Office Word Macro Generator OS X Edition
2017-02-21 13:26:42 -06:00
3d269b46ad
Support OS X for Microsoft Office macro exploit
2017-02-16 12:28:11 -06:00
1c62559e55
Add v1 of SQL Clr stored proc payload module
2017-02-10 10:28:22 +10:00
ccaa783a31
Add Microsoft Office Word Macro exploit
2017-02-02 17:44:55 -06:00
b6e882c8eb
Add a Windows LPE exploit template for x64/x86
2017-01-17 11:20:14 +10:00
32173b9701
Move execute_payload to the kernel lib
2017-01-17 11:19:26 +10:00
2585c8c8b5
Land #7461 , convert futex_requeue (towelroot) module to use targetting and core_loadlib
2017-01-11 13:24:25 -06:00
25a8283af3
fork early and use WfsDelay
2016-12-20 00:59:27 +08:00
f1efa760df
more fixes
2016-12-20 00:52:11 +08:00
e6d4c0001c
hide debug printing
2016-12-20 00:52:11 +08:00
7ac3859393
convert futex_requeue module to use targetting and core_loadlib
2016-12-20 00:52:11 +08:00
3afa20a1af
fix double \n in printf
2016-12-13 17:02:23 +08:00
fe9972cc25
fork early and use WfsDelay
2016-12-13 17:02:23 +08:00
891fccb4e2
add pattern for GT-S7392
2016-12-13 17:02:23 +08:00
07ce7f3aed
fix make run
2016-12-13 17:02:23 +08:00
9ece45a180
dont exit(0) when exploit fails
2016-12-13 17:02:23 +08:00
ebf7ae0739
add CVE-2013-6282, put_user/get_user exploit for Android
2016-12-13 17:02:23 +08:00
31b593ac67
Land #7402 , Add Linux local privilege escalation via overlayfs
2016-11-01 12:46:40 -05:00
0d1fe20ae5
revamped
2016-10-15 20:57:31 -04:00
12493d5c06
moved c code to external sources
2016-10-13 20:37:03 -04:00
36b989e6d7
Initial import of .NET compiler and persistence
...
Add Exploit::Powershell::DotNet namespace with compiler and
runtime elevator.
Add compiler modules for payloads and custom .NET code/blocks.
==============
Powershell-based persistence module to compile .NET templates
with MSF payloads into binaries which persist on host.
Templates by @hostess (way back in 2012).
C# templates for simple binaries and a service executable with
its own install wrapper.
==============
Generic .NET compiler post module
Compiles .NET source code to binary on compromised hosts.
Useful for home-grown APT deployment, decoy creation, and other
misdirection or collection activities.
Using mimikatz (kiwi), one can also extract host-resident certs
and use them to sign the generated binary, thus creating a
locally trusted exe which helps with certain defensive measures.
==============
Concept:
Microsoft has graciously included a compiler in every modern
version of Windows. Although executables which can be easily
invoked by the user may not be present on all hosts, the
shared runtime of .NET and Powershell exposes this functionality
to all users with access to Powershell.
This commit provides a way to execute the compiler entirely in
memory, seeking to avoid disk access and the associated forensic
and defensive measures. Resulting .NET assemblies can be run
from memory, or written to disk (with the option of signing
them using a pfx cert on the host). Two basic modules are
provided to showcase the functionality and execution pipeline.
Usage notes:
Binaries generated this way are dynamic by nature and avoid sig
based detection. Heuristics, sandboxing, and other isolation
mechanisms must be defeated by the user for now. Play with
compiler options, included libraries, and runtime environments
for maximum entropy before you hit the temmplates.
Defenders should watch for:
Using this in conjunction with WMI/PS remoting or other MSFT
native distributed execution mechanism can bring malware labs
to their knees with properly crafted templates.
The powershell code to generate the binaries also provides a
convenient method to leave behind complex trojans which are not
yet in binary form, nor will they be until execution (which can
occur strictly in memory avoiding disk access for the final
product).
==============
On responsible disclosure: I've received some heat over the years
for prior work in this arena. Everything here is already public,
and has been in closed PRs in the R7 repo for years. The bad guys
have had this for a while (they do their homework religiously),
defenders need to be made aware of this approach and prepare
themselves to deal with it.
2016-10-08 14:05:53 -05:00
0e82ced082
Add LPE exploit module for the capcom driver flaw
...
This commit includes:
* RDI binary that abuses the SMEP bypass and userland function pointer
invocation that is provided by the driver.
* Related metasploit module.
* Associated make.build to build from command line.
* Updated command line build file.
This also includes the beginnings of a new set of functions that help
with the management/automation of kernel-related work on Windows for
local priv esc exploits.
2016-09-27 22:37:45 +10:00
21e6211e8d
add exploit for cve-2016-0189
2016-08-01 13:26:35 -05:00
7b1d9596c7
Land #7068 , Introduce 'mettle' - new POSIX meterpreter
2016-07-11 22:38:40 -05:00
b4b3a84fa5
refactor ms16-016 code
2016-07-05 20:50:43 -05:00
0390ed4d6e
Add MIPS O32 Linux support (big and little endian)
2016-07-05 11:24:54 -05:00
8de508c4e0
Add mettle module for ARM
2016-07-05 11:24:54 -05:00
3147553d4f
armeb comments modified
2016-06-10 19:59:59 +02:00
26680f58ca
Original shellcode added for Linux ARM big endian bind ipv4 tcp
2016-06-10 19:19:16 +02:00
f1857d6350
Kill defanged mode
2016-03-28 09:02:07 -05:00
6eda702b25
Land #6292 , add reverse_tcp command shell for Z/OS (MVS)
2015-12-23 14:11:37 -06:00
5a19caf10a
remove temp file
2015-12-23 11:42:09 -06:00
eb4611642d
Add Jenkins CLI Java serialization exploit module
...
CVE-2015-8103
2015-12-11 14:57:10 -06:00
bb3a3ae8eb
Land #6176 , @ganzm's fix for 64 bits windows loadlibrary payload
2015-12-01 13:18:41 -06:00
09d63de502
Added revshell shellcode source
...
Put shell_reverse_tcp.s shellcode source for mainframe reverse shell
into external/source/shellcode/mainframe
2015-12-01 08:26:42 -06:00
1b951b36fe
remove -db / -pcap / -all gemspecs, merge into one
2015-11-11 15:01:50 -06:00
e6202e3eda
Revert "Land #6060 , Gemfile/gemspec updates"
...
This reverts commit 8f4046da402df149b0a5
2015-11-08 19:32:15 -06:00
7c7eb06058
remove unused kissfft library
2015-11-04 08:35:45 -06:00
4eaf1ace81
Bugfix loading address of library path into rcx
...
The old code breaks if the payload is executed from a memory area where the 4 most significant bytes are non-zero.
2015-11-02 16:56:07 +01:00
77fae28cd4
Add -q option to msfd to disable banner
2015-10-07 01:57:58 -05:00
9444c8c410
Fix #5988 , windows x64 stagers
...
* Also, use mov esi, esi to save an extra byte
* Also, modify the block_recv.asm code, just to have it up to date
2015-09-28 15:52:50 -05:00
2c9734f178
Add exploit source
2015-09-15 14:54:05 -05:00
6e857568e0
Delete comments
2015-09-03 13:33:40 -05:00
b39575928e
Update reflective exploit
2015-09-03 11:01:41 -05:00
ecf3fb61d6
Replace external source
2015-08-26 15:32:50 -05:00
d54249370b
Move tpwn source to external/source/exploits
2015-08-17 18:27:47 -05:00
7113c801b1
Land #5732 , reliability update for adobe_flash_hacking_team_uaf
2015-07-17 16:43:39 -05:00
255d8ed096
Improve adobe_flash_opaque_background_uaf
2015-07-16 14:56:32 -05:00
ab5c7a806e
Update flash exploiter
2015-07-15 18:32:45 -05:00
bd5d372436
Add build comment
2015-07-15 18:30:05 -05:00
138789b77c
Fix indentation
2015-07-15 18:29:28 -05:00
b504f0be8e
Update adobe_flash_hacking_team_uaf
2015-07-15 18:18:04 -05:00
d6565a9aee
Merge branch 'bes_flash' into bapv2_flash_test
2015-07-14 00:34:54 -05:00
b72ba7f51c
Add AS2 flash detection code
2015-07-13 18:26:02 -05:00
8fb6bedd94
Delete as3 detecotr
2015-07-13 18:23:39 -05:00
9116460cb0
Add prototype with AS3
2015-07-13 16:33:55 -05:00
299978d0e2
Put again old exploiter
2015-07-11 00:36:32 -05:00
63005a3b92
Add module for flash CVE-2015-5122
...
* Just a fast port for the exploit leaked
* Just tested on win7sp1 / IE11
2015-07-11 00:28:55 -05:00
3d630de353
Replace with a real CVE number
2015-07-07 14:44:12 -05:00
d9aacf2d41
Add module for hacking team flash exploit
2015-07-07 11:19:48 -05:00
1de94a6865
Add module for CVE-2015-3113
2015-07-01 13:13:57 -05:00
e49c36998c
Fix indentation
2015-06-25 14:12:23 -05:00
a87d4e5764
Add flash_exploiter template
2015-06-25 13:52:57 -05:00
ee0377ca16
Add module for CVE-2015-3105
2015-06-25 13:35:01 -05:00
2206a6af73
Support older targets x86 for MS15-051
2015-06-25 09:33:15 +10:00
3686accadd
Merge branch 'upstream/master' into cve-2015-1701
2015-06-22 07:52:17 +10:00
b78ba55c25
Merge minor CVE-2015-1701 from zeroSteiner
2015-06-22 07:50:26 +10:00
d73a3a4a5f
Dont call ExitProcess because it might kill the shell
2015-06-21 16:16:33 -04:00
27a583853c
Fix one more line indentation
2015-06-18 12:40:30 -05:00
55f077fa9e
Fix indentation
2015-06-18 12:38:36 -05:00
de1542e589
Add module for CVE-2015-3090
2015-06-18 12:36:14 -05:00
17b8ddc68a
Land #5524 , adobe_flash_pixel_bender_bof in flash renderer
2015-06-15 02:42:16 -05:00
72672fc8f7
Delete debug
2015-06-11 17:39:36 -05:00
8ed13b1d1b
Add linux support for CVE-2014-0515
2015-06-11 16:18:50 -05:00
ae21b0c260
Land #5523 , adobe_flash_domain_memory_uaf in the flash renderer
2015-06-10 16:59:19 -05:00
4c5b1fbcef
Land #5522 , adobe_flash_worker_byte_array_uaf in the flash renderer
2015-06-10 14:49:41 -05:00
af31112646
Fix exploit indentation
2015-06-10 14:19:36 -05:00
64562565fb
Fix method indentation
2015-06-10 14:16:47 -05:00
2bb3a5059c
Fix else indentation
2015-06-10 14:15:58 -05:00
1d05ce1cdc
Fix for indentation
2015-06-10 14:14:29 -05:00
7202e27918
Fix indentation
2015-06-10 14:12:26 -05:00
ab132290d7
Add Exploiter AS
2015-06-10 13:53:45 -05:00
6c7ee10520
Update to use the new flash Exploiter
2015-06-10 13:52:43 -05:00
0d2454de93
Fix indentation
2015-06-10 12:27:52 -05:00
7fba64ed14
Allow more search space
2015-06-10 12:26:53 -05:00
ecbddc6ef8
Play with memory al little bit better
2015-06-10 11:54:57 -05:00
d622c782ef
Land #5519 , adobe_flash_uncompress_zlib_uninitialized in the flash renderer
2015-06-10 11:52:47 -05:00
667db8bc30
Land #5517 , adobe_flash_casi32_int_overflow (exec from the flash renderer)
2015-06-10 11:39:13 -05:00
2b4fe96cfd
Tweak Heap Spray
2015-06-10 10:56:24 -05:00
a6fe383852
Use AS Exploiter
2015-06-10 09:32:52 -05:00
64b486eeac
Change filename
2015-06-10 09:12:52 -05:00
d95a0f432d
Update AS codE
2015-06-10 09:12:25 -05:00
e5d6c9a3cb
Make last code cleanup
2015-06-09 16:01:57 -05:00
d9db45690f
Delete debug messages
2015-06-09 15:47:59 -05:00
cf8c6b510b
Debug version working
2015-06-09 15:46:21 -05:00
f4649cb3fb
Delete old AS
2015-06-09 14:50:59 -05:00
4f1ee3fcdf
Really fix indentation
2015-06-09 12:42:32 -05:00
5bab1cfc68
Fix indentation
2015-06-09 12:38:24 -05:00
39851d277d
Unset debug flag
2015-06-09 11:36:09 -05:00
b7f0fad72f
Modify CVE-2014-0569 to use the flash exploitation code
2015-06-09 11:31:39 -05:00
5a6a16c4ec
Resolve #4326 , remove msfpayload & msfencode. Use msfvenom instead!
...
msfpayload and msfencode are no longer in metasploit. Please use
msfvenom instead.
Resolves #4326
2015-06-08 11:30:04 -05:00
b291d41b76
Quick hack to remove hard-coded offsets
2015-06-05 13:19:41 +10:00
51d98e1008
Update AS code
2015-06-04 18:34:08 -05:00
02181addc5
Update CVE-2014-0556
2015-06-04 18:23:50 -05:00
23df66bf3a
Land #5481 , no powershell. exec shellcode from the renderer process.
2015-06-04 15:45:09 -05:00
75454f05c4
Update AS source code
2015-06-04 12:12:49 -05:00
80cb70cacf
Add support for Windows 8.1/Firefox
2015-06-03 22:46:04 -05:00
74117a7a52
Allow to execute payload from the flash renderer
2015-06-03 16:33:41 -05:00
455a3b6b9d
Add butchered version of CVE-2015-1701
2015-06-03 21:48:23 +10:00
e9714bfc82
Solve conflics
2015-05-27 23:22:00 -05:00
e749733eb6
Land #5419 , Fix Base64 decoding on ActionScript
2015-05-27 23:13:51 -05:00
e5d42850c1
Add support for Linux to CVE-2015-0336
2015-05-27 17:05:10 -05:00
801deeaddf
Fix CVE-2015-0336
2015-05-27 15:42:06 -05:00
bd1bdf22b5
Fix CVE-2015-0359
2015-05-26 17:27:20 -05:00
19c7445d9d
Fix CVE-2015-0336
2015-05-26 17:20:49 -05:00
23d244b1fa
Fix CVE-2015-0313
2015-05-26 16:11:44 -05:00
5c8c5aef37
Fix CVE-2014-8440
2015-05-26 16:05:08 -05:00
da362914e2
Fix indentation
2015-05-26 15:50:31 -05:00
d78d04e070
Fix CVE-2014-0569
2015-05-26 15:49:22 -05:00
e0a1fa4ef6
Fix indentation
2015-05-26 15:38:56 -05:00
1742876757
Fix CVE-2014-0556
2015-05-26 15:30:39 -05:00
a1538fc3ba
Update AS code
2015-05-26 15:18:01 -05:00
f35d7a85d3
Adjust numbers
2015-05-21 15:56:11 -05:00
a8e9b0fb54
Update ActionScript
2015-05-21 14:58:38 -05:00
51bb4b5a9b
Add module for CVE-2015-0359
2015-05-07 17:00:00 -05:00
582919acac
Add module for CVE-2015-0336
2015-05-05 17:25:19 -05:00
b07a864416
Fix as indentation
2015-04-29 19:01:11 -05:00
dbba466b5b
Add module for CVE-2014-8440
2015-04-29 17:52:04 -05:00
28fac60c81
Add module for CVE-2015-0556
2015-04-15 14:08:16 -05:00
91f5d0af5a
Add module for CVE-2014-0569
...
* Adobe flash, Integer overflow on casi32
2015-04-09 19:37:26 -05:00
11c6f3fdca
Do reliable resolution of kernel32
2015-03-29 15:52:13 -05:00
f84a46df63
Add module for CVE-2015-0313
2015-03-27 18:51:13 -05:00
dab4333867
updated asm in block
2015-03-18 16:07:46 -04:00
bb81107e51
Land #4927 , @wchen-r7's exploit for Flash PCRE CVE-2015-0318
2015-03-13 23:58:05 -05:00
2a25e2b2e1
Update Main.as
2015-03-13 11:40:16 -05:00
0ee0a0da1c
This seems to work
2015-03-13 04:43:06 -05:00
0c3329f69e
Back on track
2015-03-12 15:26:55 -05:00
b604599c8e
Fix comments
2015-03-11 21:32:35 -05:00
479a9cc1a9
Fix missing stack variables & remove old comment
2015-03-11 21:23:27 -05:00
7e3b4017f0
Rename and resynced with master, ready for refactoring
2015-03-11 14:36:27 -05:00
Tim
tkmru
RaMMicHaeL
L3cr0f
zerosum0x0
Brent Cook
William Webb
wchen-r7
OJ
h00die
RageLtMan
Pearce Barry
Adam Cammack
EarthQuake
James Lee
dmohanty-r7
jvazquez-r7
Bigendian Smalls
William Vu
Matthias Ganz
Tod Beardsley
Spencer McIntyre
rwhitcroft
HD Moore