Commit Graph

236 Commits (f6708b4d836c389f22530b81874d07e531ea0544)

Author SHA1 Message Date
Meatballs 474ee81807
Merge remote-tracking branch 'upstream/master' into pr2075 2014-07-20 21:01:54 +01:00
Meatballs 7583ed4950
Merge remote-tracking branch 'upstream/master' into pr2075 2014-07-16 20:34:34 +01:00
HD Moore 84c0504b1b MSI sections actually need to be signed after all 2014-06-30 13:08:28 -05:00
HD Moore c9b6c05eab Fix improper use of host-endian or signed pack/unpack
Note that there are some cases of host-endian left, these
are intentional because they operate on host-local memory
or services.

When in doubt, please use:

```
ri pack
```
2014-06-30 02:50:10 -05:00
HD Moore 255e792ed3 Fix host-endian related pack errors. See below for details.
Ruby treats endianess in pack operators in the opposite way
of python. For example, using pack('<I') actually ignores the
endianess specifier. These need to be 'I<' or better yet, 'V'.
The endian specify must occur after the pack specifier and
multiple instances in meterpreter and exe generation were
broken in thier usage.

The summary:

Instead of I/L or I< use V
Instead of I/L or I> use N
For Q, you need to always use Q< (LE) or Q> (BE)
For c/s/l/i and other lowercase variants, you probably dont
need or want a *signed* value, so stick with vV nN and cC.
2014-06-30 02:46:36 -05:00
Meatballs 897ad6f963
Some service yarddoc 2014-06-07 13:27:32 +01:00
Florian Gaultier 808f87d213 SERVICE_DESCRIPTION doesn't concern this PR 2014-05-13 16:04:39 +02:00
Florian Gaultier bb4e9e2d4d correct error in block service_change_description 2014-05-13 16:04:39 +02:00
Florian Gaultier 6332957bd2 Try to add SERVICE_DESCRIPTION options to psexec, but it doesn't seem to work... 2014-05-13 16:04:39 +02:00
Florian Gaultier bdbb70ab71 up block_service_stopped.asm 2014-05-13 16:04:39 +02:00
Florian Gaultier 94f97ab963 Prevent import table overwritting by shifting entry point 2014-05-13 16:04:39 +02:00
Florian Gaultier e269c1e4f1 Improve service_block with service_stopped block to cleanly terminate service 2014-05-13 16:04:38 +02:00
Florian Gaultier c43e3cf581 Improve block_create_remote_process to point on shellcode everytime 2014-05-13 16:04:38 +02:00
Florian Gaultier 25d48b7300 Add create_remote_process block, now used in exe_service generation 2014-05-13 16:04:38 +02:00
Florian Gaultier 5ecebc3427 Add options `SERVICE_NAME` and `SERVICE_DISPLAYNAME` to psexec and correct service payload generation 2014-05-13 16:04:37 +02:00
Florian Gaultier 0b462ceea6 refactor `to_winpe_only` code to be used by `to_win32pe_service` 2014-05-13 16:04:37 +02:00
Florian Gaultier 914d15c285 fix typo 2014-05-13 16:04:37 +02:00
Florian Gaultier ca7a2c7a36 Add string_to_pushes to use non fixed size service_name 2014-05-13 16:04:37 +02:00
Florian Gaultier b3fd21b98d Change to try to follow ruby guidelines 2014-05-13 16:04:37 +02:00
Florian Gaultier 72a3e49fbb fix typo 2014-05-13 16:04:36 +02:00
Florian Gaultier 513f3de0f8 new service exe creation refreshed 2014-05-13 16:04:36 +02:00
Meatballs 38d8df4040
Merge remote-tracking branch 'upstream/master' into pr2075
Conflicts:
	modules/exploits/windows/local/wmi.rb
2014-04-15 22:06:45 +01:00
agix ac63e84d02 Fix little bug when using msfencode and exe-only
When arch is not defined, arch is null so it crashs.
It should be 'x86' by default
2014-04-14 01:02:31 +02:00
sinn3r c76a1ab9f4
Land #3065 - Safari User-Assisted Download & Run Attack 2014-03-07 10:29:56 -06:00
Joe Vennix 38a2e6e436 Minor fixes. 2014-03-05 19:03:54 -06:00
Joe Vennix 12cf5a5138 Add BES, change extra_plist -> plist_extra. 2014-03-05 18:51:42 -06:00
Joe Vennix cd3c2f9979 Move osx-app format to EXE. 2014-03-04 22:54:00 -06:00
OJ a1aef92652
Land #2431 - In-memory bypass uac 2014-03-05 11:15:54 +10:00
Meatballs 2885ebcb40
Merge remote-tracking branch 'upstream/master' into pr2075 2014-03-02 20:57:02 +00:00
David Maloney 1a0f77edb2
Land #2739, DLL injection in msfvenom
lands Meatballs PR to fix dll injection
in Msfvenom. Test to ensure it still works
in the new MsfVenom
2014-02-28 14:22:17 -06:00
David Maloney 9e355e1265 Merge branch 'master' into dll_inject 2014-02-28 14:20:46 -06:00
jvazquez-r7 6c490af75e Add randomization to Rex::Zip::Jar and java_signed_applet 2014-02-27 12:38:52 -06:00
Meatballs 2a6258be15
Merge remote-tracking branch 'upstream/master' into bypassuac_redo
Conflicts:
	external/source/exploits/make.bat
2014-02-28 20:26:24 +00:00
Meatballs 8bdb22aeb9
Merge remote-tracking branch 'upstream/master' into bypassuac_redo
Conflicts:
	lib/msf/core/post/windows.rb
2014-02-25 22:15:05 +00:00
Spencer McIntyre 7f9b4a4bf4
Land #2655, Re-do exe-small for scripting payloads. 2014-02-17 15:56:23 -05:00
Spencer McIntyre 3299b68adf
Landing #2767, @Meatballs1 Powershell Reflective Payload 2014-02-14 16:12:46 -05:00
Meatballs 1f9b452425
Dont tidy up template yet 2014-02-09 11:23:39 +00:00
Meatballs ad308efc05
Really minimize commandline size 2014-02-08 22:53:47 +00:00
Meatballs f112e78de9
Fixes .war file creation 2013-12-22 20:58:21 +00:00
Meatballs 0c5ac0176f
Undo psh net change 2013-12-16 13:43:40 +00:00
Meatballs dd5b66f827
Undo psh net change 2013-12-16 13:42:37 +00:00
Meatballs 14c0096115
Update template
Use Copy instead of memset
Remove | Out-Null
2013-12-16 13:38:14 +00:00
Meatballs 8dfcc8aa77
WaitForThread 2013-12-16 12:44:58 +00:00
Meatballs 637be1bdfa
Should use RIG 2013-12-16 09:19:17 +00:00
Meatballs 0a29176855
Update psh_web_delivery for reflection 2013-12-16 09:08:01 +00:00
Meatballs 7cc99d76ad
Merge remote-tracking branch 'upstream/master' into powershell_auto_arch
Conflicts:
	lib/msf/util/exe.rb
2013-12-16 09:07:08 +00:00
Meatballs 28f8ac322f
Enable inject 2013-12-14 21:30:52 +00:00
Meatballs 7347cb170c Revert "Enable DLL injection in msfvenom"
This reverts commit 64e6531bbc.
2013-12-14 21:26:13 +00:00
Meatballs bc0c080947
Indentation 2013-12-08 18:18:44 +00:00
Meatballs 64e6531bbc
Enable DLL injection in msfvenom 2013-12-08 18:16:23 +00:00