Land rapid7#8439, native OSX meterpreter support

Author: Brent Cook

Gemfile.lock

@@ -30,7 +30,7 @@ PATH
       metasploit-model
       metasploit-payloads (= 1.2.37)
       metasploit_data_models
-      metasploit_payloads-mettle (= 0.1.10)
+      metasploit_payloads-mettle (= 0.1.14)
       msgpack
       nessus_rest
       net-ssh
@@ -189,7 +189,7 @@ GEM
       postgres_ext
       railties (~> 4.2.6)
       recog (~> 2.0)
-    metasploit_payloads-mettle (0.1.10)
+    metasploit_payloads-mettle (0.1.14)
     method_source (0.8.2)
     mini_portile2 (2.2.0)
     minitest (5.10.2)

lib/msf/base/sessions/meterpreter_x64_osx.rb

@@ -0,0 +1,29 @@
+# -*- coding: binary -*-
+
+require 'msf/base/sessions/meterpreter'
+
+module Msf
+module Sessions
+
+###
+#
+# This class creates a platform-specific meterpreter session type
+#
+###
+class Meterpreter_x64_OSX < Msf::Sessions::Meterpreter
+  def supports_ssl?
+    false
+  end
+  def supports_zlib?
+    false
+  end
+  def initialize(rstream, opts={})
+    super
+    self.base_platform = 'osx'
+    self.base_arch = ARCH_X64
+  end
+end
+
+end
+end
+

lib/msf/base/sessions/meterpreter_x86_osx.rb

@@ -0,0 +1,29 @@
+# -*- coding: binary -*-
+
+require 'msf/base/sessions/meterpreter'
+
+module Msf
+module Sessions
+
+###
+#
+# This class creates a platform-specific meterpreter session type
+#
+###
+class Meterpreter_x86_OSX < Msf::Sessions::Meterpreter
+  def supports_ssl?
+    false
+  end
+  def supports_zlib?
+    false
+  end
+  def initialize(rstream, opts={})
+    super
+    self.base_platform = 'osx'
+    self.base_arch = ARCH_X86
+  end
+end
+
+end
+end
+

lib/msf/util/exe.rb

@@ -106,7 +106,7 @@ def self.to_zip(files)
   # @return           [String]
   # @return           [NilClass]
   def self.to_executable(framework, arch, plat, code = '', opts = {})
-    if elf? code
+    if elf? code or macho? code
       return code
     end
 
@@ -2148,15 +2148,19 @@ def self.to_executable_fmt(framework, arch, plat, code, fmt, exeopts)
         end
       end
     when 'macho', 'osx-app'
-      macho = case arch
-      when ARCH_X86,nil
-        to_osx_x86_macho(framework, code, exeopts)
-      when ARCH_X64
-        to_osx_x64_macho(framework, code, exeopts)
-      when ARCH_ARMLE
-        to_osx_arm_macho(framework, code, exeopts)
-      when ARCH_PPC
-        to_osx_ppc_macho(framework, code, exeopts)
+      if macho? code
+        macho = code
+      else
+        macho = case arch
+        when ARCH_X86,nil
+          to_osx_x86_macho(framework, code, exeopts)
+        when ARCH_X64
+          to_osx_x64_macho(framework, code, exeopts)
+        when ARCH_ARMLE
+          to_osx_arm_macho(framework, code, exeopts)
+        when ARCH_PPC
+          to_osx_ppc_macho(framework, code, exeopts)
+        end
       end
       fmt == 'osx-app' ? Msf::Util::EXE.to_osx_app(macho) : macho
     when 'vba'
@@ -2284,6 +2288,10 @@ def self.elf?(code)
     code[0..3] == "\x7FELF"
   end
 
+  def self.macho?(code)
+    code[0..3] == "\xCF\xFA\xED\xFE" || code[0..3] == "\xCE\xFA\xED\xFE" || code[0..3] == "\xCA\xFE\xBA\xBE" 
+  end
+
 end
 end
 end

lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb

@@ -259,7 +259,7 @@ def cmd_shell(*args)
         print_error( "Failed to spawn shell with thread impersonation. Retrying without it." )
         cmd_execute("-f", path, "-c", "-H", "-i")
       end
-    when 'linux'
+    when 'linux', 'osx'
       # Don't expand_path() this because it's literal anyway
       path = "/bin/sh"
       cmd_execute("-f", path, "-c", "-i")

metasploit-framework.gemspec

@@ -72,7 +72,7 @@ Gem::Specification.new do |spec|
   # Needed for Meterpreter
   spec.add_runtime_dependency 'metasploit-payloads', '1.2.37'
   # Needed for the next-generation POSIX Meterpreter
-  spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.1.10'
+  spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.1.14'
   # Needed by msfgui and other rpc components
   spec.add_runtime_dependency 'msgpack'
   # get list of network interfaces, like eth* from OS.

modules/payloads/singles/linux/aarch64/meterpreter_reverse_http.rb

@@ -10,7 +10,7 @@
 
 module MetasploitModule
 
-  CachedSize = 652264
+  CachedSize = 675048
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions

modules/payloads/singles/linux/aarch64/meterpreter_reverse_https.rb

@@ -10,7 +10,7 @@
 
 module MetasploitModule
 
-  CachedSize = 652264
+  CachedSize = 675048
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions

modules/payloads/singles/linux/aarch64/meterpreter_reverse_tcp.rb

@@ -10,7 +10,7 @@
 
 module MetasploitModule
 
-  CachedSize = 652264
+  CachedSize = 675048
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions

modules/payloads/singles/linux/armbe/meterpreter_reverse_http.rb

@@ -10,7 +10,7 @@
 
 module MetasploitModule
 
-  CachedSize = 645136
+  CachedSize = 668360
 
   include Msf::Payload::Single
   include Msf::Sessions::MeterpreterOptions