Skip to content

Commit aa0fca9

Browse files
wwebb-r7wwebb-r7
committed
Land rapid7#8631, Add railgun support to Python Meterpreter for the OSX
platform
2 parents 14b37c2 + 52211ab commit aa0fca9

32 files changed

+670
-912
lines changed

‎lib/msf/core/payload/python/meterpreter_loader.rb

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ def initialize(info = {})
2929
))
3030

3131
register_advanced_options([
32+
OptBool.new('MeterpreterTryToFork', [ true, 'Fork a new process if the functionality is available', true ]),
3233
OptBool.new('PythonMeterpreterDebug', [ true, 'Enable debugging for the Python meterpreter', false ])
3334
], self.class)
3435
end
@@ -61,8 +62,11 @@ def stage_meterpreter(opts={})
6162
txt.gsub('\\', '\\'*8).gsub('\'', %q(\\\\\\\'))
6263
}
6364

65+
unless ds['MeterpreterTryToFork']
66+
met.sub!('TRY_TO_FORK = True', 'TRY_TO_FORK = False')
67+
end
6468
if ds['PythonMeterpreterDebug']
65-
met = met.sub("DEBUGGING = False", "DEBUGGING = True")
69+
met.sub!('DEBUGGING = False', 'DEBUGGING = True')
6670
end
6771

6872
met.sub!('SESSION_EXPIRATION_TIMEOUT = 604800', "SESSION_EXPIRATION_TIMEOUT = #{ds['SessionExpirationTimeout']}")

‎lib/msf/core/post/windows/railgun.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ module Windows
77
module Railgun
88

99
# Go through each dll and add a corresponding convenience method of the same name
10-
Rex::Post::Meterpreter::Extensions::Stdapi::Railgun::Railgun::BUILTIN_DLLS['windows'].each do |api|
10+
Rex::Post::Meterpreter::Extensions::Stdapi::Railgun::Railgun::BUILTIN_LIBRARIES['windows'].each do |api|
1111
# We will be interpolating within an eval. We exercise due paranoia.
1212
unless api.to_s =~ /^\w+$/
13-
print_error 'Something is seriously wrong with Railgun.BUILTIN_DLLS list'
13+
print_error 'Something is seriously wrong with Railgun.BUILTIN_LIBRARIES list'
1414
next
1515
end
1616

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/linux/api_constants.rb

Lines changed: 114 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -31,122 +31,122 @@ def self.add_constants(const_mgr)
3131
const_mgr.add_const('PROT_GROWSDOWN', 0x01000000)
3232
const_mgr.add_const('PROT_GROWSUP', 0x02000000)
3333

34-
const_mgr.add_const("PF_UNSPEC", 0x00000000)
35-
const_mgr.add_const("PF_LOCAL", 0x00000001)
36-
const_mgr.add_const("PF_UNIX", 0x00000000)
37-
const_mgr.add_const("PF_FILE", 0x00000000)
38-
const_mgr.add_const("PF_INET", 0x00000002)
39-
const_mgr.add_const("PF_AX25", 0x00000003)
40-
const_mgr.add_const("PF_IPX", 0x00000004)
41-
const_mgr.add_const("PF_APPLETALK", 0x00000005)
42-
const_mgr.add_const("PF_NETROM", 0x00000006)
43-
const_mgr.add_const("PF_BRIDGE", 0x00000007)
44-
const_mgr.add_const("PF_ATMPVC", 0x00000008)
45-
const_mgr.add_const("PF_X25", 0x00000009)
46-
const_mgr.add_const("PF_INET6", 0x0000000a)
47-
const_mgr.add_const("PF_ROSE", 0x0000000b)
48-
const_mgr.add_const("PF_DECnet", 0x0000000c)
49-
const_mgr.add_const("PF_NETBEUI", 0x0000000d)
50-
const_mgr.add_const("PF_SECURITY", 0x0000000e)
51-
const_mgr.add_const("PF_KEY", 0x0000000f)
52-
const_mgr.add_const("PF_NETLINK", 0x00000010)
53-
const_mgr.add_const("PF_ROUTE", 0x00000000)
54-
const_mgr.add_const("PF_PACKET", 0x00000011)
55-
const_mgr.add_const("PF_ASH", 0x00000012)
56-
const_mgr.add_const("PF_ECONET", 0x00000013)
57-
const_mgr.add_const("PF_ATMSVC", 0x00000014)
58-
const_mgr.add_const("PF_RDS", 0x00000015)
59-
const_mgr.add_const("PF_SNA", 0x00000016)
60-
const_mgr.add_const("PF_IRDA", 0x00000017)
61-
const_mgr.add_const("PF_PPPOX", 0x00000018)
62-
const_mgr.add_const("PF_WANPIPE", 0x00000019)
63-
const_mgr.add_const("PF_LLC", 0x0000001a)
64-
const_mgr.add_const("PF_IB", 0x0000001b)
65-
const_mgr.add_const("PF_MPLS", 0x0000001c)
66-
const_mgr.add_const("PF_CAN", 0x0000001d)
67-
const_mgr.add_const("PF_TIPC", 0x0000001e)
68-
const_mgr.add_const("PF_BLUETOOTH", 0x0000001f)
69-
const_mgr.add_const("PF_IUCV", 0x00000020)
70-
const_mgr.add_const("PF_RXRPC", 0x00000021)
71-
const_mgr.add_const("PF_ISDN", 0x00000022)
72-
const_mgr.add_const("PF_PHONET", 0x00000023)
73-
const_mgr.add_const("PF_IEEE802154", 0x00000024)
74-
const_mgr.add_const("PF_CAIF", 0x00000025)
75-
const_mgr.add_const("PF_ALG", 0x00000026)
76-
const_mgr.add_const("PF_NFC", 0x00000027)
77-
const_mgr.add_const("PF_VSOCK", 0x00000028)
78-
const_mgr.add_const("PF_KCM", 0x00000029)
79-
const_mgr.add_const("PF_MAX", 0x0000002a)
34+
const_mgr.add_const('PF_UNSPEC', 0x00000000)
35+
const_mgr.add_const('PF_LOCAL', 0x00000001)
36+
const_mgr.add_const('PF_UNIX', 0x00000000)
37+
const_mgr.add_const('PF_FILE', 0x00000000)
38+
const_mgr.add_const('PF_INET', 0x00000002)
39+
const_mgr.add_const('PF_AX25', 0x00000003)
40+
const_mgr.add_const('PF_IPX', 0x00000004)
41+
const_mgr.add_const('PF_APPLETALK', 0x00000005)
42+
const_mgr.add_const('PF_NETROM', 0x00000006)
43+
const_mgr.add_const('PF_BRIDGE', 0x00000007)
44+
const_mgr.add_const('PF_ATMPVC', 0x00000008)
45+
const_mgr.add_const('PF_X25', 0x00000009)
46+
const_mgr.add_const('PF_INET6', 0x0000000a)
47+
const_mgr.add_const('PF_ROSE', 0x0000000b)
48+
const_mgr.add_const('PF_DECnet', 0x0000000c)
49+
const_mgr.add_const('PF_NETBEUI', 0x0000000d)
50+
const_mgr.add_const('PF_SECURITY', 0x0000000e)
51+
const_mgr.add_const('PF_KEY', 0x0000000f)
52+
const_mgr.add_const('PF_NETLINK', 0x00000010)
53+
const_mgr.add_const('PF_ROUTE', 0x00000000)
54+
const_mgr.add_const('PF_PACKET', 0x00000011)
55+
const_mgr.add_const('PF_ASH', 0x00000012)
56+
const_mgr.add_const('PF_ECONET', 0x00000013)
57+
const_mgr.add_const('PF_ATMSVC', 0x00000014)
58+
const_mgr.add_const('PF_RDS', 0x00000015)
59+
const_mgr.add_const('PF_SNA', 0x00000016)
60+
const_mgr.add_const('PF_IRDA', 0x00000017)
61+
const_mgr.add_const('PF_PPPOX', 0x00000018)
62+
const_mgr.add_const('PF_WANPIPE', 0x00000019)
63+
const_mgr.add_const('PF_LLC', 0x0000001a)
64+
const_mgr.add_const('PF_IB', 0x0000001b)
65+
const_mgr.add_const('PF_MPLS', 0x0000001c)
66+
const_mgr.add_const('PF_CAN', 0x0000001d)
67+
const_mgr.add_const('PF_TIPC', 0x0000001e)
68+
const_mgr.add_const('PF_BLUETOOTH', 0x0000001f)
69+
const_mgr.add_const('PF_IUCV', 0x00000020)
70+
const_mgr.add_const('PF_RXRPC', 0x00000021)
71+
const_mgr.add_const('PF_ISDN', 0x00000022)
72+
const_mgr.add_const('PF_PHONET', 0x00000023)
73+
const_mgr.add_const('PF_IEEE802154', 0x00000024)
74+
const_mgr.add_const('PF_CAIF', 0x00000025)
75+
const_mgr.add_const('PF_ALG', 0x00000026)
76+
const_mgr.add_const('PF_NFC', 0x00000027)
77+
const_mgr.add_const('PF_VSOCK', 0x00000028)
78+
const_mgr.add_const('PF_KCM', 0x00000029)
79+
const_mgr.add_const('PF_MAX', 0x0000002a)
8080

81-
const_mgr.add_const("AF_UNSPEC", 0x00000000)
82-
const_mgr.add_const("AF_LOCAL", 0x00000001)
83-
const_mgr.add_const("AF_UNIX", 0x00000000)
84-
const_mgr.add_const("AF_FILE", 0x00000000)
85-
const_mgr.add_const("AF_INET", 0x00000002)
86-
const_mgr.add_const("AF_AX25", 0x00000003)
87-
const_mgr.add_const("AF_IPX", 0x00000004)
88-
const_mgr.add_const("AF_APPLETALK", 0x00000005)
89-
const_mgr.add_const("AF_NETROM", 0x00000006)
90-
const_mgr.add_const("AF_BRIDGE", 0x00000007)
91-
const_mgr.add_const("AF_ATMPVC", 0x00000008)
92-
const_mgr.add_const("AF_X25", 0x00000009)
93-
const_mgr.add_const("AF_INET6", 0x0000000a)
94-
const_mgr.add_const("AF_ROSE", 0x0000000b)
95-
const_mgr.add_const("AF_DECnet", 0x0000000c)
96-
const_mgr.add_const("AF_NETBEUI", 0x0000000d)
97-
const_mgr.add_const("AF_SECURITY", 0x0000000e)
98-
const_mgr.add_const("AF_KEY", 0x0000000f)
99-
const_mgr.add_const("AF_NETLINK", 0x00000010)
100-
const_mgr.add_const("AF_ROUTE", 0x00000000)
101-
const_mgr.add_const("AF_PACKET", 0x00000011)
102-
const_mgr.add_const("AF_ASH", 0x00000012)
103-
const_mgr.add_const("AF_ECONET", 0x00000013)
104-
const_mgr.add_const("AF_ATMSVC", 0x00000014)
105-
const_mgr.add_const("AF_RDS", 0x00000015)
106-
const_mgr.add_const("AF_SNA", 0x00000016)
107-
const_mgr.add_const("AF_IRDA", 0x00000017)
108-
const_mgr.add_const("AF_PPPOX", 0x00000018)
109-
const_mgr.add_const("AF_WANPIPE", 0x00000019)
110-
const_mgr.add_const("AF_LLC", 0x0000001a)
111-
const_mgr.add_const("AF_IB", 0x0000001b)
112-
const_mgr.add_const("AF_MPLS", 0x0000001c)
113-
const_mgr.add_const("AF_CAN", 0x0000001d)
114-
const_mgr.add_const("AF_TIPC", 0x0000001e)
115-
const_mgr.add_const("AF_BLUETOOTH", 0x0000001f)
116-
const_mgr.add_const("AF_IUCV", 0x00000020)
117-
const_mgr.add_const("AF_RXRPC", 0x00000021)
118-
const_mgr.add_const("AF_ISDN", 0x00000022)
119-
const_mgr.add_const("AF_PHONET", 0x00000023)
120-
const_mgr.add_const("AF_IEEE802154", 0x00000024)
121-
const_mgr.add_const("AF_CAIF", 0x00000025)
122-
const_mgr.add_const("AF_ALG", 0x00000026)
123-
const_mgr.add_const("AF_NFC", 0x00000027)
124-
const_mgr.add_const("AF_VSOCK", 0x00000028)
125-
const_mgr.add_const("AF_KCM", 0x00000029)
126-
const_mgr.add_const("AF_MAX", 0x0000002a)
81+
const_mgr.add_const('AF_UNSPEC', 0x00000000)
82+
const_mgr.add_const('AF_LOCAL', 0x00000001)
83+
const_mgr.add_const('AF_UNIX', 0x00000000)
84+
const_mgr.add_const('AF_FILE', 0x00000000)
85+
const_mgr.add_const('AF_INET', 0x00000002)
86+
const_mgr.add_const('AF_AX25', 0x00000003)
87+
const_mgr.add_const('AF_IPX', 0x00000004)
88+
const_mgr.add_const('AF_APPLETALK', 0x00000005)
89+
const_mgr.add_const('AF_NETROM', 0x00000006)
90+
const_mgr.add_const('AF_BRIDGE', 0x00000007)
91+
const_mgr.add_const('AF_ATMPVC', 0x00000008)
92+
const_mgr.add_const('AF_X25', 0x00000009)
93+
const_mgr.add_const('AF_INET6', 0x0000000a)
94+
const_mgr.add_const('AF_ROSE', 0x0000000b)
95+
const_mgr.add_const('AF_DECnet', 0x0000000c)
96+
const_mgr.add_const('AF_NETBEUI', 0x0000000d)
97+
const_mgr.add_const('AF_SECURITY', 0x0000000e)
98+
const_mgr.add_const('AF_KEY', 0x0000000f)
99+
const_mgr.add_const('AF_NETLINK', 0x00000010)
100+
const_mgr.add_const('AF_ROUTE', 0x00000000)
101+
const_mgr.add_const('AF_PACKET', 0x00000011)
102+
const_mgr.add_const('AF_ASH', 0x00000012)
103+
const_mgr.add_const('AF_ECONET', 0x00000013)
104+
const_mgr.add_const('AF_ATMSVC', 0x00000014)
105+
const_mgr.add_const('AF_RDS', 0x00000015)
106+
const_mgr.add_const('AF_SNA', 0x00000016)
107+
const_mgr.add_const('AF_IRDA', 0x00000017)
108+
const_mgr.add_const('AF_PPPOX', 0x00000018)
109+
const_mgr.add_const('AF_WANPIPE', 0x00000019)
110+
const_mgr.add_const('AF_LLC', 0x0000001a)
111+
const_mgr.add_const('AF_IB', 0x0000001b)
112+
const_mgr.add_const('AF_MPLS', 0x0000001c)
113+
const_mgr.add_const('AF_CAN', 0x0000001d)
114+
const_mgr.add_const('AF_TIPC', 0x0000001e)
115+
const_mgr.add_const('AF_BLUETOOTH', 0x0000001f)
116+
const_mgr.add_const('AF_IUCV', 0x00000020)
117+
const_mgr.add_const('AF_RXRPC', 0x00000021)
118+
const_mgr.add_const('AF_ISDN', 0x00000022)
119+
const_mgr.add_const('AF_PHONET', 0x00000023)
120+
const_mgr.add_const('AF_IEEE802154', 0x00000024)
121+
const_mgr.add_const('AF_CAIF', 0x00000025)
122+
const_mgr.add_const('AF_ALG', 0x00000026)
123+
const_mgr.add_const('AF_NFC', 0x00000027)
124+
const_mgr.add_const('AF_VSOCK', 0x00000028)
125+
const_mgr.add_const('AF_KCM', 0x00000029)
126+
const_mgr.add_const('AF_MAX', 0x0000002a)
127127

128-
const_mgr.add_const("SOL_RAW", 0x000000ff)
129-
const_mgr.add_const("SOL_DECNET", 0x00000105)
130-
const_mgr.add_const("SOL_X25", 0x00000106)
131-
const_mgr.add_const("SOL_PACKET", 0x00000107)
132-
const_mgr.add_const("SOL_ATM", 0x00000108)
133-
const_mgr.add_const("SOL_AAL", 0x00000109)
134-
const_mgr.add_const("SOL_IRDA", 0x0000010a)
135-
const_mgr.add_const("SOL_NETBEUI", 0x0000010b)
136-
const_mgr.add_const("SOL_LLC", 0x0000010c)
137-
const_mgr.add_const("SOL_DCCP", 0x0000010d)
138-
const_mgr.add_const("SOL_NETLINK", 0x0000010e)
139-
const_mgr.add_const("SOL_TIPC", 0x0000010f)
140-
const_mgr.add_const("SOL_RXRPC", 0x00000110)
141-
const_mgr.add_const("SOL_PPPOL2TP", 0x00000111)
142-
const_mgr.add_const("SOL_BLUETOOTH", 0x00000112)
143-
const_mgr.add_const("SOL_PNPIPE", 0x00000113)
144-
const_mgr.add_const("SOL_RDS", 0x00000114)
145-
const_mgr.add_const("SOL_IUCV", 0x00000115)
146-
const_mgr.add_const("SOL_CAIF", 0x00000116)
147-
const_mgr.add_const("SOL_ALG", 0x00000117)
148-
const_mgr.add_const("SOL_NFC", 0x00000118)
149-
const_mgr.add_const("SOL_KCM", 0x00000119)
128+
const_mgr.add_const('SOL_RAW', 0x000000ff)
129+
const_mgr.add_const('SOL_DECNET', 0x00000105)
130+
const_mgr.add_const('SOL_X25', 0x00000106)
131+
const_mgr.add_const('SOL_PACKET', 0x00000107)
132+
const_mgr.add_const('SOL_ATM', 0x00000108)
133+
const_mgr.add_const('SOL_AAL', 0x00000109)
134+
const_mgr.add_const('SOL_IRDA', 0x0000010a)
135+
const_mgr.add_const('SOL_NETBEUI', 0x0000010b)
136+
const_mgr.add_const('SOL_LLC', 0x0000010c)
137+
const_mgr.add_const('SOL_DCCP', 0x0000010d)
138+
const_mgr.add_const('SOL_NETLINK', 0x0000010e)
139+
const_mgr.add_const('SOL_TIPC', 0x0000010f)
140+
const_mgr.add_const('SOL_RXRPC', 0x00000110)
141+
const_mgr.add_const('SOL_PPPOL2TP', 0x00000111)
142+
const_mgr.add_const('SOL_BLUETOOTH', 0x00000112)
143+
const_mgr.add_const('SOL_PNPIPE', 0x00000113)
144+
const_mgr.add_const('SOL_RDS', 0x00000114)
145+
const_mgr.add_const('SOL_IUCV', 0x00000115)
146+
const_mgr.add_const('SOL_CAIF', 0x00000116)
147+
const_mgr.add_const('SOL_ALG', 0x00000117)
148+
const_mgr.add_const('SOL_NFC', 0x00000118)
149+
const_mgr.add_const('SOL_KCM', 0x00000119)
150150
end
151151
end
152152

‎lib/rex/post/meterpreter/extensions/stdapi/railgun/def/linux/def_libc.rb

Lines changed: 24 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,12 @@ module Stdapi
77
module Railgun
88
module Def
99

10-
class Def_libc
10+
class Def_linux_libc
1111

12-
def self.create_dll(constant_manager, dll_path = 'libc.so.6')
13-
dll = DLL.new(dll_path, constant_manager)
12+
def self.create_library(constant_manager, library_path = 'libc.so.6')
13+
lib = Library.new(library_path, constant_manager)
1414

15-
dll.add_function(
15+
lib.add_function(
1616
'calloc',
1717
'LPVOID',
1818
[
@@ -22,7 +22,7 @@ def self.create_dll(constant_manager, dll_path = 'libc.so.6')
2222
nil,
2323
'cdecl'
2424
)
25-
dll.add_function(
25+
lib.add_function(
2626
'free',
2727
'VOID',
2828
[
@@ -31,14 +31,14 @@ def self.create_dll(constant_manager, dll_path = 'libc.so.6')
3131
nil,
3232
'cdecl',
3333
)
34-
dll.add_function(
34+
lib.add_function(
3535
'getpid',
3636
'DWORD',
3737
[],
3838
nil,
3939
'cdecl'
4040
)
41-
dll.add_function(
41+
lib.add_function(
4242
'inet_ntop',
4343
'LPVOID',
4444
[
@@ -50,7 +50,7 @@ def self.create_dll(constant_manager, dll_path = 'libc.so.6')
5050
nil,
5151
'cdecl'
5252
)
53-
dll.add_function(
53+
lib.add_function(
5454
'inet_pton',
5555
'DWORD',
5656
[
@@ -61,14 +61,14 @@ def self.create_dll(constant_manager, dll_path = 'libc.so.6')
6161
nil,
6262
'cdecl'
6363
)
64-
dll.add_function(
64+
lib.add_function(
6565
'malloc',
6666
'LPVOID',
6767
[['SIZE_T', 'size', 'in']],
6868
nil,
6969
'cdecl'
7070
)
71-
dll.add_function(
71+
lib.add_function(
7272
'memfrob',
7373
'LPVOID',
7474
[
@@ -78,7 +78,7 @@ def self.create_dll(constant_manager, dll_path = 'libc.so.6')
7878
nil,
7979
'cdecl'
8080
)
81-
dll.add_function(
81+
lib.add_function(
8282
'mmap',
8383
'LPVOID',
8484
[
@@ -92,7 +92,7 @@ def self.create_dll(constant_manager, dll_path = 'libc.so.6')
9292
nil,
9393
'cdecl'
9494
)
95-
dll.add_function(
95+
lib.add_function(
9696
'mprotect',
9797
'DWORD',
9898
[
@@ -103,7 +103,7 @@ def self.create_dll(constant_manager, dll_path = 'libc.so.6')
103103
nil,
104104
'cdecl'
105105
)
106-
dll.add_function(
106+
lib.add_function(
107107
'munmap',
108108
'DWORD',
109109
[
@@ -113,7 +113,17 @@ def self.create_dll(constant_manager, dll_path = 'libc.so.6')
113113
nil,
114114
'cdecl'
115115
)
116-
return dll
116+
lib.add_function(
117+
'strcat',
118+
'LPVOID',
119+
[
120+
['PCHAR', 'to', 'inout'],
121+
['PCHAR', 'from', 'in']
122+
],
123+
nil,
124+
'cdecl'
125+
)
126+
return lib
117127
end
118128

119129
end

0 commit comments

Comments
 (0)