e209256d62
ensure we do autoruns for all session types
2017-10-12 23:11:58 -05:00
bf2fb7051a
Fix session compatibility check for post modules
2017-10-12 11:57:11 -05:00
a0abffb6c4
Adding functionality of StagerRetryWait and StagerRetryCount
2017-10-12 22:25:00 +05:30
f556a5f805
Add compatible session types to post module info
2017-10-12 11:41:02 -05:00
374c139d33
Increasing the functionality of the nodejs shell_reverse_tcp payload
2017-10-12 19:05:59 +05:30
294230c455
Land #8509 , add Winsxs bypass for UAC
2017-10-11 16:24:52 -05:00
84fe0847bf
Land #9074 , Add prints and error checking to HTTP CmdStagers
2017-10-11 14:27:52 -05:00
27876a91d3
Add prints and better checking to HTTP CmdStagers
...
Admittedly, this code is more convoluted than it needs to be.
2017-10-11 14:01:56 -05:00
b76c1f3647
remove invalid 'client' object reference in nodejs
...
fix #9063 by removing invalid object reference introduced in PR #8825
2017-10-11 11:09:28 -05:00
31bb0ff068
More typo
2017-10-10 15:29:15 -05:00
88f53352c7
Land #9056 , Check for /etc/issue before reading
2017-10-10 15:05:27 -05:00
35533cd401
Another Typo
2017-10-10 14:01:23 -05:00
2002697be7
Typo
2017-10-10 13:58:41 -05:00
4c164fafb0
WIP: proxy credentials
2017-10-10 13:52:30 -05:00
bf731b4f5e
look before leap issues
2017-10-09 14:27:09 -04:00
7df18e378d
Fix conflicts in PR 8509 by mergeing to master
2017-10-09 10:30:21 -05:00
124a1531f4
Clean up powershell exec string
...
The scriptblock invocation is already coming from Rex, so there's
no need to re-wrap the executed code in more of the same.
2017-10-06 13:19:36 -04:00
0dbfc9d447
WIP: Drop session objects before JSON conversion
...
The session object is not intended to be store in the DB.
There are a ton of subobjects and unneeded data that causes the JSON conversion
to hang or fail with 'stack level too deep' errors.
2017-10-06 11:43:01 -05:00
9afdde2938
Address generation issues with pure PSH payloads
...
Powershell payloads were generating using the :generate method
mixed in from Payload::Windows::Exec which is a binary payload
mixin.
Address the breakage by implementing a generate method which simply
outputs the script code produced by the module with no additional
content prepended or appended.
While here, cleanup the commandline generation for the script being
produced by having Rex do it (this permits changes made in Rex to
benefit all consumers).
As a bonus, drop the IEX invocation since it'll trip up AMSI and
upgrade to the scripblock execution semantic.
Credit for finding this little gem goes to bperry - i dont usually
use the native powershell command shells, and managed to miss this
for a long time. Thanks boss.
Testing:
Local in pry
@bperry: Could you test and ping me back if this is right?
2017-10-06 12:32:52 -04:00
08b62db061
Pass loot contents over the API and write file
2017-10-03 12:31:57 -05:00
e8d0f2dde0
Fix missing message for vprint_* in AuthBrute
2017-09-29 18:51:35 -05:00
49f5256f88
Make session_events retrievable from the API
2017-09-29 16:04:17 -05:00
293d1edeb1
Merge master: 8853193542
2017-09-29 11:06:16 -05:00
ed74c3726f
Proxy session events.
...
This enables modules to use report_loot with a remote data service
2017-09-28 17:03:09 -05:00
f88840e5b7
Move normaliize_host to a library method
...
This method was in Msf::DbManager class but doesn't actually use the DB.
This required you to have a DB connection just to do the check.
Moved it out to a helper library so we have access to it without forcing
a DB connection.
2017-09-28 16:59:44 -05:00
0408979e54
Land #9005 , Remove spurious commas
2017-09-26 15:36:33 -05:00
cad36ee14e
Land #8952 , suhosin compatibility added to staged payload
2017-09-26 15:22:36 -05:00
0b29408aa2
Allow filtering of loot
2017-09-26 13:48:01 -05:00
ec51ab2547
Exit function param bug
2017-09-26 11:16:41 +03:00
d234409d40
Land #8918 , wp_admin_shell_upload multisite fix
2017-09-25 13:54:10 -05:00
d73e95e7db
Land #8946 , fix #8879 , APK injection edge cases
2017-09-23 20:48:12 -04:00
40abbccb03
Merge remote-tracking branch 'rapid7/master' into proxy_loot
2017-09-22 14:10:02 -05:00
62aac450f8
Change confusing variable name
2017-09-22 11:43:26 -05:00
4ea8f639a3
Add host and service reporting to external modules
2017-09-22 11:42:32 -05:00
36fc01d375
check files before opening
2017-09-21 19:36:19 -04:00
812ad9f9cb
loot printing (maybe) working
2017-09-21 15:20:49 -05:00
9f95f88035
Fix a couple of bugs.
2017-09-19 16:35:18 -05:00
765ea01e9f
loot posting working
2017-09-18 15:58:40 -05:00
363d3c28d7
suhosin comaptibility added to staged payload
2017-09-12 08:49:53 +05:30
a58552daad
Land #8825 , Handle missing util.pump in nodejs shell payloads
2017-09-11 15:32:21 -05:00
c3fa30707d
fix #8879 , fix APK injection edge cases
2017-09-11 12:03:20 +08:00
000f561d6f
Added session data export
2017-09-08 11:09:15 -05:00
b9fdca04a1
rework logical fix for #8884 to function with bootstrap code
2017-09-07 01:43:58 -05:00
9877a61eff
bump payloads
2017-09-07 01:36:25 -05:00
7a2a47586b
Fix named pipe migration stubs
2017-09-07 01:36:25 -05:00
4ec87985a2
Fix stager crash and support pivots in x64 meterp loader
2017-09-07 01:36:24 -05:00
c8b8ef03bd
Force max 0x10000 bytes when reading from pipe in stager
2017-09-07 01:36:23 -05:00
7acd772c10
Pivot session stability, display and handling
2017-09-07 01:36:21 -05:00
fdc9864b61
First working packet pivot session!
2017-09-07 01:36:20 -05:00
e3de01219a
Pushed on with more pivot code
2017-09-07 01:33:54 -05:00
Brent Cook