Commit Graph

7956 Commits

Author SHA1 Message Date
OJ bdfaaf01b2 Make multi work with https 2016-11-29 15:51:38 +10:00
OJ bd8f8fd6cb More rework of payload structure to handle multi arch handlers 2016-11-29 15:21:13 +10:00
OJ beca63645e Revamp of java payload structure 2016-11-29 11:54:30 +10:00
OJ e8d7a074fa Tweak to stageless handling for python payloads 2016-11-29 07:54:51 +10:00
OJ 5e8a47ac00 Merge upstream/master into universal handler work 2016-11-28 15:26:43 +10:00
OJ 496836fc06 Remove debug junk, rejig order of ops in initializer 2016-11-28 15:25:07 +10:00
OJ e8158bd200 Add multi platform type, wire into the multi stage 2016-11-28 09:34:09 +10:00
OJ 5fdd5a7326 More progress on http universal staged handler 2016-11-25 13:00:35 +10:00
Jin Qian 9f4784354a Disconnect after making the HTTP transaction in send_request_cgi
Add a disconnect call after cgi is done.
2016-11-23 11:20:10 -06:00
James Lee b45a36180e Don't complain when Proxies is an empty string 2016-11-22 09:29:04 -06:00
OJ c606eabbb9 Merge 'upstream/master' into universal-handlers 2016-11-22 14:06:46 +10:00
wchen-r7 b2cc8e2b95 Fix #7569, Fix warbird check for missing text section
Fix #7569
2016-11-21 14:57:01 -06:00
Tim daae46d37b Fixes #7552, fix apk injection into proguarded apks 2016-11-21 15:05:59 +08:00
Brent Cook f313389be4 Merge remote-tracking branch 'upstream/master' into land-7507-uuid-arch 2016-11-20 19:08:56 -06:00
h00die cd01b07682 Land #7565
Lands print_bad and vprint_bad from todb-r7
2016-11-18 13:29:39 -05:00
Tim 66ba2b077b Land #7567, fix apk injection when template has no permissions 2016-11-17 11:42:54 +00:00
Brian Yip 927e195e28 Generate payload apk from permissionless apk 2016-11-16 00:48:10 -04:00
Tod Beardsley 1deacad2be Add a print_bad alias for print_error
Came up on Twitter, where Justin may have been trolling a little:

https://twitter.com/jstnkndy/status/798671298302017536

We have a `print_good` method, but not a `print_bad`, which seems a
little weird for Ruby -- opposite methods should be intuitive as Justin
is implying.

Anyway, I went with alias_method, thanks to the compelling argument at

https://github.com/bbatsov/ruby-style-guide#alias-method

...since Metasploit is all about the singleton, and didn't want to risk
some unexpected scoping thing.

Also dang, we define the `print_` methods like fifty billion times!
Really should fix that some day.
2016-11-15 19:20:42 -06:00
Brendan 7e4645afb3 Land #7527, Add LURI support to the reverse_http/s stagers 2016-11-15 16:31:20 -06:00
dana-at-cp c0e839dfd9 Fixes keytool bug in APK inject code 2016-11-11 06:12:47 -08:00
OJ 50c2ed8509 Fix post mixin platform/session check 2016-11-05 02:41:52 +10:00
OJ b0970783ff Another interim commit moving towards universal handlers 2016-11-04 13:25:02 +10:00
OJ 47ac122c15 Add LURI support to the reverse_http/s stagers 2016-11-03 14:51:07 +10:00
OJ 09d9733a75 Interim commit while working on multi payloads 2016-11-03 06:44:39 +10:00
OJ cc8c1adc00 Add first pass of multi x86 http/s payload (not working yet) 2016-11-03 02:44:53 +10:00
OJ 494b4e67bd Refactor http/s handler & payloads
This commit moves much of the platform-specific logic from the
reverse_http handler down into the payloads. This makes the handler
a bit more agnostic of what the payload is (which is a good thing).
There is more to do here though, and things can be improved.

Handling of datastore settings has been changed to make room for the
ability to override the datastore completely when generating the
payloads. If a datastore is given via the `opts` then this is used
instead otherwise it falls back to the settings specified in the usual
datatstore location.

Down the track, we'll have a payload that supports multiple stages, and
the datastore will be generated on the fly, along with the stage itself.
Without this work, there's no other nice way of getting datastore
settings to be contained per-stager.
2016-11-02 11:33:59 +10:00
OJ 0fca4483c0 Correctly call generate_stage on native init 2016-11-02 00:52:25 +10:00
Brent Cook f08a7ac10b modernize default smtp_deliver TLS options 2016-11-01 05:42:05 -05:00
OJ 294b1e5ed7 Move session_type to base, and map shell arch to string 2016-11-01 03:02:23 +10:00
OJ ddd2d5e43f Remove junk spaces from EXE exploit module 2016-11-01 01:28:21 +10:00
OJ 0730613c67 Add comment to hilight need to support ARCH_CMD in sess check 2016-10-29 14:29:05 +10:00
OJ 8605992cdf Remove superfluous session check in the post mixin 2016-10-29 14:19:27 +10:00
OJ e5d3feebea Final regex fix for jobs arch check 2016-10-29 14:10:01 +10:00
OJ 57eabda5dc Merge upstream/master 2016-10-29 13:54:31 +10:00
OJ 8b97183924 Update UUID to match detected platform, fail exploit on invalid session 2016-10-29 13:45:28 +10:00
OJ 0737d7ca12 Tidy code, remove regex and use comparison for platform checks 2016-10-29 13:41:20 +10:00
OJ 1d617ae389 Implement first pass of architecture/platform refactor 2016-10-28 07:16:05 +10:00
OJ ca377cadd7 Move the binary suffix stuff to a better location 2016-10-27 07:43:27 +10:00
Sonny Gonzalez 5ce886cf5c Land #7490, xml importer fingerprinting fixed 2016-10-25 14:13:15 -05:00
Louis Sato 56d5c49d4d host was no associated with the workspace
* searching mdm host by wspace id instead
2016-10-25 12:05:06 -05:00
Louis Sato 1378e2e61a preserve hosts should still fingerprint new hosts 2016-10-25 09:58:30 -05:00
Louis Sato 744724c083 conditionalize fingerprinting
* fix bug where host not preserved
2016-10-24 18:45:48 -05:00
Jon Hart 12508f7140 Fix DRDoS mixin to handle empty responses 2016-10-24 14:21:28 -07:00
Adam Cammack 39b889ea29 Land #7459, Delay fingerprinting during import 2016-10-24 10:47:25 -05:00
Tim ce1f3e6b9e Land #7451, copy original signing certificate when backdooring APK 2016-10-22 18:04:22 +08:00
David Maloney 6b77f509ba fixes bad file refs for cmdstagers
when moving to the rex-exploitation gem some of the
file references were missed, partially due to silly differences
between how each file was referenced

Fixes #7466
2016-10-21 12:31:18 -05:00
David Maloney de87fccf85 Land #7469, OJ's php preamble fix
this is OJ's fix for the bind_php payload
preamble that causes it to be missing the php
tags
2016-10-21 12:05:39 -05:00
dana-at-cp b8e30a241e Copy original cert data into new signing cert created for APK injection 2016-10-20 08:43:45 -07:00
Louis Sato f18cbd655e delay fingerprinting of host
MS-2073

 * imports are slow mainly caused by fingerprinting after every service creation
 * now only fingerprints after all the services are created for imports
2016-10-18 17:42:48 -05:00
William Vu ebf52759cc Land #7449, unsuitable language fix 2016-10-16 03:23:05 -05:00