Commit Graph

16492 Commits

Author SHA1 Message Date
BAZIN-HSC 070a156925 -Recovrey +Recovery 2015-11-27 13:58:19 +01:00
Jon Cave 0c8eb6fb37 Display ReverseListenerBindPort if it is set
ReverseListenerBindPort overrides LPORT if it is used. The `listener_uri`
method should use the output `bind_port` to account for this.
2015-11-27 09:16:20 +00:00
wchen-r7 c888726a1a Fix #6287, check DisablePayloadHandler value in exploit.rb
It looks active_module datastore options are always strings. They
are actually different than what the module uses (normalized), so
we have to always have to check it.
2015-11-26 18:30:31 -06:00
Brent Cook e5119e6446 use payload_uri's result to derive lhost / lport 2015-11-26 15:21:51 -06:00
Brent Cook 216119c05c unfold override lhost/lport logic 2015-11-26 15:15:21 -06:00
Spencer McIntyre 1b495e73ac Further reduce python reverse_http duplicate code 2015-11-26 14:31:00 -05:00
Spencer McIntyre bd25ffa48c Consolidate py reverse http uri code into a mixin 2015-11-26 13:32:50 -05:00
Brent Cook f4d35116bd land #6288, fix regression using non-default port with reverse_http 2015-11-26 11:04:24 -06:00
Brent Cook eb57163db6 Land #6285, excellent new sound plugin scheme 2015-11-26 10:41:02 -06:00
Jon Cave d9655fc882 Use LPORT if opts[:lport] is undefined
`nil.to_i` returns 0 which will short circuit the || resulting in port 0
being used. nil should be checked for prior to casting to int.
2015-11-26 16:08:22 +00:00
OJ 87507e19a9 Change job view to show bind port if applicable 2015-11-26 16:18:00 +10:00
wchen-r7 776455d10a Add another sound and event
Add sound: "We've got a shell"
Add event on_session_fail
2015-11-25 22:46:51 -06:00
Brent Cook a7a89adfac Land #6264, meterpreter per-extension init string support, update payloads to 1.0.17
This brings in the following changes:
	Changes to support maven 3.3+
	Don't fall back to 0.0.0.0
	Remove all debug builds from the Windows projects
	Add show_mount, ps_list, and some core tweaks
	Refactor TLV layout, add more debug output, token stealing
	Add incognito binding, code tidies
	Update packaged libs
	Add transport list binding
	Add transport add command to python binding
	Update python core lib archive
	change source perms back to non-executable
	First pass of stageless initialisation script
	Finalise stageless initialisation scripts
	add BOOT_COMPLETED receiver that starts the Payload
	Improve the implementation of the getuid command
	Switch to Utils.runCommand per timwr's suggestion
	Updated init script method

also bumps msgpack 0.7.1, which fixes a failure packing messages > 256k
2015-11-25 22:27:27 -06:00
Kyle Gray 8923252de7 Land #6259, NoMethodError in vim_soap.rb fix
We haven't been able to get the XML data that would cause the error, all we have is a backtrace. So "verification" is purely code reading. Thanks @wchen-r7

Fixes #6085

Merge remote-tracking branch 'origin/pr/6259'
2015-11-24 17:33:35 -06:00
wchen-r7 b1abfe898d Update wordpress_xmlrpc_login
Replace the wordpress_xmlrpc_login code with
wordpress_xmlrpc_massive_bruteforce.rb, which should run a lot
faster.
2015-11-24 16:30:34 -06:00
James Lee bd9ebeea53 Land #5851, meterpreter dispatcher queue 2015-11-24 15:32:15 -06:00
Brent Cook 7ad8adf67f Land #6240, change default SMBDomain to '.' 2015-11-24 12:58:46 -06:00
Louis Sato 5303079ba4 Land #6262, local exploit add not implemented error 2015-11-23 14:23:13 -06:00
Brent Cook 5654b6b2e2 Land #6227, reverse_hop_http updates and HTTPS unification 2015-11-23 06:29:15 -06:00
Brent Cook 25f2241aa3 Land #6246, show the user errors from create_session 2015-11-23 06:01:08 -06:00
HD Moore 353cad2cc6 Update to match active & github account merge 2015-11-22 13:38:26 -06:00
HD Moore b9e176cd77 Fix up cell result parsing 2015-11-21 11:15:00 -06:00
Jon Cave c03ff13377 Don't wait if the response has already been set
Fixes a race condition which could leave the waiter sitting indefinitely
if notify() is called before wait().
2015-11-21 14:21:42 +00:00
Jon Cave 12b24fecee Return true/false if a waiter was/wasn't notified
The method is used as follows:

  if notify_response_waiter(response)
    # Proceed as if a waiter was notified
  end

Previously the return value would be `nil` whenever the loop broke early
due to a waiter being found. This meant that the dispatcher thread often
believed that a packet was not being handled. As a result the
backlog == incomplete sleep kicked in unnecessarily.
2015-11-21 14:20:51 +00:00
Jon Cave 6509696eb1 Switch back to Mutex/CV for response waiters
Makes use of the wait() method's timeout parameter instead of using the
Timeout class.
2015-11-21 14:20:51 +00:00
Jon Cave 640a302b78 Switch to a Queue for the dispatcher's packet queue
The select() based sleep can be replaced by a blocking pop(). The thread
will be suspended until data is pushed onto the queue.
2015-11-21 14:20:51 +00:00
wchen-r7 b636aeb303 rm print_warning 2015-11-20 19:38:33 -06:00
Jon Hart 07767cd803 Fix #6265 2015-11-20 15:17:15 -08:00
HD Moore 99a74fd4d2 Merge branch 'master' into feature/interval-collect-geo 2015-11-20 14:06:22 -06:00
BAZIN-HSC 5592e4e4ea seek_relative suppression (use seek instead) 2015-11-20 18:30:51 +01:00
BAZIN-HSC f49d6905a6 Fix comments by @jhart-r7 2015-11-20 18:30:50 +01:00
BAZIN-HSC c8847182d7 Add module to dump Bitlocker master key (FVEK) 2015-11-20 18:30:48 +01:00
wchen-r7 d405f31c35 Add a NotImplementedError if run is used to run a local exploit
Running a local exploit like a post is not currently supported,
we should at least raise a warning or something, and not just
let it backtrace and confuse the user.
2015-11-19 14:31:31 -06:00
wchen-r7 d6921fa133 Add Atlassian HipChat for Jira Plugin Velocity Template Injection
CVE-2015-5603

Also fixes a bug in response.rb (Fix #6254)
2015-11-18 11:34:25 -06:00
Jon Hart 089a006408 Land #6248 2015-11-17 14:28:55 -08:00
wchen-r7 f6fdabfd77 Land #6239, added Session info display to module output
MS-706
2015-11-16 18:10:58 -06:00
Dev Mohanty ce62984e52 Fix #6079, Check nil when using read_exactly_n_bytes 2015-11-16 18:06:49 -06:00
wchen-r7 038d367d58 Fix #6247, Update Meterpreter Usage on "Interact"
The "interact" command does not actually exist. Instead, users
should do "channel -i" to interact with a channel.

Fix #6247
2015-11-16 17:58:39 -06:00
wchen-r7 a78fa7c3d9 Fix #4273, print error in create_session
Fix #4273
2015-11-16 17:17:20 -06:00
William Vu 24c41c9261 Land #6225, wall(1)/write(1) post module 2015-11-16 12:47:35 -06:00
David Maloney 708cbe9479 change the default SMBDomain to .
Due to a recent change using WORKGROUP
as the SMBDomain causes Trust errors.
Using '.' instead works fine.
2015-11-16 12:20:27 -06:00
David Maloney a1ab8f1dc7 added Session info display to module output
output from the mssql_local_auth_bypass module
is now prefixed with the Session id and address
of the target host so it is explicitly clear
where it is performing each action

MS-706
2015-11-16 12:13:26 -06:00
PsychoMario 2b99969f9a quote paths to allow spaces 2015-11-15 00:14:30 +00:00
PsychoMario e3f25fd6e2 Add support for specifying path, file in bourne dropper 2015-11-14 18:31:11 +00:00
scriptjunkie 06a5b5b0bd Land #6234, Host header transport 2015-11-14 11:35:47 -06:00
Jon Hart 4a707b33a2 Add rspec coverage for cowsay. Achievement unlocked 2015-11-13 10:26:47 -08:00
Jon Hart 4604f8cd83 Move cowsay to Rex::Text so that everyone can enjoy it ;) 2015-11-13 08:57:48 -08:00
sammbertram cd4aa28d11 Transport priority changes
Pass in the "lhost" and "lport" options to the default transport during the native payload. This takes the following LHOST priorities:
1. OverrideLHOST, only if OverrideRequestHost is TRUE
2. The request Host: header.
3. The LHOST datastore.
2015-11-13 13:21:46 +00:00
sammbertram 9d9865150b Transport priority changes
Default transport request should set the priority to the Host: request header, and the subsequent OverrideRequestHost, OverrideLHOST, and OverrideLPORT options in the handler for reverse_http(s).
2015-11-13 13:19:01 +00:00
wchen-r7 0e121df69d Need a default template
The set_template_default actually needs the second argument,
otherwise we hit a RuntimeError.
2015-11-12 15:17:03 -06:00