adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
25,302 Commits 27 Branches 1,043 Tags
cecdcef2e21426b158980cca3a2fd39b66534708
Commit Graph

53 Commits

Author SHA1 Message Date
HD Moore d6a263d538 Identify the hung host in the thread info 2014-06-22 16:01:03 -05:00
HD Moore b3d83720ca Add ReverseListenerThreaded option to prevent deadlocks 
JodaZ reported that the handle_connection() sock.put call can
result in the entire reverse_tcp stager hanging if the client
stops receiving or is on a very slow link. The solution emulates
what ReverseTcpDouble already does, which is stage each connection
in a new thread. However, given that a high number of threads
can be a problem on some operating systems (*ahem* win32) this
option is not enabled by default.

We should look into thread pooling and handle_connection() timeouts
as well as event-based polling of multiple clients as alternatives,
but this option will improve the situation for our existing users.
 2014-06-22 15:55:20 -05:00
Niel Nielsen 73e359ede1 Update reverse_tcp.rb 
Change to OpenSSL::Digest from deprecated OpenSSL::Digest::Digest
 2014-01-07 22:06:11 +01:00
OJ 12810580d6 Remove arg for bind port/addr functions 
Done to avoid masking of datastore instance variable.
 2013-11-05 06:56:21 +10:00
OJ 58cd2c796e Add a bind port setting to reverse listeners 
This adds a `ReverseListenerBindPort` advanced setting to the reverse listeners whic
allows for the local bind port to be separated from the `LHOST` setting used in the
payload. This means that listeners can bind to different ports in cases where the
attacker isn't able to listen on the same port that the victim can call out on, but
there are NATs/portforwards/whatever in place that allow the connection to happen.
 2013-09-28 05:38:39 +10:00
Tab Assassin 7e5e0f7fc8 Retab lib 2013-08-30 16:28:33 -05:00
James Lee db676f1a88 Whitespace at EOL 2013-03-07 18:20:08 -06:00
m m 36d27242c7 allow reverse tcp with proxies 2012-07-09 23:05:09 +02:00
HD Moore d656e3185f Mark all libraries as defaulting to 8-bit strings 2012-06-29 00:18:28 -05:00
Michael Schierl 34ecc7fd18 Adding @schierlm 's AES encryption for Java 
Tested with and without AES, works as advertised. Set an AESPassword,
get encryptification. Score.

Squashed commit of the following:

commit cca6c5c36c
Author: Michael Schierl <schierlm@gmx.de>
Date:   Wed Apr 4 00:45:24 2012 +0200

    Do not break other architectures
    even when using `setg AESPassword`

commit 422d1e341b
Author: Michael Schierl <schierlm@gmx.de>
Date:   Tue Apr 3 21:50:42 2012 +0200

    binaries

commit 27368b5675
Author: Michael Schierl <schierlm@gmx.de>
Date:   Tue Apr 3 21:49:10 2012 +0200

    Add AES support to Java stager

    This is compatible to the AES mode of the JavaPayload project.

    I'm pretty sure the way I did it in the handlers (Rex::Socket::tcp_socket_pair())
    is not the supposed way, but it works :-)
 2012-06-11 16:13:25 -05:00
James Lee bf105f48cb massive removal of spaces at EOL and some bad tabs 2011-11-20 12:32:06 +11:00
James Lee d1e2f274f9 add ability to use arbitrary certs with SSL server sockets. 
git-svn-id: file:///home/svn/framework3/trunk@12675 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-20 23:12:35 +00:00
HD Moore 9ce47c01bd Reverting the autoload changes until we can upgrade to a new ActiveSupport library or find a workaround 
git-svn-id: file:///home/svn/framework3/trunk@12600 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-12 20:03:55 +00:00
James Lee 06779bc8c0 remove unnecessary requires for stuff in rex. autoload and a high-level require 'rex' in lib/msf/core.rb should take care of everything. see #4371, #4373, r12587, and r12554. 
git-svn-id: file:///home/svn/framework3/trunk@12588 4d416f70-5f16-0410-b530-b9f4589650da
 2011-05-12 00:53:33 +00:00
HD Moore 2c3e85af05 Major cleanups to the session manager, serialized processing of incoming connections, concurrent processing (up to a max scheduler thread count) of meterpreter initialization/scripts. This is to avoid a potential deadlock in openssl and ensure consistent, reliable session staging. This commit also fixes a bug that would mark database sessions as closed too early. 
git-svn-id: file:///home/svn/framework3/trunk@12485 4d416f70-5f16-0410-b530-b9f4589650da
 2011-04-30 18:51:50 +00:00
HD Moore c28ad8ea0c Minor improvements and corner case bug fixes to session handling. This fixes issues that can come up when a stream is shut down 
git-svn-id: file:///home/svn/framework3/trunk@11371 4d416f70-5f16-0410-b530-b9f4589650da
 2010-12-18 03:00:26 +00:00
HD Moore a12d9f8dbf This patch adds detailed thread tracking across the metasploit framework, along with a new console command (threads) to manage these. This level of tracking is required to accurately monitor background tasks, assist with debugging, and kill orphaned threads. 
git-svn-id: file:///home/svn/framework3/trunk@11003 4d416f70-5f16-0410-b530-b9f4589650da
 2010-11-12 06:19:49 +00:00
HD Moore 2e9138ebbc This commit overhauls much of the meterpreter timeouts and staging processes. This fixes a bug with concurrent session handling, reduces CPU load by caching a single SSL certificate for all sessions, increases all of the critical timeouts, and generally makes mass ownage work better. We still need to limit the maximum number of concurrent on_session() threads to something sane to prevent sesssion spikes from dragging out the process even longer. The C-side meterpreter change is minimal and will only help with future compatibility if we move to non-blocking fd's for the SSL socket. 
git-svn-id: file:///home/svn/framework3/trunk@10595 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-08 04:11:47 +00:00
HD Moore 1b4190df38 This commit brings configurability to TCP Servers as to which Comm they use. The ReverseListenerComm and ListenerComm advanced options can be used to prevent a given listener from trying to bind a listener over the pivoted routed. This is useful for a number of situations and not possible to configure explicitly before. 
git-svn-id: file:///home/svn/framework3/trunk@10534 4d416f70-5f16-0410-b530-b9f4589650da
 2010-10-04 02:11:22 +00:00
HD Moore faf58c2b62 Allows 0.0.0.0/::0 to be used in place of the real "any" address regardless of socket type when the bind address is specified 
git-svn-id: file:///home/svn/framework3/trunk@10473 4d416f70-5f16-0410-b530-b9f4589650da
 2010-09-25 03:28:19 +00:00
HD Moore 3b31f56894 This commit adds a new option to all reverse handlers: ReverseListenerBindAddress. This setting determines exactly what address is bound on the local system 
git-svn-id: file:///home/svn/framework3/trunk@10472 4d416f70-5f16-0410-b530-b9f4589650da
 2010-09-25 03:25:09 +00:00
Stephen Fewer fd2469db24 Commit the Ruby end for TCP server channels, the modified TCP client channels and the support for pivoting a reverse_tcp meterpreter. 
git-svn-id: file:///home/svn/framework3/trunk@8384 4d416f70-5f16-0410-b530-b9f4589650da
 2010-02-06 17:59:25 +00:00
James Lee 7e177962bf tell the user what port we're listening on 
git-svn-id: file:///home/svn/framework3/trunk@7452 4d416f70-5f16-0410-b530-b9f4589650da
 2009-11-10 17:39:51 +00:00
HD Moore 00b2915554 Fixes #342. Set ReverseConnectRetries to a value between 1 and 255 (default is 5). On failure it will ExitProcess (still better than a cpu spin) 
git-svn-id: file:///home/svn/framework3/trunk@7217 4d416f70-5f16-0410-b530-b9f4589650da
 2009-10-20 20:31:14 +00:00
HD Moore 069144f56a Dont print the bind message for the any address 
git-svn-id: file:///home/svn/framework3/trunk@7057 4d416f70-5f16-0410-b530-b9f4589650da
 2009-09-24 20:52:58 +00:00
James Lee 077c201f10 try any before specific LHOST 
git-svn-id: file:///home/svn/framework3/trunk@6177 4d416f70-5f16-0410-b530-b9f4589650da
 2009-01-23 23:03:53 +00:00
James Lee 9bb814a9d1 fix typo in comment 
git-svn-id: file:///home/svn/framework3/trunk@5974 4d416f70-5f16-0410-b530-b9f4589650da
 2008-11-21 23:44:45 +00:00
James Lee 4b082a77a8 un-break reverse handler for ipv6 
git-svn-id: file:///home/svn/framework3/trunk@5972 4d416f70-5f16-0410-b530-b9f4589650da
 2008-11-21 05:34:39 +00:00
James Lee b76d3e1560 better handling of LHOST vs 0.0.0.0; fixes #262 again 
git-svn-id: file:///home/svn/framework3/trunk@5971 4d416f70-5f16-0410-b530-b9f4589650da
 2008-11-21 05:12:31 +00:00
James Lee fec1533b50 revert r5969 which breaks behind nat 
git-svn-id: file:///home/svn/framework3/trunk@5970 4d416f70-5f16-0410-b530-b9f4589650da
 2008-11-21 02:01:43 +00:00
James Lee f1e71237e4 bind to LHOST instead of 0.0.0.0, fixes #262 
git-svn-id: file:///home/svn/framework3/trunk@5969 4d416f70-5f16-0410-b530-b9f4589650da
 2008-11-21 01:09:17 +00:00
Ramon de C Valle f124597a56 Code cleanups 
git-svn-id: file:///home/svn/framework3/trunk@5773 4d416f70-5f16-0410-b530-b9f4589650da
 2008-10-19 21:03:39 +00:00
HD Moore d53dd66701 Adds initial support for IPv6, including two stager. Tested Meterpreter over IPv6 stages on XP and Vista. Using this is still tricky, I will add a wiki page tomorrow to explain the ScopeID stuff for link-local testing. This commit also includes the raw (oversized) assembler for the stagers as well as the entire old metasploit assembly set (useful for development). 
git-svn-id: file:///home/svn/framework3/trunk@5635 4d416f70-5f16-0410-b530-b9f4589650da
 2008-08-22 06:34:57 +00:00
HD Moore 070f9af55f Reverse connection payloads now listen on 0.0.0.0 by default. 
git-svn-id: file:///home/svn/framework3/trunk@4000 4d416f70-5f16-0410-b530-b9f4589650da
 2006-10-01 16:56:17 +00:00
HD Moore b4ad4a5d75 Tabs vs Spaces 
git-svn-id: file:///home/svn/incoming/trunk@3453 4d416f70-5f16-0410-b530-b9f4589650da
 2006-01-27 05:33:08 +00:00
HD Moore 7a26ec55bf Proxy chaining patch from bmc 
git-svn-id: file:///home/svn/incoming/trunk@3244 4d416f70-5f16-0410-b530-b9f4589650da
 2005-12-18 02:19:21 +00:00
Matt Miller 22278ce458 vncinject payload 
git-svn-id: file:///home/svn/incoming/trunk@3201 4d416f70-5f16-0410-b530-b9f4589650da
 2005-12-12 07:07:19 +00:00
Matt Miller fc42fef941 exploits now pass context when creating sockets 
git-svn-id: file:///home/svn/incoming/trunk@3034 4d416f70-5f16-0410-b530-b9f4589650da
 2005-11-15 21:25:23 +00:00
Matt Miller 5676117bff last of normalized docs from last night 
git-svn-id: file:///home/svn/incoming/trunk@3030 4d416f70-5f16-0410-b530-b9f4589650da
 2005-11-15 15:11:43 +00:00
Matt Miller 05a84cc7da bug fixes in x86 asm, jmp call additive, payload generation, and new exploit 
git-svn-id: file:///home/svn/incoming/trunk@3021 4d416f70-5f16-0410-b530-b9f4589650da
 2005-11-11 01:22:03 +00:00
Matt Miller 6a5870ddcd updated comments to be more uniformed in class definition 
git-svn-id: file:///home/svn/incoming/trunk@3004 4d416f70-5f16-0410-b530-b9f4589650da
 2005-11-02 16:49:45 +00:00
Matt Miller b06a2ca030 initial support for compat filtering, may be buggy 
git-svn-id: file:///home/svn/incoming/trunk@2971 4d416f70-5f16-0410-b530-b9f4589650da
 2005-10-19 01:48:10 +00:00
Matt Miller 6f8f862e2a support for multiple con-current sessions 
git-svn-id: file:///home/svn/incoming/trunk@2869 4d416f70-5f16-0410-b530-b9f4589650da
 2005-09-23 06:08:04 +00:00
Matt Miller fe0a151d7e ported ie object type, more work on http stuff 
git-svn-id: file:///home/svn/incoming/trunk@2861 4d416f70-5f16-0410-b530-b9f4589650da
 2005-09-22 03:24:32 +00:00
Matt Miller 46c2cd2ac1 added ui subscriber stuff 
git-svn-id: file:///home/svn/incoming/trunk@2775 4d416f70-5f16-0410-b530-b9f4589650da
 2005-07-17 07:06:05 +00:00
Matt Miller 11724ac797 fixed stager merging, made things a bit more pimply 
git-svn-id: file:///home/svn/incoming/trunk@2774 4d416f70-5f16-0410-b530-b9f4589650da
 2005-07-17 06:01:11 +00:00
Matt Miller 24c4a2513a some more madness 
git-svn-id: file:///home/svn/incoming/trunk@2765 4d416f70-5f16-0410-b530-b9f4589650da
 2005-07-16 08:12:58 +00:00
Matt Miller 2f2363d141 it lives, major changes, fixed bugs, exploiting works with the test exploit 
git-svn-id: file:///home/svn/incoming/trunk@2763 4d416f70-5f16-0410-b530-b9f4589650da
 2005-07-16 07:32:11 +00:00
Matt Miller be2414a8b2 exploitation progress 
git-svn-id: file:///home/svn/incoming/trunk@2762 4d416f70-5f16-0410-b530-b9f4589650da
 2005-07-15 23:46:05 +00:00
Matt Miller d62566a68f lots of changes, making the simple wrapper better, lots of improvements 
git-svn-id: file:///home/svn/incoming/trunk@2750 4d416f70-5f16-0410-b530-b9f4589650da
 2005-07-14 06:34:58 +00:00