Commit Graph

4111 Commits

Author SHA1 Message Date
Brendan Coles ef4e7b2165 post/windows/manage/persistence_exe: Replace IO.read with File.binread 2022-03-05 13:24:55 +00:00
Grant Willcox 585b470703 Land #16093, Fix URL refs for various modules and improve tools/modules/module_reference.rb code 2022-02-23 17:04:26 -06:00
Grant Willcox 5f672019ac Add in RuboCop fixes before final land 2022-02-23 16:27:12 -06:00
adfoster-r7 5e4f7a1707 Land #16200, fix post/windows/enum_chrome on Chrome > 80 2022-02-21 11:38:47 +00:00
Tim W 526f1be891 run rubocop on enum_chrome.rb 2022-02-18 02:45:09 +00:00
h00die d5ba1afbec fix URLs not resolving
fix URLs not resolving

add csv export to references

fix URLs not resolving

pdf not pd

missed a url change

remove extra recirectedfrom fields

remove extra file

fix ovftool url accidental replacement
2022-02-16 17:22:40 -06:00
Tim W f5c17a0d00 use LocalAlloc instead of process.open 2022-02-16 21:27:26 +00:00
Tim W 9211838a62 fix #16134, fix post/windows/enum_chrome on Chrome > 80 2022-02-16 21:27:15 +00:00
Spencer McIntyre 50d78e035d Remove the deprecated VSS modules 2022-02-15 08:49:11 -05:00
Tim W 65453a1bfa Land #16076, add meterpreter session type support to post/osx/gather/hashdump 2022-02-13 11:46:49 +00:00
Brendan Coles 04552d7998 windows/gather/enum_domains: Return early if no domains are found 2022-01-28 11:06:53 +00:00
Spencer McIntyre 3cd2b1b929 Update naming for consistency and the module 2022-01-24 10:35:40 -06:00
Brendan Coles c17c2636ae post/osx/gather/hashdump: Add 'meterpreter' to supported SessionTypes 2022-01-20 13:11:24 +00:00
Brendan Coles a31052afbd post/multi/manage/sudo: Abort if session type is Meterpreter 2022-01-20 12:44:29 +00:00
Brendan Coles c29e30c58e local_admin_search_enum: Fix typo: @domain_controller 2022-01-18 15:08:30 +00:00
Brendan Coles 2bb5edac9e local_exploit_suggester: Print session_host if session is valid 2022-01-16 03:24:41 +00:00
Jake Baines e7810acb1e Pulled offsets out of dll into module. Auto-find lsass.exe when pid is 0 2021-12-18 10:56:46 -08:00
Jake Baines deab4ce90e Initial commit of Dellicious port 2021-12-08 07:33:16 -08:00
Grant Willcox e21812fa5c Land #15864, fix #15856, fix shell_to_meterpreter to detect x64 windows and return an x64 meterpreter session 2021-11-24 17:41:31 -06:00
Grant Willcox 1b9f9f0620 Add in final review fixes to handle Windows ARM if ever encountered 2021-11-24 16:37:21 -06:00
Jeffrey Martin 21a6a18d92 trade URI.encode & URI.escape for Ruby 3
Ruby 3 removed the `URI.escape` methods however access to
the a parse for the same RFC is stil available at `URI::DEFAULT_PARSER.escape`.

Per the Ruby forum [comment](https://bugs.ruby-lang.org/issues/17309#note-1) this should equal.
2021-11-22 14:11:03 -06:00
Tim W 423810ca5c fix shell_to_meterpreter cmd_exec powershell 2021-11-22 03:11:26 +00:00
Tim W f2d7f33280 run rubocop on shell_to_meterpreter 2021-11-11 16:00:05 +00:00
Tim W 7a2eb1cbcb fix #15856, fix shell_to_meterpreter to detect x64 windows and return an x64 meterpreter session 2021-11-11 14:40:18 +00:00
dwelch-r7 73e55fcaee Land #15665, Add Meterpreter compatibility metadata 2021-10-29 12:45:26 +01:00
Christophe De La Fuente 1befd545e3 Land #15558, add module to access a sessions filesystem in a browser 2021-10-25 18:37:42 +02:00
Tim W 86d1e3cb0a fix get_drives format 2021-10-25 17:30:47 +01:00
adfoster-r7 9f0804cbfb Fix Meterpreter spelling mistake 2021-10-12 23:40:43 +01:00
adfoster-r7 28eab4d871 Add Meterpreter compatibility metadata 2021-10-06 13:54:51 +01:00
Jay Turla 613d26743a Update diagnostic_state.rb 2021-10-04 07:31:06 +08:00
Jay Turla 8bdbf99c80 Add Diagnostic State Module
## Introduction
This module will keep the vehicle in a diagnostic state on rounds by sending tester present packet.

## Verification Steps

Fire up virtual CAN bus:

1. `sudo modprobe can`
2. `sudo modprobe vcan`
3. `sudo ip link add dev vcan0 type vcan`
4. `sudo ip link set up vcan0`

Launch msf:

5. Start `msfconsole`
6. `use auxiliary/server/local_hwbridge`
7. `set uripath testbus`
8. `run`
9. `use auxiliary/client/hwbridge/connect`
10. `set targeturi testbus`

## Options

```
Module options (post/hardware/automotive/diagnostic_state):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   ARBID    0x7DF            no        CAN ID to perform ECU Hard Reset
   CANBUS                    no        CAN Bus to perform scan on, defaults to connected bus
   ROUNDS   500              yes       Number of executed rounds
   SESSION                   yes       The session to run this module on.
```

## Scenarios
You can test this module doing a candump and you should receive a response for each can frame in a loop at 0x7E8 when running UDS Simulator.

```
msf5 auxiliary(client/hwbridge/connect) > run
[*] Running module against 127.0.0.1

[*] Attempting to connect to 127.0.0.1...
[*] Hardware bridge interface session 1 opened (127.0.0.1 -> 127.0.0.1) at 2019-09-11 04:59:40 -0700
[+] HWBridge session established
[*] HW Specialty: {"automotive"=>true}  Capabilities: {"can"=>true, "custom_methods"=>true}
[!] NOTICE:  You are about to leave the matrix.  All actions performed on this hardware bridge
[!]          could have real world consequences.  Use this module in a controlled testing
[!]          environment and with equipment you are authorized to perform testing on.
[*] Auxiliary module execution completed
msf5 auxiliary(client/hwbridge/connect) > sessions

Active sessions
===============

  Id  Name  Type                   Information  Connection
  --  ----  ----                   -----------  ----------
  1         hwbridge cmd/hardware  automotive   127.0.0.1 -> 127.0.0.1 (127.0.0.1)

msf5 auxiliary(client/hwbridge/connect) > sessions -i 1
[*] Starting interaction with 1...

hwbridge > run post/hardware/automotive/diagnostic_state canbus=vcan0

[*] Putting the vehicle in a diagnostic state...
[*] In order to keep the vehicle in this state, you need to continuously send a packet to let the vehicle know that a diagnostic technician is present.
hwbridge >
```

You can use candump to verify the CAN messages being sent:

```
─$ candump vcan0
└─$ candump vcan0
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E
  vcan0  7E8   [4]  03 7E 00 00
  vcan0  7DF   [2]  01 3E

-- snippet --
```

UDS Server Output
```
└─$ ./uds-server -v -V "PWN3D" vcan0
Using CAN interface vcan0
Fuzz level set to: 0
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E
Pkt: 7DF#01 3E

-- snippet --
```
2021-10-04 01:35:31 +08:00
adfoster-r7 26e317d093 Land #15707, Add ECU Hard Reset for hwbridge 2021-09-28 19:18:46 +01:00
adfoster-r7 230c7b5e82 Remove repeatable session metadata 2021-09-28 18:51:51 +01:00
bwatters ded4401b2b More rubocop fixes.... 2021-09-27 12:34:07 -05:00
bwatters 082948f8d9 Fix references to new global and fix a forgotten module 2021-09-27 12:26:53 -05:00
bwatters 6e08c6087e Rubocop corrections 2021-09-27 12:26:53 -05:00
Kazuyoshi Maruta 77e144b668 Add a method to check if the folder containing the artifact exists 2021-09-27 12:26:53 -05:00
Kazuyoshi Maruta 0d021deb0c Update modules with rubocop 2021-09-27 12:26:53 -05:00
Kazuyoshi Maruta e6d2c01ad2 Run Rubocop for aim.rb 2021-09-27 12:26:53 -05:00
KazuCyber aa9598cd20 Rename ICQ.rb to icq.rb 2021-09-27 12:26:53 -05:00
Kazuyoshi Maruta 09ed5b671e Add xchat.rb, Add kmeleon.md 2021-09-27 12:26:53 -05:00
KazuCyber 81719f6613 Update aim.rb
Bug fix.
2021-09-27 12:26:52 -05:00
Kazuyoshi Maruta 37cc6e540e Add modules, Rename a module 2021-09-27 12:26:52 -05:00
Kazuyoshi Maruta c1742a23b9 Update wording on Module documentation. Replace EXTRACT_CREDENTIALS_FROM_FILE with EXTRACT_DATA 2021-09-27 12:26:52 -05:00
Kazuyoshi Maruta e582c15f56 Update & and & to 'and' 2021-09-27 12:26:52 -05:00
Kazuyoshi Maruta 94d3f87461 Update artifact description in line.rb 2021-09-27 12:26:52 -05:00
Kazuyoshi Maruta dc6f6a8f25 Packrat: 29 post exploitation modules 2021-09-27 12:26:52 -05:00
adfoster-r7 959527a4c4 Land #15669, Add meterpreter compatibility metadata to screenshare module 2021-09-27 15:18:01 +01:00
Jay Turla 70c400e883 Update ecu_hard_reset.rb 2021-09-27 19:39:06 +08:00
adfoster-r7 06762d0934 Update references to railgun to be consistent 2021-09-27 12:37:14 +01:00