metasploit-payloads 2.0.100 → 2.0.102

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b67d82e440962d7ce1fbc58d8763cb527576a4ed23ffe2958dc2eb92790de8ec
-  data.tar.gz: 6b5167e7f0d90c44bbee9564085bc5f9a1636a3bbdb5b3ef99a0becf005bb826
+  metadata.gz: dfdd8851985d5249c1665ea15b2c2fb4ba0871e8eedb1c12dfcfdbe82702ac27
+  data.tar.gz: a2547c05feeca62ca2a269af361ecd48ebcb589ba4459a42f339b8dc3ab07384
 SHA512:
-  metadata.gz: 0d0447ce0102adc723d9ee57deb40b5fb750df432dfa32ec09d9f763df54824435f06bcc2d91d95bf7a61ca0e216b36331a28074a3a8ef739e44ae69e1d8d495
-  data.tar.gz: 607649cc780ec08822518ded9135653386e04a1ecf9bc1c214c7d9c3da8dde7ceff5b8e71a0f04e58ca722d1c0e372b5ea65b80dc5bc6079e980224c9782d7f6
+  metadata.gz: c71b217dc011367c228c6d65ce6054731b5219b4979b7fa2f7ef88759b346affb78179ee1b2467f0bc893c3d87887c612c3f6d330d2096e964a52de77adaf995
+  data.tar.gz: ae8b718e8c46fa54a557e18669c58de1dc7ee21b00a3be2ecd6cc51397ce0fba6e95b158c39ff488e9265d7e90186c2b35e1713054b26b81481f22ec04ff5633

data/data/meterpreter/ext_server_stdapi.py

@@ -386,6 +386,17 @@ if has_ctypes:
 
     PTOKEN_PRIVILEGES = ctypes.POINTER(TOKEN_PRIVILEGES)
 
+    MAXLEN_PHYSADDR = 8
+
+    class MIB_IPNETROW(ctypes.Structure):
+        _fields_ = [
+            ('dwIndex', ctypes.c_uint32),
+            ('dwPhysAddrLen', ctypes.c_uint32),
+            ('bPhysAddr', ctypes.c_byte * MAXLEN_PHYSADDR),
+            ('dwAddr', ctypes.c_uint32),
+            ('dwType', ctypes.c_uint32)
+        ]
+
 
     #
     # Linux Structures
@@ -522,6 +533,7 @@ TLV_TYPE_NETMASK               = TLV_META_TYPE_RAW     | 1421
 TLV_TYPE_GATEWAY               = TLV_META_TYPE_RAW     | 1422
 TLV_TYPE_NETWORK_ROUTE         = TLV_META_TYPE_GROUP   | 1423
 TLV_TYPE_IP_PREFIX             = TLV_META_TYPE_UINT    | 1424
+TLV_TYPE_ARP_ENTRY             = TLV_META_TYPE_GROUP   | 1425
 
 TLV_TYPE_IP                    = TLV_META_TYPE_RAW     | 1430
 TLV_TYPE_MAC_ADDRESS           = TLV_META_TYPE_RAW     | 1431
@@ -706,6 +718,10 @@ ERROR_SUCCESS = 0
 # not defined in original C implementation
 ERROR_FAILURE = 1
 
+ERROR_INSUFFICIENT_BUFFER = 0x0000007a
+ERROR_NOT_SUPPORTED = 0x00000032
+ERROR_NO_DATA = 0x000000e8
+
 # Special return value to match up with Windows error codes for network
 # errors.
 ERROR_CONNECTION_ERROR = 10000
@@ -1712,6 +1728,49 @@ def stdapi_fs_mount_show(request, response):
         response += tlv_pack(TLV_TYPE_MOUNT_GROUP, mount)
     return ERROR_SUCCESS, response
 
+@register_function_if(has_windll)
+def stdapi_net_config_get_arp_table(request, response):
+    MIB_IPNET_TYPE_DYNAMIC = 3
+    MIB_IPNET_TYPE_STATIC  = 4
+
+    GetIpNetTable = ctypes.windll.iphlpapi.GetIpNetTable
+    GetIpNetTable.argtypes = [ctypes.c_void_p, ctypes.POINTER(ctypes.c_ulong), ctypes.c_long]
+    GetIpNetTable.restype = ctypes.c_ulong
+
+    ipnet_table = None
+    size = ctypes.c_ulong(0)
+    result = GetIpNetTable(ipnet_table, size, False)
+
+    if result == ERROR_INSUFFICIENT_BUFFER:
+        ipnet_table = ctypes.cast(ctypes.create_string_buffer(b'', size.value), ctypes.c_void_p)
+
+    elif result != ERROR_SUCCESS and result != ERROR_NO_DATA:
+        return error_result_windows(result), response
+
+    if not ipnet_table:
+        return error_result_windows(), response
+
+    result = GetIpNetTable(ipnet_table, size, False)
+    if result != ERROR_SUCCESS:
+        return error_result_windows(result), response
+
+    class MIB_IPNETTABLE(ctypes.Structure):
+        _fields_ = [
+            ('dwNumEntries', ctypes.c_uint32),
+            ('table', MIB_IPNETROW * ctypes.cast(ipnet_table.value, ctypes.POINTER(ctypes.c_ulong)).contents.value)
+        ]
+    
+    ipnet_table = ctypes.cast(ipnet_table, ctypes.POINTER(MIB_IPNETTABLE))
+    for ipnet_row in ipnet_table.contents.table:
+        if (ipnet_row.dwType != MIB_IPNET_TYPE_DYNAMIC and ipnet_row.dwType != MIB_IPNET_TYPE_STATIC):
+            continue
+        arp_tlv  = bytes()
+        arp_tlv += tlv_pack(TLV_TYPE_IP, struct.pack('<L', ipnet_row.dwAddr))
+        arp_tlv += tlv_pack(TLV_TYPE_MAC_ADDRESS, bytes(ipnet_row.bPhysAddr)[:ipnet_row.dwPhysAddrLen])
+        arp_tlv += tlv_pack(TLV_TYPE_MAC_NAME, str(ipnet_row.dwIndex))
+        response += tlv_pack(TLV_TYPE_ARP_ENTRY, arp_tlv)
+    return ERROR_SUCCESS, response
+
 @register_function
 def stdapi_net_config_get_interfaces(request, response):
     if hasattr(socket, 'AF_NETLINK') and hasattr(socket, 'NETLINK_ROUTE'):

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.100'
+  VERSION = '2.0.102'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.100
+  version: 2.0.102
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2022-11-10 00:00:00.000000000 Z
+date: 2022-12-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake