metasploit-payloads 2.0.108 → 2.0.109

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8b2e2cb12a89c4b055997fa3dcce68de37ba85753595a53658fcbb6e85c6857f
-  data.tar.gz: bc026282a9499ede5356004abf9b91affbefdd44d9da805f056dadaa889a44d3
+  metadata.gz: a667e59f354834de4c22bab9b2e20964c8da6c69d1a4ef5d90ddc66e45320fa0
+  data.tar.gz: 2f10651bd6ade59a0d69c6ebd0ed8c636aceb1c86208827ad3130f9c968857e0
 SHA512:
-  metadata.gz: 9a5fe117aa8cc0db6c32911912814d5367c2fd40ef0fcde3407a47733f46ce483c213045fa50cfca561420064fdf4963eb530eb3d2fd6db050aff079af4a292a
-  data.tar.gz: 4cf53ffdd0f3bb5a2413c06a30834d8b5129321a3eb6a397c2b2771bd11b53df2d2deac8c618fb0cadd56b8395e6db42bd04604079255300cc1c4b68bdf1cf43
+  metadata.gz: 75d36a853ef6d09e030061d997832e98e31a6f8682b9dda7c8715ef4cf6a91839de11def68602cb4af2fb700ee4ce623b265748d72caee34548e855ebe59858c
+  data.tar.gz: 48d8b118e18a02b4415b35377ad9771b9f2a8bb2717e24cdbe2fe90a969727f3e7cf255783a3e08655da9fad1dc208556c6946cd1ff973e344b3237735405d8c

data/data/meterpreter/ext_server_stdapi.py

@@ -2792,7 +2792,6 @@ def stdapi_ui_get_idle_time(request, response):
 
 @register_function_if(has_windll)
 def stdapi_ui_desktop_enum(request, response):
-    
     response_parts = []
     if ctypes.sizeof(ctypes.c_long) == ctypes.sizeof(ctypes.c_void_p):
         LPARAM = ctypes.c_long
@@ -2830,7 +2829,7 @@ def stdapi_ui_desktop_enum(request, response):
         ProcessIdToSessionId = ctypes.windll.kernel32.ProcessIdToSessionId
         ProcessIdToSessionId.argtypes = [ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)]
         ProcessIdToSessionId.restype = ctypes.c_bool
-        
+
         if not ProcessIdToSessionId(ctypes.c_ulong(pid), ctypes.byref(dwSessionId)):
             dwSessionId = ctypes.c_ulong(-1)
 
@@ -2876,6 +2875,50 @@ def stdapi_ui_desktop_enum(request, response):
 
     return ERROR_SUCCESS, response
 
+@register_function_if(has_windll)
+def stdapi_ui_desktop_get(request, response):
+    UOI_NAME = 2
+
+    GetCurrentProcessId = ctypes.windll.kernel32.GetCurrentProcessId
+    GetCurrentProcessId.restype = ctypes.c_ulong
+
+    GetProcessWindowStation = ctypes.windll.user32.GetProcessWindowStation
+    GetProcessWindowStation.restype = ctypes.c_void_p
+
+    GetUserObjectInformationA = ctypes.windll.user32.GetUserObjectInformationA
+    GetUserObjectInformationA.argtypes = [ctypes.c_void_p, ctypes.c_int32, ctypes.c_void_p, ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)]
+    GetUserObjectInformationA.restype = ctypes.c_bool
+
+    GetCurrentThreadId = ctypes.windll.kernel32.GetCurrentThreadId
+    GetCurrentThreadId.restype = ctypes.c_ulong
+
+    GetThreadDesktop = ctypes.windll.user32.GetThreadDesktop
+    GetThreadDesktop.argtypes = [ctypes.c_ulong]
+    GetThreadDesktop.restype = ctypes.c_void_p
+
+    ProcessIdToSessionId = ctypes.windll.kernel32.ProcessIdToSessionId
+    ProcessIdToSessionId.argtypes = [ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)]
+    ProcessIdToSessionId.restype = ctypes.c_bool
+
+    dwSessionId = ctypes.c_ulong(0)
+    if not ProcessIdToSessionId(GetCurrentProcessId(), ctypes.byref(dwSessionId)):
+        return error_result_windows(), response
+
+    station_name = ctypes.create_string_buffer(bytes(), 256)
+    success = GetUserObjectInformationA(GetProcessWindowStation(), UOI_NAME, ctypes.byref(station_name), 256, None)
+    if not success:
+        return error_result_windows(), response
+
+    desktop_name = ctypes.create_string_buffer(bytes(), 256)
+    success = GetUserObjectInformationA(GetThreadDesktop(GetCurrentThreadId()), UOI_NAME, ctypes.byref(desktop_name), 256, None)
+    if not success:
+        return error_result_windows(), response
+
+    response += tlv_pack(TLV_TYPE_DESKTOP_SESSION, dwSessionId.value)
+    response += tlv_pack(TLV_TYPE_DESKTOP_STATION, station_name.value.decode())
+    response += tlv_pack(TLV_TYPE_DESKTOP_NAME, desktop_name.value.decode())
+    return ERROR_SUCCESS, response
+
 @register_function_if(has_termios and has_fcntl)
 def stdapi_sys_process_set_term_size(request, response):
     channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.108'
+  VERSION = '2.0.109'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.108
+  version: 2.0.109
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2023-01-19 00:00:00.000000000 Z
+date: 2023-01-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake