metasploit-payloads 2.0.108 → 2.0.110

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8b2e2cb12a89c4b055997fa3dcce68de37ba85753595a53658fcbb6e85c6857f
-  data.tar.gz: bc026282a9499ede5356004abf9b91affbefdd44d9da805f056dadaa889a44d3
+  metadata.gz: 64de577065bf9307467789a2223a1c49cf8676525a0b0c9abfe63c09db9fddac
+  data.tar.gz: 7617cc80525c7eafbb908a141d0f3cfa7bf0e2fe4e2fba2a45892b60788efd9b
 SHA512:
-  metadata.gz: 9a5fe117aa8cc0db6c32911912814d5367c2fd40ef0fcde3407a47733f46ce483c213045fa50cfca561420064fdf4963eb530eb3d2fd6db050aff079af4a292a
-  data.tar.gz: 4cf53ffdd0f3bb5a2413c06a30834d8b5129321a3eb6a397c2b2771bd11b53df2d2deac8c618fb0cadd56b8395e6db42bd04604079255300cc1c4b68bdf1cf43
+  metadata.gz: 54eff4b6a2279c30fafceb7d80fe2583868349f9a560d7c08a9f6cbe804c7aacbc95f86c006d5e2927510693aac66d176df82811bef312eb5f2723a359bc585a
+  data.tar.gz: cb7f5f78770c1f99fc78335e2246e78c96f3e1ac29d9c054bc37ae5deeeb072618f5708e40f8324734b1b4c2d09eb9201f712e6685c6e3447e51cb5c04320f4b

data/data/meterpreter/ext_server_stdapi.py

@@ -2792,7 +2792,6 @@ def stdapi_ui_get_idle_time(request, response):
 
 @register_function_if(has_windll)
 def stdapi_ui_desktop_enum(request, response):
-    
     response_parts = []
     if ctypes.sizeof(ctypes.c_long) == ctypes.sizeof(ctypes.c_void_p):
         LPARAM = ctypes.c_long
@@ -2830,7 +2829,7 @@ def stdapi_ui_desktop_enum(request, response):
         ProcessIdToSessionId = ctypes.windll.kernel32.ProcessIdToSessionId
         ProcessIdToSessionId.argtypes = [ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)]
         ProcessIdToSessionId.restype = ctypes.c_bool
-        
+
         if not ProcessIdToSessionId(ctypes.c_ulong(pid), ctypes.byref(dwSessionId)):
             dwSessionId = ctypes.c_ulong(-1)
 
@@ -2876,6 +2875,50 @@ def stdapi_ui_desktop_enum(request, response):
 
     return ERROR_SUCCESS, response
 
+@register_function_if(has_windll)
+def stdapi_ui_desktop_get(request, response):
+    UOI_NAME = 2
+
+    GetCurrentProcessId = ctypes.windll.kernel32.GetCurrentProcessId
+    GetCurrentProcessId.restype = ctypes.c_ulong
+
+    GetProcessWindowStation = ctypes.windll.user32.GetProcessWindowStation
+    GetProcessWindowStation.restype = ctypes.c_void_p
+
+    GetUserObjectInformationA = ctypes.windll.user32.GetUserObjectInformationA
+    GetUserObjectInformationA.argtypes = [ctypes.c_void_p, ctypes.c_int32, ctypes.c_void_p, ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)]
+    GetUserObjectInformationA.restype = ctypes.c_bool
+
+    GetCurrentThreadId = ctypes.windll.kernel32.GetCurrentThreadId
+    GetCurrentThreadId.restype = ctypes.c_ulong
+
+    GetThreadDesktop = ctypes.windll.user32.GetThreadDesktop
+    GetThreadDesktop.argtypes = [ctypes.c_ulong]
+    GetThreadDesktop.restype = ctypes.c_void_p
+
+    ProcessIdToSessionId = ctypes.windll.kernel32.ProcessIdToSessionId
+    ProcessIdToSessionId.argtypes = [ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)]
+    ProcessIdToSessionId.restype = ctypes.c_bool
+
+    dwSessionId = ctypes.c_ulong(0)
+    if not ProcessIdToSessionId(GetCurrentProcessId(), ctypes.byref(dwSessionId)):
+        return error_result_windows(), response
+
+    station_name = ctypes.create_string_buffer(bytes(), 256)
+    success = GetUserObjectInformationA(GetProcessWindowStation(), UOI_NAME, ctypes.byref(station_name), 256, None)
+    if not success:
+        return error_result_windows(), response
+
+    desktop_name = ctypes.create_string_buffer(bytes(), 256)
+    success = GetUserObjectInformationA(GetThreadDesktop(GetCurrentThreadId()), UOI_NAME, ctypes.byref(desktop_name), 256, None)
+    if not success:
+        return error_result_windows(), response
+
+    response += tlv_pack(TLV_TYPE_DESKTOP_SESSION, dwSessionId.value)
+    response += tlv_pack(TLV_TYPE_DESKTOP_STATION, station_name.value.decode())
+    response += tlv_pack(TLV_TYPE_DESKTOP_NAME, desktop_name.value.decode())
+    return ERROR_SUCCESS, response
+
 @register_function_if(has_termios and has_fcntl)
 def stdapi_sys_process_set_term_size(request, response):
     channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.108'
+  VERSION = '2.0.110'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.108
+  version: 2.0.110
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2023-01-19 00:00:00.000000000 Z
+date: 2023-02-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake