metasploit-payloads 2.0.55 → 2.0.59

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0fbcfbe46a267ae62eb3d0311ad2b8f74c67b554af643e831d572e5f5884f632
-  data.tar.gz: 7aa3192b0be1dd60541b609fdd0d5888b3a4d59c19756322b9c899417916d54c
+  metadata.gz: 117ff7aceaeba0fa89fb3018437e5c3b66decab1ab147ed014de07b30e23758f
+  data.tar.gz: d467e15ae88149f1a945d894d1e1d21c3511c8e249d3973e8b0c71b24ed4110f
 SHA512:
-  metadata.gz: 19dce631c6385cf74d2238790f9b249dd888df53ef92cc29a7f0e126b55e25bb699021cd4fe7ae44b76aa52f80c8fdd4e42949f80dd7b9c60cbb806993ad219a
-  data.tar.gz: bc994d5b3681824e3f22713abdf19bdc7f23d3c96922601288135701b9ab0d68cace7bbf171d4b2eeffadf78b5a3c044de05c9ad5e4a704f2f10d22998e1e6c0
+  metadata.gz: 81f991b1b37db4c154663dec36df1a67d0cee57191d9d53c0dfe6a498ef68578d4f33ab10824603764cd8f2c6b34fbe527d115176433d5bb5c20ff7d1c3690a6
+  data.tar.gz: 7436e234074f93cc0debeece05ef48aa447a360dc6bede6ddb0f22cc1e96c74981b226344200b5db5e6913b2dc9ec053adeb9db1484ed665e6aa344cc68491a5

data/data/meterpreter/ext_server_stdapi.php

@@ -27,7 +27,9 @@ define("TLV_TYPE_SEARCH_RECURSE",      TLV_META_TYPE_BOOL    | 1230);
 define("TLV_TYPE_SEARCH_GLOB",         TLV_META_TYPE_STRING  | 1231);
 define("TLV_TYPE_SEARCH_ROOT",         TLV_META_TYPE_STRING  | 1232);
 define("TLV_TYPE_SEARCH_RESULTS",      TLV_META_TYPE_GROUP   | 1233);
-
+define("TLV_TYPE_SEARCH_MTIME",        TLV_META_TYPE_UINT    | 1235);
+define("TLV_TYPE_SEARCH_M_START_DATE", TLV_META_TYPE_UINT    | 1236);
+define("TLV_TYPE_SEARCH_M_END_DATE",   TLV_META_TYPE_UINT    | 1237);
 define("TLV_TYPE_FILE_MODE_T",         TLV_META_TYPE_UINT    | 1234);
 
 ##
@@ -340,7 +342,7 @@ define('GLOB_RECURSE',2048);
  *   GLOB_NODOTS, GLOB_RECURSE
  */
 if (!function_exists('safe_glob')) {
-function safe_glob($pattern, $flags=0) {
+function safe_glob($pattern, $flags=0, $start_date=null, $end_date=null) {
     $split=explode('/',str_replace('\\','/',$pattern));
     $mask=array_pop($split);
     $path=implode('/',$split);
@@ -356,14 +358,21 @@ function safe_glob($pattern, $flags=0) {
                     && (!is_link($path."/".$file))
                 )
             ) {
-                $glob = array_merge($glob, array_prepend(safe_glob($path.'/'.$file.'/'.$mask, $flags),
-                    ($flags&GLOB_PATH?'':$file.'/')));
+                $newglob = safe_glob($path.'/'.$file.'/'.$mask, $flags, $start_date, $end_date);
+                if ($newglob !== false) {
+                    $glob = array_merge($glob, array_prepend($newglob,
+                        ($flags&GLOB_PATH?'':$file.'/')));
+                }
             }
             // Match file mask
             if (fnmatch($mask,$file)) {
+                $tmp_f_stat = stat($path.'/'.$file);
+                $mtime = $tmp_f_stat['mtime'];
                 if ( ( (!($flags&GLOB_ONLYDIR)) || is_dir("$path/$file") )
                     && ( (!($flags&GLOB_NODIR)) || (!is_dir($path.'/'.$file)) )
-                    && ( (!($flags&GLOB_NODOTS)) || (!in_array($file,array('.','..'))) ) )
+                    && ( (!($flags&GLOB_NODOTS)) || (!in_array($file,array('.','..'))) )
+                    && ( ($start_date === null) || ($start_date <= $mtime))
+                    && ( ($end_date === null) || ($end_date >= $mtime)) )
                     $glob[] = ($flags&GLOB_PATH?$path.'/':'') . $file . ($flags&GLOB_MARK?'/':'');
             }
         }
@@ -682,27 +691,38 @@ function stdapi_fs_search($req, &$pkt) {
     $glob = canonicalize_path($glob_tlv['value']);
     $recurse_tlv = packet_get_tlv($req, TLV_TYPE_SEARCH_RECURSE);
     $recurse = $recurse_tlv['value'];
+    $start_date_tlv = packet_get_tlv($req, TLV_TYPE_SEARCH_M_START_DATE);
+    $start_date = null;
+    if ($start_date_tlv) {
+        $start_date = $start_date_tlv['value'];
+    }
+    $end_date_tlv = packet_get_tlv($req, TLV_TYPE_SEARCH_M_END_DATE);
+    $end_date = null;
+    if ($end_date_tlv) {
+        $end_date = $end_date_tlv['value'];
+    }
 
     if (!$root) {
         $root = '.';
     }
 
     my_print("glob: $glob, root: $root, recurse: $recurse");
-    $flags = GLOB_PATH;
+    $flags = GLOB_PATH | GLOB_NODOTS;
     if ($recurse) {
         $flags |= GLOB_RECURSE;
     }
-    $files = safe_glob($root ."/". $glob, $flags);
+    $files = safe_glob($root ."/". $glob, $flags, $start_date, $end_date);
     if ($files and is_array($files)) {
         dump_array($files);
         foreach ($files as $file) {
             $file_tlvs = "";
             $s = stat($file);
-            $p = dirname($file);
-            $f = basename($file);
+            $p = canonicalize_path(dirname($file));
+            $f = canonicalize_path(basename($file));
             $file_tlvs .= tlv_pack(create_tlv(TLV_TYPE_FILE_PATH, $p));
             $file_tlvs .= tlv_pack(create_tlv(TLV_TYPE_FILE_NAME, $f));
             $file_tlvs .= tlv_pack(create_tlv(TLV_TYPE_FILE_SIZE, $s['size']));
+            $file_tlvs .= tlv_pack(create_tlv(TLV_TYPE_SEARCH_MTIME, $s['mtime']));
             packet_add_tlv($pkt, create_tlv(TLV_TYPE_SEARCH_RESULTS, $file_tlvs));
         }
     }
@@ -756,12 +776,12 @@ function stdapi_sys_config_getuid($req, &$pkt) {
     if (is_callable('posix_getuid')) {
         $uid = posix_getuid();
         $pwinfo = posix_getpwuid($uid);
-        $user = $pwinfo['name'] . " ($uid)";
+        $user = $pwinfo['name'];
     } else {
         # The posix functions aren't available, this is probably windows.  Use
         # the functions for getting user name and uid based on file ownership
         # instead.
-        $user = get_current_user() . " (" . getmyuid() . ")";
+        $user = get_current_user();
     }
     my_print("getuid - returning: " . $user);
     packet_add_tlv($pkt, create_tlv(TLV_TYPE_USER_NAME, $user));

data/data/meterpreter/ext_server_stdapi.py

@@ -474,6 +474,9 @@ TLV_TYPE_SEARCH_ROOT           = TLV_META_TYPE_STRING  | 1232
 TLV_TYPE_SEARCH_RESULTS        = TLV_META_TYPE_GROUP   | 1233
 
 TLV_TYPE_FILE_MODE_T           = TLV_META_TYPE_UINT    | 1234
+TLV_TYPE_SEARCH_MTIME          = TLV_META_TYPE_UINT    | 1235
+TLV_TYPE_SEARCH_M_START_DATE   = TLV_META_TYPE_UINT    | 1236
+TLV_TYPE_SEARCH_M_END_DATE     = TLV_META_TYPE_UINT    | 1237
 
 ##
 # Net
@@ -1518,20 +1521,36 @@ def stdapi_fs_search(request, response):
     search_root = unicode(search_root)
     glob = packet_get_tlv(request, TLV_TYPE_SEARCH_GLOB)['value']
     recurse = packet_get_tlv(request, TLV_TYPE_SEARCH_RECURSE)['value']
+    start_date = packet_get_tlv(request,TLV_TYPE_SEARCH_M_START_DATE)
+    end_date = packet_get_tlv(request,TLV_TYPE_SEARCH_M_END_DATE)
     if recurse:
         for root, dirs, files in os.walk(search_root):
             for f in filter(lambda f: fnmatch.fnmatch(f, glob), files):
+                file_stat = os.stat(os.path.join(root, f))
+                mtime = int(file_stat.st_mtime)
+                if start_date and start_date['value'] > mtime:
+                    continue
+                if end_date and end_date['value'] < mtime:
+                    continue
                 file_tlv  = bytes()
                 file_tlv += tlv_pack(TLV_TYPE_FILE_PATH, root)
                 file_tlv += tlv_pack(TLV_TYPE_FILE_NAME, f)
-                file_tlv += tlv_pack(TLV_TYPE_FILE_SIZE, os.stat(os.path.join(root, f)).st_size)
+                file_tlv += tlv_pack(TLV_TYPE_FILE_SIZE, file_stat.st_size)
+                file_tlv += tlv_pack(TLV_TYPE_SEARCH_MTIME, mtime)
                 response += tlv_pack(TLV_TYPE_SEARCH_RESULTS, file_tlv)
     else:
         for f in filter(lambda f: fnmatch.fnmatch(f, glob), os.listdir(search_root)):
+            file_stat = os.stat(os.path.join(search_root, f))
+            mtime = int(file_stat.st_mtime)
+            if start_date and start_date['value'] > mtime:
+                continue
+            if end_date and end_date['value'] < mtime:
+                continue
             file_tlv  = bytes()
             file_tlv += tlv_pack(TLV_TYPE_FILE_PATH, search_root)
             file_tlv += tlv_pack(TLV_TYPE_FILE_NAME, f)
-            file_tlv += tlv_pack(TLV_TYPE_FILE_SIZE, os.stat(os.path.join(search_root, f)).st_size)
+            file_tlv += tlv_pack(TLV_TYPE_FILE_SIZE, file_stat.st_size)
+            file_tlv += tlv_pack(TLV_TYPE_SEARCH_MTIME, mtime)
             response += tlv_pack(TLV_TYPE_SEARCH_RESULTS, file_tlv)
     return ERROR_SUCCESS, response
 

data/data/meterpreter/meterpreter.py

@@ -596,6 +596,16 @@ class MeterpreterChannel(object):
         response += tlv_pack(TLV_TYPE_LENGTH, self.write(channel_data))
         return ERROR_SUCCESS, response
 
+    def core_seek(self, request, response):
+        offset = packet_get_tlv(request, TLV_TYPE_SEEK_OFFSET)['value']
+        whence = packet_get_tlv(request, TLV_TYPE_SEEK_WHENCE)['value']
+        self.seek(offset, whence)
+        return ERROR_SUCCESS, response
+
+    def core_tell(self, request, response):
+        response += tlv_pack(TLV_TYPE_SEEK_POS, self.tell())
+        return ERROR_SUCCESS, response
+
     def close(self):
         raise NotImplementedError()
 
@@ -614,6 +624,12 @@ class MeterpreterChannel(object):
     def write(self, data):
         raise NotImplementedError()
 
+    def seek(self, offset, whence=os.SEEK_SET):
+        raise NotImplementedError()
+
+    def tell(self):
+        raise NotImplementedError()
+
 #@export
 class MeterpreterFile(MeterpreterChannel):
     def __init__(self, file_obj):
@@ -632,6 +648,12 @@ class MeterpreterFile(MeterpreterChannel):
     def write(self, data):
         self.file_obj.write(data)
         return len(data)
+
+    def seek(self, offset, whence=os.SEEK_SET):
+        self.file_obj.seek(offset, whence)
+
+    def tell(self):
+        return self.file_obj.tell()
 export(MeterpreterFile)
 
 #@export
@@ -1315,9 +1337,9 @@ class PythonMeterpreter(object):
                         self.send_packet(tlv_pack_request('stdapi_net_tcp_channel_open', [
                             {'type': TLV_TYPE_CHANNEL_ID, 'value': client_channel_id},
                             {'type': TLV_TYPE_CHANNEL_PARENTID, 'value': channel_id},
-                            {'type': TLV_TYPE_LOCAL_HOST, 'value': inet_pton(channel.sock.family, server_addr[0])},
+                            {'type': TLV_TYPE_LOCAL_HOST, 'value': server_addr[0]},
                             {'type': TLV_TYPE_LOCAL_PORT, 'value': server_addr[1]},
-                            {'type': TLV_TYPE_PEER_HOST, 'value': inet_pton(client_sock.family, client_addr[0])},
+                            {'type': TLV_TYPE_PEER_HOST, 'value': client_addr[0]},
                             {'type': TLV_TYPE_PEER_PORT, 'value': client_addr[1]},
                         ]))
                 elif isinstance(channel, MeterpreterSocketUDPClient):
@@ -1565,7 +1587,7 @@ class PythonMeterpreter(object):
             return ERROR_FAILURE, response
         channel = self.channels[channel_id]
         status, response = channel.core_eof(request, response)
-        return ERROR_SUCCESS, response
+        return status, response
 
     def _core_channel_interact(self, request, response):
         channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']
@@ -1605,6 +1627,20 @@ class PythonMeterpreter(object):
             self.handle_dead_resource_channel(channel_id)
         return status, response
 
+    def _core_channel_seek(self, request, response):
+        channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']
+        if channel_id not in self.channels:
+            return ERROR_FAILURE, response
+        channel = self.channels[channel_id]
+        return channel.core_seek(request, response)
+
+    def _core_channel_tell(self, request, response):
+        channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']
+        if channel_id not in self.channels:
+            return ERROR_FAILURE, response
+        channel = self.channels[channel_id]
+        return channel.core_tell(request, response)
+
     def create_response(self, request):
         response = struct.pack('>I', PACKET_TYPE_RESPONSE)
         commd_id_tlv = packet_get_tlv(request, TLV_TYPE_COMMAND_ID)

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.55'
+  VERSION = '2.0.59'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.55
+  version: 2.0.59
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2021-09-14 00:00:00.000000000 Z
+date: 2021-10-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake