metasploit-payloads 2.0.59 → 2.0.63

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 117ff7aceaeba0fa89fb3018437e5c3b66decab1ab147ed014de07b30e23758f
-  data.tar.gz: d467e15ae88149f1a945d894d1e1d21c3511c8e249d3973e8b0c71b24ed4110f
+  metadata.gz: 70fb6b8c214c2032e3f506341d7f9b069e93639b6abf7afbd3fd279ea087d9e6
+  data.tar.gz: a2541c9ad2051533ee66ea252f3fa1d84774f7dbea2dbe823fa45b50e8add977
 SHA512:
-  metadata.gz: 81f991b1b37db4c154663dec36df1a67d0cee57191d9d53c0dfe6a498ef68578d4f33ab10824603764cd8f2c6b34fbe527d115176433d5bb5c20ff7d1c3690a6
-  data.tar.gz: 7436e234074f93cc0debeece05ef48aa447a360dc6bede6ddb0f22cc1e96c74981b226344200b5db5e6913b2dc9ec053adeb9db1484ed665e6aa344cc68491a5
+  metadata.gz: 8938435f3345901ff7d6401ae487ae12117f09035c8fd4cc74d733eebb56a1d731b045321b5ad6aaac42ade9a884e284ab36358589857bd195443ae8e5ae9db1
+  data.tar.gz: ac0be6bedfaf25d2b3c102f42f020625d110d63d559b8361ae2b1f8199ad1df214e489bd3dbb0e251ec4c10d50e6df61a4839f929b868ba74a1cc0214677d1b5

data/data/meterpreter/ext_server_stdapi.php

@@ -461,7 +461,8 @@ function resolve_host($hostname, $family) {
     } elseif ($family == AF_INET6) {
         $dns_family = DNS_AAAA;
     } else {
-        throw new Exception('invalid family, must be AF_INET or AF_INET6');
+        my_print('invalid family, must be AF_INET or AF_INET6');
+        return NULL;
     }
 
     $dns = dns_get_record($hostname, $dns_family);
@@ -1224,15 +1225,18 @@ if (!function_exists('stdapi_net_resolve_host')) {
 register_command('stdapi_net_resolve_host', COMMAND_ID_STDAPI_NET_RESOLVE_HOST);
 function stdapi_net_resolve_host($req, &$pkt) {
     my_print("doing stdapi_net_resolve_host");
-    $hostname = packet_get_tlv($req, TLV_TYPE_HOST_NAME)['value'];
-    $family = packet_get_tlv($req, TLV_TYPE_ADDR_TYPE)['value'];
+    $hostname_tlv = packet_get_tlv($req, TLV_TYPE_HOST_NAME);
+    $hostname = $hostname['value'];
+    $family_tlv = packet_get_tlv($req, TLV_TYPE_ADDR_TYPE);
+    $family = $family['value'];
 
     if ($family == WIN_AF_INET) {
         $family = AF_INET;
     } elseif ($family == WIN_AF_INET6) {
         $family = AF_INET6;
     } else {
-        throw new Exception('invalid family');
+        my_print('invalid family, must be AF_INET or AF_INET6');
+        return ERROR_FAILURE;
     }
 
     $ret = ERROR_FAILURE;
@@ -1250,14 +1254,16 @@ if (!function_exists('stdapi_net_resolve_hosts')) {
 register_command('stdapi_net_resolve_hosts', COMMAND_ID_STDAPI_NET_RESOLVE_HOSTS);
 function stdapi_net_resolve_hosts($req, &$pkt) {
     my_print("doing stdapi_net_resolve_hosts");
-    $family = packet_get_tlv($req, TLV_TYPE_ADDR_TYPE)['value'];
+    $family_tlv = packet_get_tlv($req, TLV_TYPE_ADDR_TYPE);
+    $family = $family_tlv['value'];
 
     if ($family == WIN_AF_INET) {
         $family = AF_INET;
     } elseif ($family == WIN_AF_INET6) {
         $family = AF_INET6;
     } else {
-        throw new Exception('invalid family');
+        my_print('invalid family, must be AF_INET or AF_INET6');
+        return ERROR_FAILURE;
     }
 
     $hostname_tlvs = packet_get_all_tlvs($req, TLV_TYPE_HOST_NAME);

data/data/meterpreter/ext_server_stdapi.py

@@ -662,6 +662,7 @@ PROCESS_EXECUTE_FLAG_CHANNELIZED = (1 << 1)
 PROCESS_EXECUTE_FLAG_SUSPENDED = (1 << 2)
 PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN = (1 << 3)
 PROCESS_EXECUTE_FLAG_SUBSHELL         = (1 << 6)
+PROCESS_EXECUTE_FLAG_PTY              = (1 << 7)
 
 PROCESS_ARCH_UNKNOWN = 0
 PROCESS_ARCH_X86 = 1
@@ -1146,6 +1147,8 @@ def stdapi_sys_process_close(request, response):
     proc_h_id = proc_h_id['value']
     if proc_h_id in meterpreter.processes:
         del meterpreter.processes[proc_h_id]
+    if not meterpreter.close_channel(proc_h_id):
+        return ERROR_FAILURE, response
     return ERROR_SUCCESS, response
 
 @register_function
@@ -1166,7 +1169,7 @@ def stdapi_sys_process_execute(request, response):
         args.extend(shlex.split(raw_args))
 
     if (flags & PROCESS_EXECUTE_FLAG_CHANNELIZED):
-        if has_pty:
+        if has_pty and (flags & PROCESS_EXECUTE_FLAG_PTY):
             master, slave = pty.openpty()
             if has_termios:
                 try:

data/data/meterpreter/meterpreter.py

@@ -667,6 +667,7 @@ class MeterpreterProcess(MeterpreterChannel):
             self.proc_h.kill()
         if self.proc_h.ptyfd is not None:
             os.close(self.proc_h.ptyfd)
+            self.proc_h.ptyfd = None
         for stream in (self.proc_h.stdin, self.proc_h.stdout, self.proc_h.stderr):
             if not hasattr(stream, 'close'):
                 continue
@@ -1241,6 +1242,21 @@ class PythonMeterpreter(object):
         self.next_process_id += 1
         return idx
 
+    def close_channel(self, channel_id):
+        if channel_id not in self.channels:
+            return False
+        channel = self.channels[channel_id]
+        try:
+            channel.close()
+        except Exception:
+            debug_traceback('[-] failed to close channel id: ' + str(channel_id))
+            return False
+        del self.channels[channel_id]
+        if channel_id in self.interact_channels:
+            self.interact_channels.remove(channel_id)
+        debug_print('[*] closed and removed channel id: ' + str(channel_id))
+        return True
+
     def get_packet(self):
         pkt = self.transport.get_packet()
         if pkt is None and self.transport.should_retire:
@@ -1362,7 +1378,6 @@ class PythonMeterpreter(object):
                     self.send_packet(tlv_pack_request('core_channel_write', write_request_parts))
 
     def handle_dead_resource_channel(self, channel_id):
-        del self.channels[channel_id]
         if channel_id in self.interact_channels:
             self.interact_channels.remove(channel_id)
         self.send_packet(tlv_pack_request('core_channel_close', [
@@ -1570,16 +1585,9 @@ class PythonMeterpreter(object):
 
     def _core_channel_close(self, request, response):
         channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']
-        if channel_id not in self.channels:
+        if not self.close_channel(channel_id):
             return ERROR_FAILURE, response
-        channel = self.channels[channel_id]
-        status, response = channel.core_close(request, response)
-        if status == ERROR_SUCCESS:
-            del self.channels[channel_id]
-            if channel_id in self.interact_channels:
-                self.interact_channels.remove(channel_id)
-            debug_print('[*] closed and removed channel id: ' + str(channel_id))
-        return status, response
+        return ERROR_SUCCESS, response
 
     def _core_channel_eof(self, request, response):
         channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.59'
+  VERSION = '2.0.63'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.59
+  version: 2.0.63
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2021-10-03 00:00:00.000000000 Z
+date: 2021-12-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake