metasploit-payloads 2.0.62 → 2.0.66

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f11c89ff68506ca3906f6bf9be54f30a50b8ecb28b5c20f97457b3fe65e9d691
-  data.tar.gz: 9fb91f65b221c56d0b9378a17af6a1ec011bc6470ecd6afd706ec02b9bcfe9cf
+  metadata.gz: 674ebea21d34814be442241a307a18c2c362d6b3674ec27ac88658f255c5d696
+  data.tar.gz: e4f0620176a20f1e64c5a5820da529e49759e9da1b085ec283fac1e52ad72454
 SHA512:
-  metadata.gz: 13abd29d883b5165e51baff0e3c5402a4b350dd0c964d3b4028a031c116fa2980d52fc647a0eda358f5255ae495e173577ebc500dd66b3b8e116d2dec2f2d49b
-  data.tar.gz: d437c893d638680d064f902c0cd142aa3771049d456967f5ded448dd5f0fe827877879571bed4b64322c7c33e5ab70f7314948676d42bfe2a7c70a3e659297a4
+  metadata.gz: 47aa9480390d587667b28cd42d8ab5f9cdb076c9f8d57fb2dc38fb57f6cd3ccea68a439c1e254badfa28af616f6b4caeed4c916fd8f0ebd116e8b5323767512f
+  data.tar.gz: a028d339bc7e94955ffc30453c3410b25233fbbf6a3ece004780b8eeeb06c9df07ed02ba2be85ff2ff56101d909b32544dd702ebe554dc2f61e73cbf8ef0279f

data/data/meterpreter/ext_server_stdapi.php

@@ -628,8 +628,10 @@ function stdapi_fs_ls($req, &$pkt) {
                 packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $file));
                 packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_PATH, $path . DIRECTORY_SEPARATOR . $file));
                 $st_buf = add_stat_buf($path . DIRECTORY_SEPARATOR . $file);
-                if ($st_buf)
-                    packet_add_tlv($pkt, $st_buf);
+                if (!$st_buf) {
+                    $st_buf = create_tlv(TLV_TYPE_STAT_BUF32, '');
+                }
+                packet_add_tlv($pkt, $st_buf);
             }
         }
         closedir($dir_handle);

data/data/meterpreter/ext_server_stdapi.py

@@ -1147,6 +1147,8 @@ def stdapi_sys_process_close(request, response):
     proc_h_id = proc_h_id['value']
     if proc_h_id in meterpreter.processes:
         del meterpreter.processes[proc_h_id]
+    if not meterpreter.close_channel(proc_h_id):
+        return ERROR_FAILURE, response
     return ERROR_SUCCESS, response
 
 @register_function
@@ -1161,7 +1163,9 @@ def stdapi_sys_process_execute(request, response):
     if len(cmd) == 0:
         return ERROR_FAILURE, response
     if os.path.isfile('/bin/sh') and (flags & PROCESS_EXECUTE_FLAG_SUBSHELL):
-        args = ['/bin/sh', '-c', cmd, raw_args]
+        if raw_args:
+            cmd = cmd + ' ' + raw_args
+        args = ['/bin/sh', '-c', cmd]
     else:
         args = [cmd]
         args.extend(shlex.split(raw_args))
@@ -1490,7 +1494,11 @@ def stdapi_fs_ls(request, response):
         file_path = os.path.join(path, file_name)
         response += tlv_pack(TLV_TYPE_FILE_NAME, file_name)
         response += tlv_pack(TLV_TYPE_FILE_PATH, file_path)
-        response += tlv_pack(TLV_TYPE_STAT_BUF, get_stat_buffer(file_path))
+        try:
+            st_buf = get_stat_buffer(file_path)
+        except OSError:
+            st_buf = bytes()
+        response += tlv_pack(TLV_TYPE_STAT_BUF, st_buf)
     return ERROR_SUCCESS, response
 
 @register_function

data/data/meterpreter/meterpreter.py

@@ -680,10 +680,13 @@ class MeterpreterProcess(MeterpreterChannel):
         return self.proc_h.poll() is None
 
     def read(self, length):
-        data = ''
+        data = bytes()
+        stderr_reader = self.proc_h.stderr_reader
         stdout_reader = self.proc_h.stdout_reader
-        if stdout_reader.is_read_ready():
-            data = stdout_reader.read(length)
+        if stderr_reader.is_read_ready() and length > 0:
+            data += stderr_reader.read(length)
+        if stdout_reader.is_read_ready() and (length - len(data)) > 0:
+            data += stdout_reader.read(length - len(data))
         return data
 
     def write(self, data):
@@ -1242,6 +1245,21 @@ class PythonMeterpreter(object):
         self.next_process_id += 1
         return idx
 
+    def close_channel(self, channel_id):
+        if channel_id not in self.channels:
+            return False
+        channel = self.channels[channel_id]
+        try:
+            channel.close()
+        except Exception:
+            debug_traceback('[-] failed to close channel id: ' + str(channel_id))
+            return False
+        del self.channels[channel_id]
+        if channel_id in self.interact_channels:
+            self.interact_channels.remove(channel_id)
+        debug_print('[*] closed and removed channel id: ' + str(channel_id))
+        return True
+
     def get_packet(self):
         pkt = self.transport.get_packet()
         if pkt is None and self.transport.should_retire:
@@ -1314,9 +1332,9 @@ class PythonMeterpreter(object):
                     if channel_id in self.interact_channels:
                         proc_h = channel.proc_h
                         if proc_h.stderr_reader.is_read_ready():
-                            data = proc_h.stderr_reader.read()
-                        elif proc_h.stdout_reader.is_read_ready():
-                            data = proc_h.stdout_reader.read()
+                            data += proc_h.stderr_reader.read()
+                        if proc_h.stdout_reader.is_read_ready():
+                            data += proc_h.stdout_reader.read()
                     if not channel.is_alive():
                         self.handle_dead_resource_channel(channel_id)
                         channel.close()
@@ -1570,16 +1588,9 @@ class PythonMeterpreter(object):
 
     def _core_channel_close(self, request, response):
         channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']
-        if channel_id not in self.channels:
+        if not self.close_channel(channel_id):
             return ERROR_FAILURE, response
-        channel = self.channels[channel_id]
-        status, response = channel.core_close(request, response)
-        if status == ERROR_SUCCESS:
-            del self.channels[channel_id]
-            if channel_id in self.interact_channels:
-                self.interact_channels.remove(channel_id)
-            debug_print('[*] closed and removed channel id: ' + str(channel_id))
-        return status, response
+        return ERROR_SUCCESS, response
 
     def _core_channel_eof(self, request, response):
         channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.62'
+  VERSION = '2.0.66'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.62
+  version: 2.0.66
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2021-12-07 00:00:00.000000000 Z
+date: 2021-12-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake