metasploit-payloads 2.0.97 → 2.0.99

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 49f65721e1a9aa745903acaa4c78087d20494cd1cc064e4101ce866eb62eb7fb
-  data.tar.gz: be91cc58bcee64d662b1b292fd342f4d7db00a8444edaeaa829011b922c497a3
+  metadata.gz: 9cfe995bf9b1af59ff233551ed954d4e53efd2e6a86943f95803512ee3024727
+  data.tar.gz: 15ec398c67dbf9bca1ee55b316173fc95943260ffedaa331726dba2836dcb02e
 SHA512:
-  metadata.gz: 26baf826a30e01d34f7f7cc65d733ff97a0677fa9a315ddc167a3522dae0b56972a8f5ea3963c0765c8e8b398edcbd404720d29bb35b0ae2c380a39c62ca47c0
-  data.tar.gz: db20a24fb97fe4b781708c7df06ee2b92f04d0440c7c983b368cafa367fb67c40101a6168d7848f4606f38f119bef7b4de0cca3fcfa65561dcc575f30baa5d6d
+  metadata.gz: b7b83890bdd1a025895ebb590464a0a1b8d36e29dde9547646d6bc5baa36d7baca63ada990d07e551443118759ef20fc32a4c93575de9eca3f10a9ad6b757dfb
+  data.tar.gz: cd99d8855d51f2d51b42d8b5d5fd2e43540b9442f1a0297251e75fad98ea21fee6312ce525ca7e359d360cbb231224c8c305cfaac748a0feecff13a205ff367d

data/data/meterpreter/ext_server_stdapi.py

@@ -357,6 +357,36 @@ if has_ctypes:
             ("lpszProxy", ctypes.c_wchar_p),
             ("lpszProxyBypass", ctypes.c_wchar_p)]
 
+    class LUID(ctypes.Structure):
+        _fields_ = [
+            ('LowPart',  ctypes.c_uint32),
+            ('HighPart', ctypes.c_long)
+        ]
+
+        def __eq__(self, __o):
+            return (self.LowPart == __o.LowPart and self.HighPart == __o.HighPart)
+
+        def __ne__(self, __o):
+            return (self.LowPart != __o.LowPart or self.HighPart != __o.HighPart)
+
+    class LUID_AND_ATTRIBUTES(ctypes.Structure):
+        _fields_ = [
+            ('Luid',       LUID),
+            ('Attributes', ctypes.c_uint32)
+        ]
+
+    class TOKEN_PRIVILEGES(ctypes.Structure):
+        _fields_ = [
+            ('PrivilegeCount', ctypes.c_uint32),
+            ('Privileges',     LUID_AND_ATTRIBUTES * 0),
+        ]
+        def get_array(self):
+            array_type = LUID_AND_ATTRIBUTES * self.PrivilegeCount
+            return ctypes.cast(self.Privileges, ctypes.POINTER(array_type)).contents
+
+    PTOKEN_PRIVILEGES = ctypes.POINTER(TOKEN_PRIVILEGES)
+
+
     #
     # Linux Structures
     #
@@ -999,6 +1029,45 @@ def windll_GetVersion():
     dwBuild        = ((dwVersion & 0xffff0000) >> 16)
     return type('Version', (object,), dict(dwMajorVersion = dwMajorVersion, dwMinorVersion = dwMinorVersion, dwBuild = dwBuild))
 
+def enable_privilege(name, enable=True):
+    TOKEN_ALL_ACCESS = 0xf01ff
+    SE_PRIVILEGE_ENABLED = 0x00000002
+
+    GetCurrentProcess = ctypes.windll.kernel32.GetCurrentProcess
+    GetCurrentProcess.restype = ctypes.c_void_p
+
+    OpenProcessToken = ctypes.windll.advapi32.OpenProcessToken
+    OpenProcessToken.argtypes = [ctypes.c_void_p, ctypes.c_uint32, ctypes.POINTER(ctypes.c_void_p)]
+    OpenProcessToken.restype = ctypes.c_bool
+
+    LookupPrivilegeValue = ctypes.windll.advapi32.LookupPrivilegeValueW
+    LookupPrivilegeValue.argtypes = [ctypes.c_wchar_p, ctypes.c_wchar_p, ctypes.POINTER(LUID)]
+    LookupPrivilegeValue.restype = ctypes.c_bool
+
+    AdjustTokenPrivileges = ctypes.windll.advapi32.AdjustTokenPrivileges
+    AdjustTokenPrivileges.argtypes = [ctypes.c_void_p, ctypes.c_bool, PTOKEN_PRIVILEGES, ctypes.c_uint32, PTOKEN_PRIVILEGES, ctypes.POINTER(ctypes.c_uint32)]
+    AdjustTokenPrivileges.restype = ctypes.c_bool
+
+    token = ctypes.c_void_p()
+    success = OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, token)
+    if not success:
+        return False
+
+    luid = LUID()
+    name = ctypes.create_unicode_buffer(name)
+    success = LookupPrivilegeValue(None, name, luid)
+    if not success:
+        return False
+
+    size = ctypes.sizeof(TOKEN_PRIVILEGES)
+    size += ctypes.sizeof(LUID_AND_ATTRIBUTES)
+    buffer = ctypes.create_string_buffer(size)
+    tokenPrivileges = ctypes.cast(buffer, PTOKEN_PRIVILEGES).contents
+    tokenPrivileges.PrivilegeCount = 1
+    tokenPrivileges.get_array()[0].Luid = luid
+    tokenPrivileges.get_array()[0].Attributes = SE_PRIVILEGE_ENABLED if enable else 0
+    return AdjustTokenPrivileges(token, False, tokenPrivileges, 0, None, None)
+
 @register_function
 def channel_open_stdapi_fs_file(request, response):
     fpath = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
@@ -1335,6 +1404,23 @@ def stdapi_sys_process_get_processes(request, response):
         return stdapi_sys_process_get_processes_via_ps(request, response)
     return ERROR_FAILURE, response
 
+@register_function_if(has_windll)
+def stdapi_sys_power_exitwindows(request, response):
+    SE_SHUTDOWN_NAME = "SeShutdownPrivilege"
+
+    flags = packet_get_tlv(request, TLV_TYPE_POWER_FLAGS)['value']
+    reason = packet_get_tlv(request, TLV_TYPE_POWER_REASON)['value']
+
+    if not enable_privilege(SE_SHUTDOWN_NAME):
+        return error_result_windows(), response
+
+    ExitWindowsEx = ctypes.windll.user32.ExitWindowsEx
+    ExitWindowsEx.argtypes = [ctypes.c_uint32, ctypes.c_ulong]
+    ExitWindowsEx.restype = ctypes.c_int8
+    if not ExitWindowsEx(flags, reason):
+        return error_result_windows(), response
+    return ERROR_SUCCESS, response
+
 @register_function_if(has_windll)
 def stdapi_sys_eventlog_open(request, response):
     source_name = packet_get_tlv(request, TLV_TYPE_EVENT_SOURCENAME)['value']

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.97'
+  VERSION = '2.0.99'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.97
+  version: 2.0.99
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2022-09-29 00:00:00.000000000 Z
+date: 2022-11-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake

metadata.gz.sig

@@ -1,3 +1,2 @@
- jA����AXoX.�p��A�o�:�9��UG����"+/P��R�g��>��jy۱"1Q
-L������o.���5;�G�5�u����S
-��6l�7~���3�{��DUHՃ ��d6Yn���R���7��Li�SO�I��̡�p�8��5L��~p,����3�Ff�7��$���n57
+�(	�!�3o��k1�I&6
io�rPGO��XK�Y��U9|
+�