metasploit-payloads 2.0.101 → 2.0.102

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ba4b3fb0b4e329a16a8b7a782dd2d31a795293e904f59d0bea8b30310f9d3d60
-  data.tar.gz: b31cd2746599b6f9c764231e84c451a54632fe0227db51be98c403b38f686724
+  metadata.gz: dfdd8851985d5249c1665ea15b2c2fb4ba0871e8eedb1c12dfcfdbe82702ac27
+  data.tar.gz: a2547c05feeca62ca2a269af361ecd48ebcb589ba4459a42f339b8dc3ab07384
 SHA512:
-  metadata.gz: 859d38833aec34972b6225bb0cbc8153bf5e5815e67fdc5200b9b5e1076381d20b8fadd5e2ecca26c7b756e1ebd6d79f0e342c02b970c4f19738bb8a04437f58
-  data.tar.gz: 9d51544d265cb249cb1e668b24eef32f29746718a3905b59d0cd4cb361b12164d6afee2e03657e5cfa2ed8f558dce917fd0f3db80607d8416d05247844d5a896
+  metadata.gz: c71b217dc011367c228c6d65ce6054731b5219b4979b7fa2f7ef88759b346affb78179ee1b2467f0bc893c3d87887c612c3f6d330d2096e964a52de77adaf995
+  data.tar.gz: ae8b718e8c46fa54a557e18669c58de1dc7ee21b00a3be2ecd6cc51397ce0fba6e95b158c39ff488e9265d7e90186c2b35e1713054b26b81481f22ec04ff5633

data/data/meterpreter/ext_server_stdapi.py

@@ -386,6 +386,17 @@ if has_ctypes:
 
     PTOKEN_PRIVILEGES = ctypes.POINTER(TOKEN_PRIVILEGES)
 
+    MAXLEN_PHYSADDR = 8
+
+    class MIB_IPNETROW(ctypes.Structure):
+        _fields_ = [
+            ('dwIndex', ctypes.c_uint32),
+            ('dwPhysAddrLen', ctypes.c_uint32),
+            ('bPhysAddr', ctypes.c_byte * MAXLEN_PHYSADDR),
+            ('dwAddr', ctypes.c_uint32),
+            ('dwType', ctypes.c_uint32)
+        ]
+
 
     #
     # Linux Structures
@@ -522,6 +533,7 @@ TLV_TYPE_NETMASK               = TLV_META_TYPE_RAW     | 1421
 TLV_TYPE_GATEWAY               = TLV_META_TYPE_RAW     | 1422
 TLV_TYPE_NETWORK_ROUTE         = TLV_META_TYPE_GROUP   | 1423
 TLV_TYPE_IP_PREFIX             = TLV_META_TYPE_UINT    | 1424
+TLV_TYPE_ARP_ENTRY             = TLV_META_TYPE_GROUP   | 1425
 
 TLV_TYPE_IP                    = TLV_META_TYPE_RAW     | 1430
 TLV_TYPE_MAC_ADDRESS           = TLV_META_TYPE_RAW     | 1431
@@ -706,6 +718,10 @@ ERROR_SUCCESS = 0
 # not defined in original C implementation
 ERROR_FAILURE = 1
 
+ERROR_INSUFFICIENT_BUFFER = 0x0000007a
+ERROR_NOT_SUPPORTED = 0x00000032
+ERROR_NO_DATA = 0x000000e8
+
 # Special return value to match up with Windows error codes for network
 # errors.
 ERROR_CONNECTION_ERROR = 10000
@@ -1712,6 +1728,49 @@ def stdapi_fs_mount_show(request, response):
         response += tlv_pack(TLV_TYPE_MOUNT_GROUP, mount)
     return ERROR_SUCCESS, response
 
+@register_function_if(has_windll)
+def stdapi_net_config_get_arp_table(request, response):
+    MIB_IPNET_TYPE_DYNAMIC = 3
+    MIB_IPNET_TYPE_STATIC  = 4
+
+    GetIpNetTable = ctypes.windll.iphlpapi.GetIpNetTable
+    GetIpNetTable.argtypes = [ctypes.c_void_p, ctypes.POINTER(ctypes.c_ulong), ctypes.c_long]
+    GetIpNetTable.restype = ctypes.c_ulong
+
+    ipnet_table = None
+    size = ctypes.c_ulong(0)
+    result = GetIpNetTable(ipnet_table, size, False)
+
+    if result == ERROR_INSUFFICIENT_BUFFER:
+        ipnet_table = ctypes.cast(ctypes.create_string_buffer(b'', size.value), ctypes.c_void_p)
+
+    elif result != ERROR_SUCCESS and result != ERROR_NO_DATA:
+        return error_result_windows(result), response
+
+    if not ipnet_table:
+        return error_result_windows(), response
+
+    result = GetIpNetTable(ipnet_table, size, False)
+    if result != ERROR_SUCCESS:
+        return error_result_windows(result), response
+
+    class MIB_IPNETTABLE(ctypes.Structure):
+        _fields_ = [
+            ('dwNumEntries', ctypes.c_uint32),
+            ('table', MIB_IPNETROW * ctypes.cast(ipnet_table.value, ctypes.POINTER(ctypes.c_ulong)).contents.value)
+        ]
+    
+    ipnet_table = ctypes.cast(ipnet_table, ctypes.POINTER(MIB_IPNETTABLE))
+    for ipnet_row in ipnet_table.contents.table:
+        if (ipnet_row.dwType != MIB_IPNET_TYPE_DYNAMIC and ipnet_row.dwType != MIB_IPNET_TYPE_STATIC):
+            continue
+        arp_tlv  = bytes()
+        arp_tlv += tlv_pack(TLV_TYPE_IP, struct.pack('<L', ipnet_row.dwAddr))
+        arp_tlv += tlv_pack(TLV_TYPE_MAC_ADDRESS, bytes(ipnet_row.bPhysAddr)[:ipnet_row.dwPhysAddrLen])
+        arp_tlv += tlv_pack(TLV_TYPE_MAC_NAME, str(ipnet_row.dwIndex))
+        response += tlv_pack(TLV_TYPE_ARP_ENTRY, arp_tlv)
+    return ERROR_SUCCESS, response
+
 @register_function
 def stdapi_net_config_get_interfaces(request, response):
     if hasattr(socket, 'AF_NETLINK') and hasattr(socket, 'NETLINK_ROUTE'):

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.101'
+  VERSION = '2.0.102'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.101
+  version: 2.0.102
 platform: ruby
 authors:
 - OJ Reeves
@@ -96,7 +96,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2022-11-15 00:00:00.000000000 Z
+date: 2022-12-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake