metasploit-payloads 2.0.110 → 2.0.111

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 64de577065bf9307467789a2223a1c49cf8676525a0b0c9abfe63c09db9fddac
-  data.tar.gz: 7617cc80525c7eafbb908a141d0f3cfa7bf0e2fe4e2fba2a45892b60788efd9b
+  metadata.gz: 7909c1b37004dee1af5bed7dbe25381e5a3fcaba7a7d0ee4101f5e518aef6a36
+  data.tar.gz: e438b3747393682ffe47594ce438ed27086781602b524071aa73c51f7477e07a
 SHA512:
-  metadata.gz: 54eff4b6a2279c30fafceb7d80fe2583868349f9a560d7c08a9f6cbe804c7aacbc95f86c006d5e2927510693aac66d176df82811bef312eb5f2723a359bc585a
-  data.tar.gz: cb7f5f78770c1f99fc78335e2246e78c96f3e1ac29d9c054bc37ae5deeeb072618f5708e40f8324734b1b4c2d09eb9201f712e6685c6e3447e51cb5c04320f4b
+  metadata.gz: cda77751aa1547b93c6be12c0fe4fbedafa915bf5f34a1931d6bef4e44ad6c7c0a89a96fbe6b4878c050a196aa9fd6032800341a38826b5718d0fa3695772240
+  data.tar.gz: d40c9e8db0fd4d02e8f8e807fc26ce095b6703548de0c74cce5ad514a9082cee4ebe3b0010d4f2ab1b978d93c79c7184249540839e52f89b1b3bdb7bc8c594b4

data/data/meterpreter/ext_server_stdapi.py

@@ -489,6 +489,7 @@ TLV_TYPE_HANDLE                = TLV_META_TYPE_QWORD   | 600
 TLV_TYPE_INHERIT               = TLV_META_TYPE_BOOL    | 601
 TLV_TYPE_PROCESS_HANDLE        = TLV_META_TYPE_QWORD   | 630
 TLV_TYPE_THREAD_HANDLE         = TLV_META_TYPE_QWORD   | 631
+TLV_TYPE_PRIVILEGE             = TLV_META_TYPE_STRING  | 632
 
 ##
 # Fs
@@ -749,6 +750,25 @@ VER_PLATFORM_WIN32s               = 0x0000
 VER_PLATFORM_WIN32_WINDOWS        = 0x0001
 VER_PLATFORM_WIN32_NT             = 0x0002
 
+# Token Constants
+TOKEN_ASSIGN_PRIMARY              = 0x0001
+TOKEN_DUPLICATE                   = 0x0002
+TOKEN_IMPERSONATE                 = 0x0004
+TOKEN_QUERY                       = 0x0008
+TOKEN_QUERY_SOURCE                = 0x0010
+TOKEN_ADJUST_PRIVILEGES           = 0x0020
+TOKEN_ADJUST_GROUPS               = 0x0040
+TOKEN_ADJUST_DEFAULT              = 0x0080
+TOKEN_ADJUST_SESSIONID            = 0x0100
+TOKEN_ALL_ACCESS                  = 0xf01ff
+
+# Privilege Constants
+DISABLED                          = 0x0
+SE_PRIVILEGE_ENABLED_BY_DEFAULT   = 0x1
+SE_PRIVILEGE_ENABLED              = 0x2
+SE_PRIVILEGE_REMOVED              = 0x4
+SE_PRIVILEGE_USED_FOR_ACCESS      = 0x800000000
+
 # Windows Access Controls
 MAXIMUM_ALLOWED                   = 0x02000000
 
@@ -855,7 +875,6 @@ def get_stat_buffer(path):
     return st_buf
 
 def get_token_user(handle):
-    TOKEN_QUERY = 0x0008
     TokenUser = 1
     advapi32 = ctypes.windll.advapi32
     advapi32.OpenProcessToken.argtypes = [ctypes.c_void_p, ctypes.c_uint32, ctypes.POINTER(ctypes.c_void_p)]
@@ -1054,9 +1073,6 @@ def windll_GetVersion():
     return type('Version', (object,), dict(dwMajorVersion = dwMajorVersion, dwMinorVersion = dwMinorVersion, dwBuild = dwBuild))
 
 def enable_privilege(name, enable=True):
-    TOKEN_ALL_ACCESS = 0xf01ff
-    SE_PRIVILEGE_ENABLED = 0x00000002
-
     GetCurrentProcess = ctypes.windll.kernel32.GetCurrentProcess
     GetCurrentProcess.restype = ctypes.c_void_p
 
@@ -1216,6 +1232,81 @@ def stdapi_sys_config_getuid(request, response):
     response += tlv_pack(TLV_TYPE_USER_NAME, username)
     return ERROR_SUCCESS, response
 
+@register_function_if(has_windll)
+def stdapi_sys_config_getprivs(request, response):
+    GetCurrentProcess = ctypes.windll.kernel32.GetCurrentProcess
+    GetCurrentProcess.restype = ctypes.c_void_p
+
+    advapi32 = ctypes.windll.advapi32
+    OpenProcessToken = advapi32.OpenProcessToken
+    OpenProcessToken.argtypes = [ctypes.c_void_p, ctypes.c_uint32, ctypes.POINTER(ctypes.c_void_p)]
+    OpenProcessToken.restype = ctypes.c_bool
+
+    LookupPrivilegeValue = advapi32.LookupPrivilegeValueW
+    LookupPrivilegeValue.argtypes = [ctypes.c_wchar_p, ctypes.c_wchar_p, ctypes.POINTER(LUID)]
+    LookupPrivilegeValue.restype = ctypes.c_bool
+
+    AdjustTokenPrivileges = advapi32.AdjustTokenPrivileges
+    AdjustTokenPrivileges.argtypes = [ctypes.c_void_p, ctypes.c_bool, PTOKEN_PRIVILEGES, ctypes.c_uint32, PTOKEN_PRIVILEGES, ctypes.POINTER(ctypes.c_uint32)]
+    AdjustTokenPrivileges.restype = ctypes.c_bool
+
+    token = ctypes.c_void_p()
+    success = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, token)
+    if not success:
+        return error_result_windows(), response
+
+    priv_list = [
+        "SeAssignPrimaryTokenPrivilege",
+        "SeAuditPrivilege",
+        "SeBackupPrivilege",
+        "SeChangeNotifyPrivilege",
+        "SeCreatePagefilePrivilege",
+        "SeCreatePermanentPrivilege",
+        "SeCreateTokenPrivilege",
+        "SeDebugPrivilege",
+        "SeIncreaseBasePriorityPrivilege",
+        "SeIncreaseQuotaPrivilege",
+        "SeLoadDriverPrivilege",
+        "SeLockMemoryPrivilege",
+        "SeMachineAccountPrivilege",
+        "SeProfileSingleProcessPrivilege",
+        "SeRemoteShutdownPrivilege",
+        "SeRestorePrivilege",
+        "SeSecurityPrivilege",
+        "SeShutdownPrivilege",
+        "SeSystemEnvironmentPrivilege",
+        "SeSystemProfilePrivilege",
+        "SeSystemtimePrivilege",
+        "SeTakeOwnershipPrivilege",
+        "SeTcbPrivilege",
+        "SeCreateGlobalPrivilege",
+        "SeCreateSymbolicLinkPrivilege",
+        "SeEnableDelegationPrivilege",
+        "SeImpersonatePrivilege",
+        "SeIncreaseWorkingSetPrivilege",
+        "SeManageVolumePrivilege",
+        "SeRelabelPrivilege",
+        "SeSyncAgentPrivilege",
+        "SeTimeZonePrivilege",
+        "SeTrustedCredManAccessPrivilege",
+        "SeDelegateSessionUserImpersonatePrivilege"
+    ]
+    for privilege in priv_list:
+        luid = LUID()
+        name = ctypes.create_unicode_buffer(privilege)
+        success = LookupPrivilegeValue(None, name, luid)
+        if success:
+            size = ctypes.sizeof(TOKEN_PRIVILEGES)
+            size += ctypes.sizeof(LUID_AND_ATTRIBUTES)
+            buffer = ctypes.create_string_buffer(size)
+            tokenPrivileges = ctypes.cast(buffer, PTOKEN_PRIVILEGES).contents
+            tokenPrivileges.PrivilegeCount = 1
+            tokenPrivileges.get_array()[0].Luid = luid
+            tokenPrivileges.get_array()[0].Attributes = SE_PRIVILEGE_ENABLED
+            if AdjustTokenPrivileges(token, False, tokenPrivileges, 0, None, None):
+                response += tlv_pack(TLV_TYPE_PRIVILEGE, privilege)
+    return ERROR_SUCCESS, response
+
 @register_function
 def stdapi_sys_config_localtime(request, response):
     localtime = time.strftime("%Y-%m-%d %H:%M:%S %Z", time.localtime())
@@ -1374,8 +1465,6 @@ def stdapi_sys_process_get_processes_via_ps(request, response):
 
 def stdapi_sys_process_get_processes_via_windll(request, response):
     TH32CS_SNAPPROCESS = 2
-    TOKEN_QUERY = 0x0008
-    TokenUser = 1
     k32 = ctypes.windll.kernel32
     pe32 = PROCESSENTRY32()
     pe32.dwSize = ctypes.sizeof(PROCESSENTRY32)
@@ -1435,7 +1524,6 @@ def stdapi_sys_process_get_processes(request, response):
         return stdapi_sys_process_get_processes_via_windll(request, response)
     else:
         return stdapi_sys_process_get_processes_via_ps(request, response)
-    return ERROR_FAILURE, response
 
 @register_function_if(has_windll)
 def stdapi_sys_power_exitwindows(request, response):

data/lib/metasploit-payloads/version.rb

@@ -1,6 +1,6 @@
 # -*- coding:binary -*-
 module MetasploitPayloads
-  VERSION = '2.0.110'
+  VERSION = '2.0.111'
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-payloads
 version: !ruby/object:Gem::Version
-  version: 2.0.110
+  version: 2.0.111
 platform: ruby
 authors:
 - OJ Reeves